Thnkrr — Where Things Stand

7 October 2026

In one minute

Everything we can build without the live Amazon account is built, tested and joined into one test version of Thnkrr, including the four safety roles and the team's tools.
The safety team has proper tools. Each person has a clear role and sees only their own work. They see the actual post, photo or profile a complaint is about, and act on it from the same screen: warn, remove, suspend, ban, or hide a fake profile. The person on the other side is told why in plain words, except in child-safety cases.
Next: we set up the Amazon account, put a private test version online for our own team, and then open it to the first school.
We need a few decisions and some paperwork from you. They're listed at the end.

Your feedback, and what we did with it

Every point from your last review has been taken into account:

You asked	What we did
Say "no third party retains students' writing"	Changed.
Sign OpenAI's data agreement, confirm it keeps nothing, list it as a supplier, check its rules for under-18s	Your goal is met without needing OpenAI's paperwork. We use OpenAI's free safety AI, but Amazon runs it for us, so OpenAI never sees students' writing. Amazon's terms already promise it keeps nothing and never trains on it.
A child-safety evidence hold must override deleting photos	Built. Anything linked to a child-safety case is kept for at least a year from the moment the case opens, and no reviewer can delete it. Removing content only takes it off the site.
The deadlines must match the published Community Guidelines; change the build if they differ	Built to exactly those deadlines (listed below). We also added the law's 7-day limit for all other complaints. Still needed: the Community Guidelines page itself (see "What we need from you").
AI screens first; people decide what AI can't	Built. It goes live once the Amazon account is set up.
One shared review list for the whole team, with no clashes when two people act at once	Built. Everyone has their own login. People with the same role share the same list. If two people act on the same item, it happens once, and the second sees "already done by Vidhi".
A WebPurify quote for live review of every image and held text, with a data agreement, nothing kept, and child-abuse matching	We checked them. A good fit at about 2 cents a photo, and their system connects to our review list. But their standard terms let them share uploaded images and train on them, so we'll ask for the quote with conditions that rule this out (see "What we need from you").
Vidhi as Child Safety Lead, handling everything the vendor escalates	Recorded in our safety procedures. Before her first case: a background check (CMU or Checkr) and free child-safety training.
The vendor goes on the supplier list and into school disclosures	Planned. A public supplier list page will exist before the first real student, and the same list goes to schools.
Reporting to NCMEC stays with us	Yes. Our team files reports; a vendor never does.

What's done

Keeping students safe

Nothing anyone writes or uploads is shown until it's checked. The writer sees it straight away, marked "being checked".
Three layers of checking:
- our own rules, which catch phone numbers, emails and social media handles, even when disguised (including numbers written out in words);
- an AI check of every piece of writing;
- people, who decide anything unclear and look at every photo and video.
Mentor messaging is switched off until a specialist grooming check is in place. Students and mentors see a plain notice saying so.
Every page links to the complaint form and the intimate-image removal form.

The AI that checks writing

Decided: a free safety AI made by OpenAI, run for us by Amazon inside our own Amazon account.
No agreement with OpenAI is needed. OpenAI isn't part of the arrangement and never sees students' writing. Amazon's terms already promise that students' writing is never used to train AI, with nothing extra to sign.
If Amazon ever retires this AI, it must give at least 6 months' warning. A tested backup takes over with one setting change.

Speed on a busy day

In our own test, 10,000 posts sent at the same moment were all checked in under 2 minutes.
Messages and anything that might be about self-harm are checked first.
If checking is busy, students see "about N minutes" instead of waiting in silence.
One person can post at most 10 times a minute, so nobody can flood the system.

The safety team: four roles

Each person on the team has one or more roles, and their screen shows only that work:

Role	What they handle
Moderator	Posts waiting to be checked, reports from students, students who may be at risk
Child Safety Lead (Vidhi)	Child-safety cases, intimate-image removals, reports to NCMEC and the police
Grievance Officer	The public complaint form, court orders and government notices
Safety Admin	Sees everything and is told when anything is late, but doesn't act

Two or more people can share a role. They see the same list and each other's actions, by name.
Each role has a backup person.
If two people act on the same item at once, it happens only once, and the second person sees "already done by Vidhi".
A "Who did what" record shows every action and who took it. Students only ever see "Thnkrr", never a reviewer's name.

