# MatchMind and the Children's Internet Protection Act (CIPA)

**Last updated: 2 August 2026**

This document is written for the person at a school, district, or library who
has to sign a CIPA certification and needs to know exactly what MatchMind does
and does not do. It is deliberately specific, and it is deliberately honest
about the boundary between what an application can provide and what remains the
institution's responsibility.

---

## 1. The most important thing on this page

**No software product is "CIPA certified," and MatchMind does not claim to be.**

CIPA (47 U.S.C. § 254(h)(5), implemented at 47 C.F.R. § 54.520) is a **condition
on federal E-Rate funding**. It binds **schools and libraries**, not vendors.
The certification is made by the institution, about the institution's own
internet safety policy and technology protection measures. There is no
certifying body that audits applications, and any vendor that tells you their
product "is CIPA compliant" is describing something that does not exist.

What a product can legitimately do is two things:

1. Not be a hole in the policy you are certifying.
2. Give you controls and evidence that make your certification easier to make
   and easier to defend.

That is what the rest of this document describes.

---

## 2. What CIPA requires, and what MatchMind provides for each

A school certifying under CIPA must have an internet safety policy that
**addresses five subjects**, must operate a **technology protection measure**,
must **monitor** minors' online activity, and — since the FCC's 2011 order
implementing the Protecting Children in the 21st Century Act (Pub. L. 110-385
§ 215) — must **educate minors** about appropriate online behavior.

### § 254(h)(5)(B)(i) — Access by minors to inappropriate matter

| | |
|---|---|
| **What MatchMind does** | Every message and image is screened before it is delivered. Text is checked by an instant on-device matcher (slurs, profanity, sexual content, violent threats — including leetspeak, spacing, and elongation evasion) and then by an AI classifier. Images are screened by a moderation model before upload completes. |
| **AI-generated text** | AI Coach responses are screened **on the way out**, not only on the way in. A deterministic screen blocks generated text containing self-harm instructions, sexual content, weapon or explosive construction, drug synthesis, or slurs, and replaces it. In streaming responses the text is buffered to sentence boundaries and screened *before* release, so an unsafe sentence is caught while still buffered. |
| **Always on** | This is not a School Safe Mode setting. It applies to every account, on every plan, and there is no administrator switch to disable it. |

### § 254(h)(5)(B)(ii) — Safety and security of minors in direct electronic communications

| | |
|---|---|
| **Conversations are opt-in** | A new conversation from someone a student has not talked to before arrives as a **request**. Nothing is delivered, and the student's name is not revealed, until they accept. |
| **Restricted messaging** *(School Safe Mode)* | Messaging can be limited to teammates the student is already connected with. |
| **Calling** *(School Safe Mode)* | Voice and video calling can be disabled entirely. Where it is enabled, call media is authorized server-side: the server independently verifies the caller is a participant of that conversation before issuing a media token, and tokens expire after one hour. |
| **No public directory** | There is no searchable directory of students. A student cannot be found and contacted by a stranger browsing the app. |

### § 254(h)(5)(B)(iii) — Unauthorized access, "hacking," and other unlawful activities

| | |
|---|---|
| **No unfiltered egress** *(School Safe Mode)* | With external links blocked, only official VEX Robotics, RobotEvents, and REC Foundation destinations open. Every other outbound link is refused and the attempt is recorded. MatchMind cannot be used as a way around the school's own web filter. |
| **No general-purpose browsing** | MatchMind has no embedded browser, no file-sharing, and no code execution surface. |
| **AI scope** | The AI Coach is instructed and screened to stay within robotics. It will not return instructions for circumventing filters, accessing systems, or other unlawful activity. |

### § 254(h)(5)(B)(iv) — Unauthorized disclosure, use, and dissemination of minors' personal information

| | |
|---|---|
| **Private by default** | Student identity is not revealed to another user until the student accepts that conversation. |
| **Identity restriction** *(School Safe Mode)* | Names and photos stay hidden from anyone outside the student's own team. |
| **Message content** | Direct messages are encrypted; message bodies are not readable from the database console. |
| **Under-13 accounts** | Messaging, team features, and data sharing are gated behind verified parental consent (COPPA). Analytics data sharing is off for under-13 accounts regardless of any other setting. |
| **Full detail** | See the [Privacy Policy](PRIVACY_POLICY.md). |

### § 254(h)(5)(B)(v) — Measures restricting minors' access to materials harmful to them

Covered by the always-on technology protection measure described under
(B)(i) above, plus the graduated enforcement ladder in the
[Community Guidelines](COMMUNITY_GUIDELINES.md): a first violation is a recorded
warning, repeats suspend AI chat and messaging for 1 day, then 3 days, then
1 week. Suspensions are never permanent and never lock the rest of the app.

