Every knob you can turn, named and explained.

Session timer.

Caps how long a single sit-down can last. Configurable from 0 (off) to 120 minutes in 15-minute steps. The studio shows a soft countdown the last 5 minutes; at 0, the project saves cleanly and the studio closes itself.

Defaults the studio suggests:

• Age 6–8: 30-minute sessions.
• Age 9–11: 45-minute sessions.
• Age 12+: 60-minute sessions.

You can override per kid. The session timer resets whenever the kid is offline for ten consecutive minutes — a stretch break or a snack run doesn’t count against the cap.

Daily cap.

Caps how many studio minutes a kid can have in a 24-hour window. Configurable from 0 (off) to 180 minutes. Multiple sessions in a day add up against this cap; the dashboard shows the running total.

The default cool-down is 24 hours; you can switch to a custom cool-down window (for instance, "8 AM the next morning" instead of rolling 24h). When the cap hits, the studio refuses to open and shows the kid when they can come back.

Ask for more time.

When a kid hits a session or daily limit, they can request an extension. The request goes to your email and the dashboard. You see what they’re working on, how much they’ve used today, and the optional reason they wrote ("I just need to finish this scene"). You approve a 15, 30, or 60-minute extension — or deny.

Default is off. Turn it on per kid. We recommend turning it on for kids 10+; younger kids tend to use it more often than the original cap.

AI budget.

Only relevant if you’ve subscribed to our managed Co-Pilot ($30/month or $300/year). The Co-Pilot ships with generous monthly limits; if you want to cap further, you can set a per-week AI-request cap per kid.

When a kid hits the cap, the studio still works — they can edit files, run wizards, keep / revise / undo their existing project. They just can’t generate new AI proposals until the next week. The dashboard shows the running count.

If you bring your own AI subscription (your Claude or ChatGPT account), this control does not apply — budget is enforced by your provider.

Content rating + per-category tuning.

Every kid is on G or PG-13. The full architecture lives at /parents/safety; the part that lives on this page is what you do with the rating.

Within each rating, the nine content categories (jailbreak / privacy leaks / self-harm / sexual / graphic violence / profanity / illicit / harassment / weapons) each have a default threshold. You can tighten any of them beyond the rating’s default. For instance:

• Your kid is on PG-13 but you want strict-G on profanity. Tune profanity to strict.
• Your kid is on G but you’re comfortable with mild action in service of a story. Loosen graphic violence to PG-13 (still blocks gore; allows a chase scene).

You cannot loosen below the most permissive PG-13 default. The categories never reach a "no filter" mode.

Notification preferences.

Three families of emails, each switchable on or off per kid:

• Approval prompts. Sent when the kid asks to publish. Default on; off only if you’re reviewing exclusively from the dashboard.
• Safety alerts. Sent when the filter blocks something. Default on, with per-category opt-out (you can mute notifications for, say, privacy-leak blocks while keeping notifications on for self-harm or weapons).
• Time-extension requests. Sent when the kid uses the "ask for more time" feature.

Other transactional emails (purchase receipts, billing changes, security signals) cannot be disabled — they belong to the account, not to the kid’s settings.

PIN management.

Each kid signs in with a four-digit PIN. You and the kid pick it together at profile setup; the studio hashes it (SHA-256 + per-account salt) in the browser before it ever leaves the device. The plain digits never reach our servers.

Reset paths:

• Kid forgot the PIN. You reset from the dashboard. The studio generates a new salt and hash; the old digits cannot be recovered (we never had them). Your kid picks a new four-digit code and signs in.
• You want to retire a kid profile. Delete the profile from the dashboard. Their projects move to your archive; the PIN is invalidated.
• You suspect someone else knows the PIN. Rotate it from the dashboard. New four digits, new hash, immediate effect.

Lights-out window.

An hours-of-the-day window during which the studio refuses to open. Set it once per kid; the dashboard enforces. Outside the window the studio works normally; inside, it shows a friendly note saying when it’ll be back.

Default off. We recommend turning it on for younger kids around bedtime — it removes the "just one more thing" negotiation entirely.

Multi-kid households.

Every control on this page is set per kid, not per family. An 8-year-old on G with strict profanity and a 30-minute session cap can live in the same household as a 13-year-old on PG-13 with no session cap and a custom lights-out at 10 PM. Sibling settings do not bleed into each other.

The dashboard shows all kids at once. You tune one without thinking about the others.

What you cannot override.

The settings on this page are dialled inward, not outward. Some defaults are baked into the product and cannot be loosened:

• The two-layer safety filter runs on every request. You can tighten categories. You cannot disable the filter or any single category.
• Publishing requires parent approval. No "trust mode" exists. Every public URL is an approval event.
• Card data never reaches our servers. Stripe holds payment data; we hold receipts.
• Kid PINs are always hashed in the browser. No setting puts the plaintext PIN on our network.
• The safety log retains 50 events per kid. You can read them; you cannot edit or delete individual entries. The whole log clears when you delete the kid profile.