Three facts about this product
Agents here do things. They draft, they book, they answer a phone, they move a task from one place to another without asking twice.
Money is real. Balances are spent in cents, payouts land in bank accounts, and creators earn from people they have never met.
And adults and minors use the same app. Not a kids’ edition and a grown-up edition living in separate stores — one product, with content levels inside it.
Any one of those three is a reason to know who is on the other side of the screen. Together they make it structural. An unverified account is not a neutral state on a platform like this; it is an account we cannot make correct decisions for.
So we check at the door.
Everyone, at the point of entry
The age check is part of creating an account, not a setting you opt into later. There is no self-declared checkbox and no birthday field — we do not ask you to type a date, because we do not consider a typed date to be an answer.
The checkbox model is the industry’s polite fiction. It exists to create a record that the user lied, which is useful in a courtroom and useless to a fourteen-year-old. We would rather have the answer than the paperwork.
Today the check is a selfie you take in the app. The mobile platforms are moving toward supplying age signals of their own, and adopting those is on our roadmap rather than in the product today — when it lands, a device that already knows an account belongs to a minor will be able to say so before anything else happens. Those signals would not replace our own check. They arrive earlier, which matters, because the safest age decision is the one made before the first screen loads.
Identity verification exists too, and it is worth being precise about its role: it is an appeal route, not a gate. If a check reads an adult as a minor, verifying with a government ID through Stripe Identity corrects it. That is the only thing it is for. No content level on myOrbit requires a government ID, and none is gated behind one.
The one promise we make about the photo
Here is what we will commit to in public, because it is a promise rather than a mechanism.
The photo is deleted right after the check.
That sentence is load-bearing, so it is built rather than asserted. Deletion runs on a guaranteed path: it executes whether the check succeeds, fails, or crashes partway through, because the alternative — deletion that only happens when everything goes right — is not a promise, it is a hope. It is idempotent, so a retry cannot leave a copy behind or fail because the copy is already gone. When a deletion does not succeed, it raises an alarm rather than a log line nobody reads. And behind those three sits a storage backstop that clears anything still present within a day.
What we will not say is “we never store the photo.” It exists for the length of the check, and in the rare case where every other safeguard fails, the backstop is the thing that ends it. A company that tells you a file was never anywhere is describing a system that does not exist, and you should treat the claim accordingly.
The trade, said plainly
Every age check costs something, and the cost is not evenly distributed.
It costs you a moment of friction at the worst possible time — the first minute in a new app, when your patience is thinnest and your reason to trust us is weakest. It asks you to hand over something personal, for the length of a check, on the strength of a promise you cannot personally audit. For adults who are obviously adults, it is an interruption that proves something nobody doubted.
Skipping the check costs something too. It costs minors their safety, in a product where agents act and money moves and adult content levels exist a settings toggle away. That cost does not land on the median user having a mildly annoying Tuesday. It lands on the people least able to absorb it, and it lands invisibly, which is what makes it easy for a company to choose.
We chose the friction. Not because the trade is close, but because it isn’t: a moment of inconvenience distributed across everyone is worth less than a child’s safety concentrated on one person. Any product that tells you it found a way to have neither cost is selling you the third option that does not exist.
What we will not publish
We will not describe how the check works. Not where it runs, not what performs it, not what the system looks at to reach an answer.
This is deliberate, and the reason is not modesty. An age check is an adversarial system. The people most motivated to read a detailed description of it are the people trying to get past it, and every specific we publish is a specific they can work against. Documenting the mechanism would make this note more interesting and the product less safe.
What we will publish is the shape of the commitment: that the check happens, that nobody skips it, that identity verification is only ever an appeal, and that the photo is deleted right after with the discipline described above. Those are the things you can hold us to. The mechanism is not a promise we can keep by explaining it.
Where the bar goes
This is version one of something we intend to keep raising. The check will get better at being right, and at being brief — the goal is a door you barely notice, not a door that isn’t there.
We would rather be early and imperfect on user safety than late and elegant. With any technology there are tradeoffs; what we owe you is that they are clear. Read the safety page for how age fits the rest of the system, and the privacy policy for what we keep and for how long.