### § 254(h)(5)(D) — Monitoring the online activities of minors

| | |
|---|---|
| **Activity log** *(School Safe Mode)* | Records the **kind** of activity and when it happened: sign-ins, AI queries, messages sent, calls started, images uploaded, blocked links, blocked content, module completion. |
| **What is deliberately NOT recorded** | Message bodies and AI conversation content. This is a considered position, not an oversight. CIPA requires the school to be able to *supervise*; it does not require a vendor to build a searchable transcript of children's private conversations, and we will not build one. |
| **Export** | Settings → School Safe Mode → Export CSV, for your records or an audit response. |
| **Moderation evidence** | Separately, every message that trips the content filter is written to an append-only, tamper-evident record that the operator reviews, and the account holder is emailed. Clients cannot read, edit, or delete these records. |

### Protecting Children in the 21st Century Act § 215 — Educating minors

This is the requirement **no filter can satisfy**, and the one most often left
undone. MatchMind includes a completion-tracked online-safety module covering
exactly the three statutory topics:

1. **Appropriate online behavior** — permanence of what you send, that trash
   talk is not permitted in any direction (not about a person, a team, or their
   robot), the difference between honest competitive talk and a put-down, and
   what never to share.
2. **Interacting with others on social networking sites and in chat rooms** —
   people are not always who they claim, off-platform and secrecy requests as
   warning signs, why legitimate adults contact coaches rather than students.
3. **Cyberbullying awareness and response** — recognising it, not retaliating,
   preserving evidence before blocking, telling a trusted adult, and bystander
   responsibility.

The module ends in a four-question check. **A wrong answer shows the explanation
and requires another attempt** — a module a student can click through without
reading would make your certification a fiction. Completion is timestamped on
the student's record (`digitalCitizenshipCompletedAt`) so you can evidence it.

---

## 3. Turning it on

**Settings → School Safe Mode.** Enter your school or district name and enable
it. Each control below can then be tuned individually:

| Control | Default when enabled |
|---|---|
| Limit who can message students | On |
| Turn off voice & video calling | On |
| Block links out of MatchMind | On |
| Keep student identity private | On |
| Record activity for review | On |
| Require the online-safety module | On |

Explicit-content filtering and the AI harmful-content screen do not appear in
this list because they are always on and cannot be switched off.

---

## 4. Enforcement model — and its current limit

Read this section before you rely on School Safe Mode.

**What is enforced server-side.** When Safe Mode is enabled by one account for
another (a coach or administrator for a student), the policy is frozen at the
database rules layer: the student cannot edit the safety profile on their own
record, and cannot delete their record to escape it. Call media authorization is
also fully server-side — a student who forged client state still could not
obtain a media token for a conversation they are not part of.

**What is not yet enforced.** Enabling Safe Mode *on another user's account*
currently requires operator assistance — a coach cannot yet provision a student
roster from the app on their own. Safe Mode enabled by the student's own account
can also be turned off by that student. **For a deployment where students should
not be able to opt out, contact us and we will provision the managed profile for
your roster.** Self-service roster provisioning for coaches is the next planned
step, and this document will be updated when it ships.

We would rather tell you this than let you certify against a control that a
motivated fifteen-year-old can switch off.

---

## 5. What remains the institution's responsibility

MatchMind is one application on a network. CIPA certification covers the whole
network, and these parts are not ours to provide:

- **The internet safety policy document itself**, adopted by your board.
- **Public notice and a public hearing or meeting** on that policy before
  adoption — required by § 254(h)(5)(A) and frequently overlooked.
- **Network-level filtering** of general web traffic.
- **Supervision of the physical space** where students use devices.
- **Your own annual certification** (FCC Form 486).
- **Curriculum-level digital citizenship instruction.** Our module is designed
  to support and evidence this, not to replace a curriculum.

---

## 6. Related documents

- [Privacy Policy](PRIVACY_POLICY.md) — what is collected, where it goes, retention
- [Terms of Service](TERMS_OF_SERVICE.md)
- [Community Guidelines](COMMUNITY_GUIDELINES.md) — content rules and the enforcement ladder

## 7. Contact

For compliance questions, managed roster provisioning, or documentation your
district needs for its own review: **help@matchmindapp.org**

---

*MatchMind is an independent project and is not affiliated with VEX Robotics or
the REC Foundation. This document describes product behavior; it is not legal
advice, and it is not a substitute for your own counsel's review of your CIPA
obligations.*