Child safety

Standards against child sexual abuse and exploitation.

Effective from: 11 August 2026

Subsets is a private photo-sharing app operated by Workwind, Inc. We have zero tolerance for child sexual abuse and exploitation (CSAE). This page sets out our published standards, how we prevent and act on CSAE, and how anyone — user or not — can report it to us.

What we prohibit

The following are strictly forbidden on Subsets, whether shared publicly, privately with friends, or in a profile, name, or message:

• Child sexual abuse material (CSAM) — any image, video, or other depiction of sexually explicit conduct involving a minor.
• Child sexual exploitation — sexualizing, soliciting, or otherwise exploiting a minor, including sextortion and the trading of sexualized imagery of minors.
• Grooming — befriending or building trust with a minor for the purpose of sexual abuse or exploitation, online or offline.
• Sexualization of minors — content that depicts, encourages, or promotes minors in a sexualized manner, including drawn, computer-generated, or AI-generated depictions.
• Trafficking — advertising, recruiting, or facilitating the sexual exploitation or trafficking of a minor.
• Off-platform conduct — using Subsets to link to, direct users toward, or coordinate any of the above elsewhere.

These prohibitions are also written into our Terms of Service and apply to every account, with no exceptions and no warnings.

Age requirements

Subsets is not for children. You must be at least 13 years old globally, and at least 16 in the European Economic Area and the United Kingdom. We collect date of birth at signup and enforce the minimum age. Accounts we find to be underage are terminated and their data deleted.

How the app is designed to reduce risk

• Private by default. Every account starts private. A private account’s photos and albums are visible only to the accounts it has added in return — a stranger browsing Subsets sees nothing of it. A public profile is something a user has to deliberately turn on, and can turn off again at any time.
• Discovery is opt-in and signed-in only. The Explore page surfaces only accounts that have chosen a public profile, and it is reachable only from inside an authenticated account — there is no signed-out browsing, no crawlable profile pages, and no public web surface for anyone to trawl. Users can also switch profile discovery and contact discovery off in settings, which removes them from Explore and from contact matching entirely.
• Mutual consent to see private content. Adding an account lets a user see only what that account has made public. Seeing anything that account has kept private requires it to add them back. A user can decline, remove, or block at any time, and a blocked account cannot add them, send a request, or interact with them.
• No background location, and no location taken from photos. Subsets never tracks a device’s position, and asks for no continuous location permission. EXIF metadata, including GPS coordinates, is removed from every photo at upload, so an uploaded photo never reveals where it was taken. A user may choose to tag a post with a place; that tag is something they select deliberately, it can be removed at any time, and — like the post it belongs to — it is visible only to that post’s audience.
• No ads, and no advertising profiles. We do not run advertising, we do not sell data, and we build no profile of any user for advertising or for any third party — which removes a common vector for targeting minors. We do record how a user interacts with Explore in order to decide which public accounts to recommend to them there; that record is used for nothing else, is never disclosed, and is described in our Privacy Policy.
• Nothing is published to the open web. Every profile and every post is served only to a signed-in Subsets user. Nothing on Subsets can be reached by a logged-out visitor, indexed by a search engine, or crawled.

How to report CSAE

Anyone can report — you do not need a Subsets account. Reports are prioritized above all other support requests.

• In the app: use Report on the content, profile, or account. Every report reaches our trust and safety team; if it concerns a minor, say so in the report so we can escalate it. You can also block the account immediately.
• By email: [email protected] with the subject line “CSAE report”. Include the username, and any detail that helps us locate the content.

If a child is in immediate danger, contact local law enforcement first. Reporting to us does not replace emergency services.

How we respond

1. Triage. Child-safety reports are escalated immediately and reviewed by our trust and safety team ahead of any other queue.
2. Action. Confirmed CSAE results in removal of the content, permanent termination of the account, and blocking of the associated user from creating new accounts. There is no appeal path for confirmed CSAM.
3. Preservation. We preserve the relevant content and account records as required by law, so investigators can act on them even though the material is removed from the app.
4. Reporting to authorities. We report apparent CSAM to the U.S. National Center for Missing & Exploited Children (NCMEC) via the CyberTipline, and cooperate with law enforcement and with equivalent authorities in other jurisdictions as applicable law requires.

Legal compliance

We comply with applicable child-safety law in the jurisdictions where we operate, including U.S. reporting obligations under 18 U.S.C. § 2258A, and we align our standards with Google Play’s Child Safety Standards policy and Apple’s App Store guidelines. We respond to valid legal requests from law enforcement relating to child safety.

Point of contact

Our designated child-safety point of contact — for users, regulators, app stores, and law enforcement — is:

• Email: [email protected]
• Entity: Workwind, Inc.
• Acknowledgement: within 24 hours for child-safety reports.

External resources

• United States — NCMEC CyberTipline
• United Kingdom — Internet Watch Foundation
• Global — INHOPE hotline network

Review

We review these standards at least annually, and whenever our product, our obligations, or applicable law changes. See also our Terms of Service, Privacy Policy, and Help center.