Stamplo is designed to exceed the ICO Children's Code and align with UK GDPR and the spirit of COPPA. Every child is protected. Every parent stays in control.
🔐 Our Security Commitments
Stamplo is built with a zero-trust mindset and secure-by-default architecture:
- Strong encryption at rest for letters and uploaded images
- Strict session and cookie policies (`HttpOnly`, `Secure`, `SameSite=Strict`)
- Full CSRF protection using server-backed session tokens (not exposed to JavaScript).
- No ads. No tracking. No third-party scripts.
- No behavioral profiling or engagement-based personalisation.
- Private, access-logged backend with audit-ready logs.
- Letter and pen pal approvals require both parents (Four-Eyes Check)
While no system can promise perfection, Stamplo is designed to protect children like your own — because that's exactly who it was built for.
📋 How We Meet the ICO Code
The ICO Children's Code contains 15 principles. We've built Stamplo to honour all of them — thoughtfully, thoroughly, and transparently.
1. Best Interests of the Child
The child’s best interests must be a primary consideration when designing and developing online services.
How Stamplo Meets This:- No ads, no algorithms, no dopamine traps — ever.
- Letters are intentionally delayed to promote patience and wellbeing.
- Every interaction is reviewed by both sets of parents before delivery.
- Upcoming kindness campaigns and collectible stamps are designed to encourage empathy and creativity, not compulsive use.
2. Data Minimisation
Only the minimum amount of personal data necessary to provide the service should be collected.
How Stamplo Meets This:- Children do not create usernames or public profiles.
- We use offline-only invite codes to connect pen pals.
- We never require email addresses or surnames for children — only a first name.
3. Age-Appropriate Application
The service must work differently depending on the child’s age, development, and maturity.
How Stamplo Meets This:- UX is optimized for children aged 7–14, with a balance of simplicity and expressiveness.
- Children can browse public pen pal profiles by country, viewing first name, age, and parent-approved hobbies. No personal contact details are shown.
- Parents control visibility, image permissions, and access to Twitch the mascot.
4. Transparency
Children and parents must be provided clear information about how their data is used.
How Stamplo Meets This:- Plain-language privacy policies written for parents.
- In-dashboard prompts explain what’s shared and why.
- We do not track or profile users.
5. Detrimental Use of Data
Children’s data must not be used in ways that are harmful to their wellbeing.
How Stamplo Meets This:- We don’t use data for advertising, targeting, or ranking.
- Messages are encrypted at rest and only decrypted for parental approval flow.
- There is no behavioral analysis or engagement scoring.
6. Policies and Community Standards
Services must uphold published standards that protect children.
How Stamplo Meets This:- Strict letter content rules enforced by both parents.
- Prohibited behavior is outlined clearly and reinforced in UX.
- Repeated violations trigger suspension, logging, and parent alerts.
7. Default Settings
Settings must be set to high privacy by default.
How Stamplo Meets This:- Profiles are private and hidden from Friend Finder unless parents opt in.
- Image sharing is disabled until explicitly enabled by a parent.
- AI chat access is off by default.
8. Data Sharing
Children’s data must not be disclosed unless it’s needed to provide the service.
How Stamplo Meets This:- No third-party data sharing — ever.
- Encrypted messages are only used for parent-reviewed delivery.
- All sensitive content is stored encrypted at rest.
9. Parental Controls
Tools should allow parents to supervise their child’s use of the service.
How Stamplo Meets This:- Every letter, image, and friend request passes through our Four-Eyes Check.
- Parents control profile visibility, image permissions, and AI access.
- We notify parents of all pending actions securely.
10. Profiling
Profiling should be avoided unless strictly necessary.
How Stamplo Meets This:- No engagement based personalisation, ranking, or tracking of children.
- No data is analyzed for engagement or optimization.
- Each child’s experience is equal and calm by design.
11. Nudge Techniques
Design should not encourage children to provide more data or lower their privacy.
How Stamplo Meets This:- We don’t prompt children to reveal anything unnecessary.
- Stamp collecting is calm and achievement-based — not compulsive.
- Kindness campaigns reward empathy, not frequency of use.
12. Connected Toys and Devices
Where applicable, connected products must be safe and secure.
How Stamplo Meets This:- Stamplo is browser-based only. No cameras, microphones, or location data.
- No external APIs or smart device integrations.
- Fully secure, sandboxed runtime.
13. Online Tools
Children must be able to easily report concerns or get help.
How Stamplo Meets This:- Twitch mascot offers accessible, AI-powered help — parent-controlled.
- Parents can contact our team via secure form or email.
- We aim to reply to all support requests within 24-48 hours. Stamplo is founder-led, built with care by a full-time working dad — we appreciate your patience.
14. Data Portability
Children and parents should be able to access or move their data.
How Stamplo Meets This:- Parents can request a structured data export of their child’s messages.
- All data exports are decrypted only at the parent's request and are readable only to them.
- We never retain decrypted content outside of the parent approval context.
15. Account Deletion
It should be easy to delete accounts and associated data.
How Stamplo Meets This:- Parents can delete all data securely via their dashboard.
- We purge backups within 30 days of deletion.
- Every deletion is logged and verified.
