How it works
When a child wants to chat with a friend in another family, an admin from one side requests the connection. An admin from the other side approves. Once both have agreed, a dedicated conversation is created — with its own key, wrapped for the two children and the admins of both families.
Either side’s admins can revoke at any time. Revocation stops further messages being delivered to the removed party. Messages they’ve already received stay on their devices — revoke isn’t a way to un-send what’s already been seen.
Why we built it like this
Children’s friendships don’t follow tidy boundaries. Cousins, classmates, kids your kids meet on holiday — they all want to stay in touch, and most of the time the conversation is harmless. The risk isn’t that kids talk to other kids. The risk is that those conversations happen on platforms designed for engagement metrics and adults.
Shoal makes the safe path the easy path. Two-sided approval means no one is added without genuine consent. Both families’ admins have visibility, so there’s accountability without surveillance creep. And because each connection has its own key, removing access actually removes access — there are no orphaned permissions or stale invites.
The principle
Friends are good. Surveillance is bad. Approval is the middle path.
Cross-family connections in Shoal are deliberate by design. They take a few extra seconds to set up. That’s the point.