ADR-0006: Limit PlatePilot to adults and privacy-preserving two-adult households
- Status: Accepted
- Date: 2026-09-19
- Scope: Product, identity, authorization, and UX
Context
PlatePilot’s wellness records and meal photos can reveal routines and sensitive preferences. Household coordination is useful, but a shared household must not become blanket access or create child-safety functionality.
Decision
- PlatePilot is only for adults aged 18 and older.
- Do not create minor, child, dependent, guardian, pediatric, or school-oriented profiles or flows.
- A household contains at most two independently authenticated adults.
- Joining requires a clear invitation and independent acceptance.
- Each adult retains their own identity, credentials, private records, raw photos, export, and deletion authority.
- Any sharing is purpose-specific, explained before acceptance, revocable, and enforced by server-side object authorization.
- Household membership alone does not authorize access to all diary data, photos, settings, exports, or destructive actions.
- Product copy remains supportive and non-medical.
The exact shared-record model is pending product safety research and must follow these constraints.
Consequences
- The model is simpler than general family management but still requires strong ownership and authorization.
- Subscription or planning concepts cannot be reused as an implicit permission system.
- Leaving, revocation, disputed shared records, and coercive-use scenarios require careful design.
- An age affirmation alone may not prevent all misuse; escalation and deletion handling are needed.
Follow-up
- Define a record-by-record authorization matrix before household endpoints.
- Test invitation, revocation, export, deletion, and post-separation scenarios with adults.
- Obtain privacy/legal review of age assurance and shared-data wording before beta.