Trust & safety
What we reviewed, what passed, and what's still open
We reviewed FlexiKeys against WCAG 2.1 AA accessibility guidelines, the OWASP ASVS Level 2 security standard, and a COPPA/GDPR-K–aware privacy posture for children's data. This page is the detailed version of the summary on our homepage — including items we haven't finished yet. We'd rather show an honest, dated review than a polished claim with nothing behind it.
Last reviewed: July 2026.
Accessibility — WCAG 2.1 AA
Touch targets and contrast are checked against fixed minimums for both the child experience and the parent/teacher experience.
| Item | Measured | Requirement | Status |
|---|---|---|---|
| Adaptive keyboard keys (default) | 64×64 dp | ≥ 64 dp | Pass |
| Adaptive keyboard keys (enlarged) | up to 96×96 dp | ≥ 64 dp | Pass |
| Primary child buttons | 64 dp height | ≥ 64 dp | Pass |
| Parent / teacher UI controls | 48 dp height | ≥ 44 dp | Pass |
| Text contrast, ink on cloud background | 8.2:1 | ≥ 4.5:1 | Pass |
| Text contrast, ink on brand pastels | 4.6–5.7:1 | ≥ 4.5:1 | Pass |
Open findings, not hidden
No critical, must-fix-before-launch findings were identified in the latest review.
Security — OWASP ASVS Level 2
Authentication
Rate-limited login, signed time-limited reset tokens, refresh-token rotation with reuse detection.
Session management
Short-lived access tokens (15 min), 30-day refresh tokens, full revocation on logout.
Access control
Server-side role checks on every protected route; child session tokens cannot reach parent or admin endpoints.
Input validation
Strict schema validation on every request; the app renders text, never raw HTML, so injection surface is minimal.
Child privacy — COPPA / GDPR-K posture
Child identity
A generated UUID only — no name, email, or birthdate is required to create a child profile.
Display name
Chosen by the parent; typically a first name or nickname, not treated as directly identifying.
Telemetry
Keystroke and interaction events are pseudonymized at ingest and used only to drive the adaptive engine.
Third parties
No third-party analytics or advertising SDKs are present in the child-facing experience.