Changelog

Parents must record guardian consent before creating a link. Withdrawing that consent immediately invalidates the shared reader and its media requests.

Export without leaking private fields

The owner can open a print-friendly HTML handoff or download the HTML variant. Both use authenticated asset proxies and leave prompts, raw R2 keys, checksums, and encrypted child profiles out of the document.

Deletion has a recovery boundary

Deleting a book revokes its readers and schedules exact-prefix R2 cleanup. An administrator can retry a failed cleanup without restoring the deleted book.

Safety before generation

Deterministic child-safety checks run before private draft persistence and after generated story validation. Semantic moderation remains opt-in until production coverage, cost, and false-positive behavior are accepted.

This release is still a private beta. The production Worker, domain, and provider credentials remain separate launch prerequisites.

A private beginning

PictureBook starts with a signed-in family workspace. Child details are stored as a validated encrypted profile and are never part of an anonymous reading response.

Twelve pages with room to review

Every story revision has twelve English and Chinese page pairs. Parents can save, submit, approve, or request changes while the revision history stays explicit.

PictureBook checkpoints

Story, illustration, and narration each have their own review boundary. A parent can retry one failed asset without losing the rest of the book.

A gentle reader

The owner reader presents English first with optional Chinese support. A revocable share link exposes only approved story media and never exposes the child profile or provider prompts.

Honest early access

The private beta is still being connected to its production Cloudflare Worker. Credit purchases and hosted mail remain closed until their production credentials and domain are deliberately configured.

PictureBook trust and reading updates