Anyone can build a marketplace. The reason a parent says yes to NIL.CARDS is that the platform carries the consent, the approvals, the payments and the liability — and can prove every one of them. Most of what's on this page isn't policy. It's architecture.
Awaiting your approval
No deadlineRejecting costs the family nothing. The brand is refunded automatically.
Four commitments, each carried by the platform — not by a checklist someone remembers to follow.
No asset featuring a minor publishes without parental authority. Parents choose per-asset review or Fast-Track pre-authorization within limits they set — approved photos, approved categories, human review and a 24-hour veto before anything goes live. One tap reverts to Must-Approve, and the veto outranks everyone. Including us.
No direct messages to minors, from anyone, ever — there is no message table to misuse. Brands book through structured offers only; comments are off by default; donation messages route to the parent, moderated. Addresses are never shown to brands, and minors render as first name + last initial everywhere public.
Every AI asset is generated from the member's approved source photos only — a vault brands can't see into — carries a visible, non-removable AI label rendered into the pixels, and is never used to train any model. Brands receive finished deliverables. Never source photos, never contact details.
Brand payments sit in escrow until approval. A flat 10% member fee, pledges routed directly to verified non-profits, and per-member earnings statements — every figure on every screen is the same sum over the same double-entry ledger, and every transaction balances to zero by database trigger.
Not 'against the rules' — structurally impossible. Each row names the impossible thing and the machinery that makes it so.
| The impossible thing | What makes it impossible |
|---|---|
| A minor with instant auto-approve | Database CHECK constraint — the row cannot exist |
| A published AI asset without its disclosure | Label rendered into the pixels + database CHECK refuses the state |
| A DM to any member | No message table in the schema — absent, not disabled |
| A brand downloading source photos | Storage layer refuses to sign source/** for brand accounts |
| An unbalanced money movement | Ledger trigger — transactions that don't sum to zero are rejected |
| A silently edited audit trail | Append-only by trigger — updates and deletes raise errors |
| An asset changed after approval | SHA-256 pinned at approval — a changed hash voids the approval |
| A gated feature in an unapproved state | Per-state feature gates — counsel outcomes are data, not deploys |
A rule that lives in the interface can be forgotten by the interface. These live in the database and the storage layer, where forgetting isn't an option the software has.
The guardian system ships with Beta — and minors don't join until it does. Here is what it hands you on day one.
Your child's card cannot become brand-visible until you e-sign the Likeness & Media Consent — a marketing release plus a separate AI election you can decline entirely. Consents are versioned, auditable, and expire each season.
Must-Approve is the default: each asset comes to you before it exists in public. Prefer Fast-Track? You pre-approve the photos and categories, a human reviews every asset, and you hold a 24-hour veto on each one.
Comments off by default. Follower approval available. Optional post-review mode queues your child's posts for your approval. You can remove any post or follower, any time.
Order any published asset taken down at any time — it's an action, not a request. And one tap reverts Fast-Track to Must-Approve, effective on everything unpublished.
Payout accounts belong to adults, full stop. For a minor, you onboard as the payout owner and every dollar routes through you — with a per-deal statement showing gross, fee and net.
Every consent, approval, veto and takedown is logged with actor, timestamp and asset hash. If you ever ask 'what exactly was approved, and by whom?' — there is one answer, and we can show it to you.
Today, NIL.CARDS is 18+ (Alpha). We would rather launch the guardian system late than launch minors early — the order is the point.
Hold up any published asset and the record answers: which consent covered it, who approved exactly which file, when it published, and where every cent went. One chain, one query.
The audit log itself is append-only at the database level — it can grow, and nothing else. Even we can't quietly rewrite history, which is exactly how you'd want it.
Write to a human at hello@nil.cards — safety questions get answered first, usually the same day. Or read the full production spec, stage by stage.
