Private testing · demo profiles are fictional · signup closed
NOKIDS

Launch checklist

NOKIDS is not production-ready. The second list must be finished before real members are allowed in.

Done — prototype & phase 2

  • Discover, Matches and Chat use real member data, with live chat
  • Discover respects age range and who you're interested in; moderators activate tester accounts
  • Email/password sign-in, email verification, password reset, sign out
  • Server-side eligibility: signup rejected under 21 or over 35 (18+ hard floor), or without single / no-children / terms
  • Members can read and edit only their own profile; birth date, declarations and visibility are locked
  • Other members only ever see age, city, neighborhood and profile text — never birth date or exact location
  • Likes visible only to the person who liked; matches created only by the server on a mutual like
  • Messages readable and sendable only inside your own mutual match
  • Blocking removes the match and likes and hides both members from each other
  • Reports and moderation evidence readable only by authorized safety staff; roles cannot be self-assigned
  • Account deletion removes profile, photos, preferences, likes, matches, messages and blocks
  • Private photo storage — owners and moderators can preview; members see only approved photos
  • Admin photo review: approve or reject photos before they appear in Discover, Matches and Chat
  • Public registration switched off; only moderator-activated testers participate
  • Confirmed email required for member interaction; age eligibility rechecked before matching and messaging
  • Owner privacy controls: pause discovery, hide profile/distance, in-app notification preferences
  • Optional broad-area distance bands without GPS or coordinates
  • Custom accepted-action limits per fixed minute: 20 likes, 30 messages, 5 reports, 10 profile/preference changes
  • Daily caps per member: 100 likes and 150 messages per day, with a clear message when reached
  • Sign-in lockout: 5 failed attempts per account or 20 per IP within 15 minutes locks sign-in for 15 minutes, with a clear message
  • Community guidelines and clearly labeled draft Terms and Privacy Policy
  • Database authorization rules tested with simulated members

Not done / not verified

  • Self-declared age, single and no-children status are NOT independently verified (needs ID + selfie checks)
  • Bot/distributed-attack protection: the hosted auth endpoint is still directly reachable, so a determined attacker can bypass the app's sign-in lockout; independent review of custom abuse limits
  • Optional SMS flow prepared but inactive; delivery setup/cost approval and end-to-end verification required
  • Independent age evidence integration and enforcement activation before launch
  • Approved retention periods, backup expiry and safety-evidence redaction procedures
  • Final Terms, Privacy Policy and community guidelines; legal review for Ohio & US
  • Payments for Gold ($14.99) and Elite ($24.99) — intentionally not enabled
  • End-to-end test of signup with real email (registration currently closed)
  • Independent security review / penetration test before launch