Child safety

An app for six-year-olds has to say exactly what it does about this.

Rilo is built for children, so the standards below are not boilerplate. They are the reason several product decisions went the way they did. This page states what is forbidden, how the design prevents it, how to report what it does not prevent, and what happens when you do.

Reporting abuse of a child

If a child is being harmed, or you have seen material that sexually exploits a child, report it here:

childsafety@rilotalk.com

You do not have to give your name. Anonymous reports are accepted and acted on the same way. Leave the sender blank or write from an address that is not yours if you prefer.

If a child is in immediate danger, call the emergency services on 112 first. In Belgium, Child Focus can be reached free on 116 000. Tell us afterwards, not instead.

What is forbidden

The following are prohibited on Rilo without exception, and are grounds for permanent removal of an account with no warning and no appeal:

child sexual abuse material, in any form, including drawn or generated imagery;
grooming: building a relationship with a child in order to abuse them, or attempting to move a child to another service to do so;
sexual extortion, or soliciting sexual imagery from a child;
trafficking, or arranging for a child to meet someone for the purpose of abuse;
an adult representing themselves as a child, or using a child’s account, in order to reach other children.

We report credible cases to the police and to the national hotline. We do not warn the account first.

These standards sit on top of the law rather than instead of it. Belgian and European law on child sexual abuse material binds us in full, we co-operate with the authorities that enforce it, and a case that belongs with the police goes to the police whatever else we do.

What the design prevents

Most abuse in children’s messaging arrives from a stranger. Rilo makes that structurally impossible rather than discouraging it:

There is no discovery. No search, no directory, no suggestions, no random matching, no way to be found by anyone.
Every contact is approved by a grown-up on each side. Adding one starts with a one-time invite, scanned from another phone’s screen or sent as a link that expires within the hour, and finishes with a grown-up saying yes on their own phone. A forwarded invite connects nobody. Whoever opens it still has to be approved, by name.
A grown-up signs for every one. Any contact involving a child exists only after a guardian approves it on their own phone, with their own key.
A child cannot widen their own circle. Children can put down a contact, but only a guardian can add one, and a child cannot remove their guardian.
A contact can be cut at any time, by a grown-up or by the child themselves, and it stops working straight away, even mid-call.

We are direct about the limit of this. A closed circle is excellent against strangers and does nothing about an adult who was invited in. That is the case reporting exists for, and it is why reports reach us rather than only the parent.

What encryption means for moderation

Calls and messages are end-to-end encrypted, which means we cannot read them and there is no key anybody could ask us for. That is a property of the software, not a policy we could change on request. So we cannot scan message content. We will not claim to.

It also rules out most of what a moderation page usually claims, so what follows is the exact state of what we can and cannot see:

Names and faces do not reach us either. They are chosen on each phone and travel inside the pairing code or sealed to the other phone, so there is no profile picture and no display name here for anyone to review. All the server sees of a pairing is a one-time number, which it spends rather than reads.
Text is checked on the child’s own phone. The check runs after decryption, on the phone that received the message, against a word list that ships inside the app. A match is hidden before the child reads it, and their grown-up is told who sent it and when, never the words themselves. Nothing about the message reaches us, because nothing needs to. It catches an accident or a casual insult. It does not catch grooming, and that is what reporting is for.
We do not watch how people pair or call. Those patterns are not encrypted and could be watched. Nothing on our server does it today, and if that ever changes it will be written here before it is switched on. There is one exception, and it only ever arrives by somebody’s own hand. When a grown-up reports an account, the report carries that one pairing with it: who was allowed to reach whom, and which grown-up allowed it. A report we cannot place is one nobody can act on, and no part of the server collects that on its own.
A report carries only what the person reporting sends. We cannot fetch a conversation, so what reaches us is what somebody chooses to attach. The report control in the app lists every item before it seals anything: who the person is as a key, the name they appear under on your phone, when the pair was made and which grown-up allowed it, and your own words. It attaches the conversation, messages and stickers together, only if you say so. It carries no recording of any call, here or anywhere, because none is ever made.

What happens when you report

Reports about a child’s safety are separated from ordinary support and handled on this schedule:

Within 24 hours: A person has read it and answered. Not a queue and not an autoresponder. The address below reaches the person named on this page.
Action: We act on the account, because we cannot reach a message. An account that breaks the standards above is removed within 24 hours of a person reading the report, which ends every one of its contacts at once. This is one recorded action, checked before it runs, not two separate steps that could be half-finished.
Escalation: Credible reports involving child sexual abuse go to the police and to the national hotline, with whatever evidence we lawfully hold. We do not decide on our own whether something was serious enough to pass on.
Appeal: If we removed an account and were wrong, write to the address above and say so. We will look again and tell you either way.

Who to contact

There is a named person responsible for child safety here, not a shared inbox with nobody behind it.

Child-safety contact: Marijn Vandevoorde, founder
Email: childsafety@rilotalk.com
National hotline: Child Focus (Belgium), the INHOPE member for this country: childfocus.be, free on 116 000.
Law enforcement: Belgian Federal Police. Emergencies: 112.

What parents can do

The controls are on your phone, not buried in a settings screen on your child’s:

approve or refuse every contact before it exists, and narrow what it is allowed to do at that moment;
switch calling, messaging, adding friends or changing their own photo off for a child, from your own phone, whatever their contacts are allowed;
remove any contact from your child’s list at any time;
and, worth more than any of them, know who is on the list, because nobody joined it without you saying yes.

Last updated 15 August 2026, and reviewed at least once a year and whenever the product changes.

Back to the start