What the safety team can actually do

Every complaint, removal request or court order opens like a case:

The real thing, not a description. If it mentions a Thnkrr link, the team sees that actual profile or post, with its photos and videos. They also see a card about the person: their age, school, and past reports or removals. One click opens that person's full record.
Photos are blurred and in black and white until a reviewer chooses to look. Every look is recorded. Large platforms do this to protect their reviewers, and so that nobody looks at more than they need to.
Buttons that do it:
- remove a post, a comment, or one photo or video;
- pause someone's new posts while the team looks;
- hide a profile while an impersonation report is checked;
- suspend an account for a set number of days;
- ban an account;
- refer a student to their school counsellor.
Each role gets only the buttons for its own work. A suspended or banned person is signed out at once, and their profile, posts and comments disappear for everyone else.
The person is told why by email, with how to ask us to look again. The one exception is anything about child safety or an intimate image: then they're never told, because a notice could warn an abuser.
Attached files. The Grievance Officer attaches the court order or police notice itself. A parent can attach a screenshot or proof to their complaint. The intimate-image form never asks for the picture.
Each item records what was done about it, and who did it. A court order is marked done only when something has actually been removed. Replies to the person who complained come from ready-made templates in plain words.
Works like the big platforms, from both sides:
- the ladder is warn, then suspend, then ban;
- removed posts simply disappear, and only the author is told why, by notification;
- a moderator who sees grooming hands it straight to Vidhi. The person can't post, comment or message anyone from that moment until she decides. They see only a neutral notice ("we've limited some activity on your account"), never the reason;
- whoever reported something is told what happened, without naming anyone;
- a suspended or banned person is told at sign-in why and until when, with a link to appeal;
- for anything about child safety, the person is never told the reason, so an abuser isn't warned.
Tested from both sides. We checked every action from the reviewer's screen and from the screen of the person it affects: 50 checks, all passing.

The legal deadlines

Situation	Deadline
Acknowledge any complaint	24 hours
Remove reported unlawful content	36 hours
Remove an intimate image	2 hours
Someone pretending to be someone else, or a fake picture of them	2 hours
A court order or government notice	3 hours
Everything else	7 days

Emails make sure nothing is missed:

when something arrives, the people in that role are emailed;
if half the time has gone and nobody has acted, they're emailed again, with their backup;
if the deadline passes, the Safety Admin is emailed too.

Two extra targets are for our own team only, not legal deadlines: confirm a child-safety case within 4 hours, and report it to NCMEC within 24 hours.

Evidence and removals

Anything linked to a child-safety case is kept for at least a year, and no reviewer can delete it.
Content we remove is taken off the site, so nobody can see it any more. A locked copy is kept for 180 days, as Indian law requires, in case the police or a court ask for it. Only our safety team can open it.
A removed photo or video disappears from the site within minutes, and the same file can't be uploaded again.

Also built and joined in

Public profile links, LinkedIn-style search, and "who viewed your profile".
School pages, and moving a student from one school to another.

Where it will run

Amazon's US East location (Virginia), close to the first pilot schools.
Cost: about $46–63 a month for 20 to 1,000 students, all paid from the Amazon credits.

What's next

Us:

Set up the Amazon account safely. Adarsh starts this now; it takes about half a day.
Put a private test version online and test everything for real, including the team's tools with two people on two laptops.
Run the AI's first real checks, measure its speed for a week, and test 10,000 students posting at once.
Then open it to the first school.

Later, once we grow: a plan to keep the database fast past about 1 million messages. It's written, and waiting for the CTO's go-ahead.

What we need from you

Photos and videos: should a person still check every photo and video before it's shown? We recommend yes for the pilot, with an outside review team (WebPurify) to help on busy days. The alternative is to let the AI approve photos it's very sure about: faster, but a promise to families changes.
Longest video at launch: keep 15 minutes, or start with 3? Shorter means faster checking, and we can raise it later.
Names for each role, plus a backup for each. Until then, the test version uses made-up people:
- Is Vidhi also the person who reports child abuse to NCMEC, the US centre for these reports?
- Who backs up Vidhi as Child Safety Lead?
- Who is India's Grievance Officer? By law, this name goes on the site.
- Who is the Safety Admin (you or Adarsh)?
- Who are the first moderators?
Rules for suspending and banning. Built like this; each is easy to change:
- only the Child Safety Lead and the Grievance Officer can ban an account;
- a moderator can suspend someone for at most 7 days;
- to appeal, a person uses the complaint form, and the Grievance Officer answers;
- the person is always told why, except for child-safety and intimate-image actions.
Paperwork to send or sign:
- register Thnkrr with NCMEC;
- apply for the five free child-abuse image lists, which let us block known abuse images and videos at upload:
1. Microsoft PhotoDNA, the matching tool most platforms use;
2. NCMEC's hash list: fingerprints of known abuse images, from the US centre for these reports;
3. the Internet Watch Foundation (IWF) list, from the UK's child-abuse watchdog;
4. Project Arachnid, run by the Canadian Centre for Child Protection;
5. Google CSAI Match, which matches known abuse videos;
- send the two drafted emails to Thorn and Hive (grooming detection);
- ask WebPurify for a quote, with our conditions: a signed data agreement; nothing kept after each decision; no sharing or training on our images; no face analysis; where their reviewers work; their child-abuse matching included; and a price for checking held text.
The Community Guidelines: send us the text, or tell us to draft it using the deadlines above.
Mentor messaging: confirm it stays off until the grooming check is live.
How long we keep messages: we keep them today, but have never set a time limit. Please decide this with our lawyer.
Our lawyer: the final Terms of Use and Privacy Notice, and approval of the deadlines and the at-risk-student procedure.
Amazon credits and domain: when do the credits end, and who manages the domain's settings?