Access Policy
Purpose
This policy defines how Yamess team members may access child conversations, what controls exist to prevent unauthorised access, and what safeguards are in place to protect family privacy.
This policy answers the question: Who can read my child's conversations?
Current State
Yamess has no customer-facing internal tool for browsing conversations. There is no dashboard, admin panel, or support interface that allows team members to view child chats.
The only way to access conversation data is through the Firebase Admin SDK, GCP Console (Firestore UI), or Firebase Console — all of which require specific IAM permissions on the production project.
Access to the production Firebase project is limited to the founder. No third-party or contract staff have access to the production environment.
Policy
Principle of Least Privilege
Access to child conversations is granted only when required for technical operations (incident response, debugging), safeguarding obligations (reviewing an escalated safety event), or legal compliance (responding to a lawful request).
No Casual Access
Conversations are not browsable through any internal tool. There is no "view conversations" dashboard for employees. Access requires deliberate technical steps through authenticated cloud infrastructure.
Safeguarding Access
If a safety event (red severity) requires review of a specific conversation, access is permitted but limited to the specific chat thread involved, the minimum number of messages needed, and documentation of why access was needed.
Logging and Accountability
All access to the production GCP project is logged via Cloud Audit Logs, including who accessed Firestore, what documents were read, and when the access occurred.
Third-Party Access
No third-party service providers have direct access to the production Firestore database. The AI provider (DeepSeek) receives only the individual message sent in each API request, not database-level access.
Claims Status
- No internal browsing tool — True. No customer-facing admin panel exists.
- Only founder has production access — True. IAM permissions are restricted.
- All GCP access is audited — True. Cloud Audit Logs are enabled.
- Formal access request process — Operational practice, not yet documented as a formal workflow.
- Regular access reviews — Not yet implemented. Planned.
Future Improvements
- Publish this policy as a parent-facing page
- Create formal access request and approval process
- Implement time-bound, scoped access credentials
- Regular quarterly access reviews