# Legal, Privacy, Content, and Platform Constraints

> **Updated:** 15 September 2026  
> **Authority:** Engineering/compliance constraint. Applicable law and non-excludable statutory rights prevail.

## Core protection doctrine

Protection of streamers, viewers, individual participants, children, women, and people exposed to stalking, grooming, coercion, harassment or doxxing is a first-class Sphinixx architectural requirement. It is not an optional moderation feature, engagement preference or future enhancement.

Engineering must implement privacy and safety by design and default. Social identity is tag-first. Deterministic server privacy gates are authoritative. Client masking adds immediate protection but is not the trust boundary. Ordinary product configuration and optional AI review cannot waive mandatory privacy controls.

See `Sphinixx_Contracts_and_Licences/15_Privacy_Safety_Sovereignty_and_Authority_Charter.md`, `16_Child_Safety_Privacy_and_Online_Safety_Compliance_Standard.md`, and `17_Safety_Authority_Release_and_Incident_Governance.md`.

## User data and consent

Distinguish operational data from content resources. Collect only data needed for defined purposes and provide legally required transparency and rights mechanisms. The intended control vocabulary includes access, correction, portability where applicable, deletion, restriction, objection, consent withdrawal where consent is relied upon, account closure and integration disconnect/revocation.

Do not write tokens, webhook secrets, raw rejected private disclosures, unnecessary personal identifiers or payment credentials into ordinary logs, Creator drafts, diagnostics, screenshots or packages. Diagnostics must redact sensitive values.

For services likely to be accessed by children, child best interests, higher-protection considerations, high-privacy defaults and data minimisation must be built into design and documented assessments.

## Content and safety

The platform boundary must support deterministic privacy blocking, bounded automated checks, human review where required, reporting, rejection, appeals/review where appropriate and safe failure. Safety analysis must include cumulative identification, grooming, stalking, harassment and doxxing risks rather than only prohibited-content keywords.

AI/provider review for assets, chats, stickers, maps and packages is supplemental and non-essential. No adapter may claim that an unavailable/offline provider produced a real moderation decision.

## Streaming and broadcast

Streaming creates an expanded audience and persistence threat. Design must account for accidental disclosure being clipped, copied, indexed or correlated outside the visible room. Broadcast/OBS integrations must not expose credentials or silently weaken privacy controls.

Inbound platform events must be authenticated at the platform/server boundary, bounded by size, queue, retry and rate limits, and mapped to neutral events before Runtime consumes them.

## Payments and creator economy

Sensitive checkout belongs to a secure server/platform boundary. Payment credentials must not enter ordinary social/content pipelines. Marketplace/publication systems must not trade away mandatory participant protection for conversion or engagement.

## Remix and publishing

Publishing is a staged workflow. Public content must pass applicable deterministic privacy gates before distribution. A creator's permission to publish their work is not authority to disclose another person's protected personal information or secrets.

## Governance and release

A feature touching identity, messaging, discovery, age handling, location, uploads, publishing, livestream interaction or personal data requires the applicable privacy/safety review before unrestricted release. Known bypass of a mandatory privacy invariant is a release blocker until contained and evidenced.

A document is not proof of compliance. Evidence must point to deployed controls, current assessments, procedures, provider configuration and accountable ownership.

## Legal baseline

The UK baseline includes UK GDPR and the Data Protection Act 2018 as amended, relevant Data (Use and Access) Act 2025 changes, PECR where applicable, the ICO Children's Code for covered services, and Online Safety Act 2023 duties where the service is in scope. Consumer, intellectual-property, payment and other mandatory laws remain applicable to their respective features.

This engineering reference is not legal advice, regulator approval or a substitute for specialist review of the actual deployed service.