Ellaverse: designing a parent onboarding flow where the law writes half the spec.
A per-child AI companion for kids, configured by a parent. Under thirteen, COPPA sets hard rules on what can be collected and when. The onboarding flow had to satisfy those rules, be finishable by a tired parent in a few minutes, and set up a safety system the parent could understand without reading a policy page.
Two users, one flow, and only one of them is allowed to make decisions.
The child is the daily user. The parent is the account owner, the configurer, and the only person who can consent. Every screen had to be unambiguous about which of them it was for, and the child's experience could not depend on the child entering anything a regulator would call personal information.
The second problem is harder. Once the product promises "we alert you if something concerning comes up," a missed alert becomes a liability and a false alarm becomes a trust problem. The parent has to understand what the system will and won't catch before they rely on it.
Parent sets up. Child never sees a form.
- The age band is a parent decision, not a child input. Asking a child their age is both a compliance problem and an unreliable signal. The parent chooses, and the choice changes the whole experience.
- Setup runs once. After a profile exists, the setup route refuses to run again. Re-configuration happens inside the PIN-gated parent dashboard, so a child can't wander into setup.
- Profiles are device-bound by strict cookie. No silent fallback to "the first profile" if the cookie is missing. Ambiguity about which child is talking is a safety failure.
Three layers, explained as three sentences.
The safety stack is technically involved: a normalized pattern classifier that catches homoglyph and leet-speak evasion, an optional language-model input classifier, and an output verifier that fails closed on concerning turns and falls back to a curated response bank. The parent doesn't need any of that. The parent-facing copy reduces it to what happens:
Keyword and pattern detection for self-harm, abuse, grooming, and drug-seeking at minimum. Alerts are deduplicated per topic so a parent gets one message, not forty.
Output is verified before it's shown. If verification fails on a sensitive turn, the child gets a safe, pre-written response instead of a guess.
Hallucination guardrails framed for parents as a refusal policy: when unsure, decline rather than invent.
Explicit limits, stated up front. Over-promising a safety feature is the fastest way to lose a parent's trust the first time it misses.
Design decisions that came out of code and security review.
- Per-profile rate limiting so one child's session can't exhaust the account.
- Image uploads capped and typed (small PNGs only) for the creation studio, because the studio is the feature kids love and the one most exposed to abuse.
- Error messages sanitized so a failure never leaks implementation detail to a child's screen.
- Documented Phase 2 gaps rather than hidden ones: verifiable parental consent, multi-tenant auth, payment, and a therapist-curated content bank are listed as not-yet-done in the product itself.