$ curl -I asknoodle.ai → server: cloudflare

Lift the lid.

You build this sort of thing for a living, so you want specifics before you hand it to your child. Here are the models we use, where they run, what we keep and what we don't, and the places it still falls short.

In short: what your child types or says is answered and checked by AI models running on Cloudflare. Everything we store about your family is in the EU; Cloudflare's own request logs, which hold IP addresses for 7 days, are not.

// where it runs

Noodle runs on Cloudflare.

The app, everything it stores and all of its AI models run on Cloudflare's network. The text, safety, listening and voice models run inside that network, so what your child types or says isn't sent to an AI company. Ask Noodle is an independent company, not part of Cloudflare.

  • on Cloudflare's network

    No servers of our own

    The app runs on Cloudflare's network, not on servers we manage, so there are no servers of ours to patch or leave open. Every request is usually handled at the Cloudflare location nearest your child.

  • isolated per family

    One private store per family

    Each family's chats, house rules and question count live in their own store, kept apart from every other family. The app works out which family is asking from the signed-in session, not from anything the browser sends.

  • inside the same network

    The models

    The text, safety, listening and voice models run on Cloudflare's own GPUs, not on an AI lab's servers. Every call goes through a gateway that keeps no log of chat, safety or voice requests.

Stored in the EU

Chats, house rules, accounts and read-aloud audio are stored only in the EU, using Cloudflare's EU jurisdiction. Each request is handled at the nearest Cloudflare location, which for UK families is usually in the UK.

Where the models run

Cloudflare runs each model wherever it has spare capacity, which can be outside the UK and EU. Your child's question passes through the model and isn't kept there.

The plumbing, drawn
AT HOMECLOUDFLARE'S NETWORKEverything below runs here. Nothing a child types leaves it.CHILD'S DEVICEpaired with a club code,no account, no passwordGROWN-UP'S PHONEsigns in with an emailedcode, never a passwordTurnstile at every sign-inWORKERThe app and its APISign-in and devicesThe Sunday email, and a dailycheck that the safety modelhasn't driftedEACH FAMILY'S STORERuns every safety checkIts own Durable Object anddatabase of chats, rulesand allowancesEUAI GATEWAYrequest logging offWORKERS AIClef-flash checks everyquestion and answerGemma 4 writes answersSpeech in, a voice outDIRECTORY (D1)Grown-ups, first names,age bands, devices, countsNever a chatEUAUDIO STORE (R2)Answers already read aloud,so a repeat costs nothingEUQUEUE: EMAILSent later, and retriedEMAILSign-in codes, urgent alertsand the Sunday email, neverwith a child's words in themEUkept in the EUThe models themselves runwherever Workers AI has room;nothing they see trains them.

A child's device and a grown-up's phone talk to one Worker on Cloudflare's network. The Worker hands each family's questions to that family's own Durable Object, which keeps the family's chats, rules and allowances in its own small database and runs every safety check by calling Workers AI through AI Gateway, with request logging off. D1 holds who's who and never a chat, R2 keeps audio of answers already read aloud, and a queue sends sign-in codes, urgent alerts and the Sunday email, never with a child's words in them. The family stores, D1 and R2 are kept in the EU; the models run wherever Workers AI has room, nothing they see is used to train them, and we keep no log of it.

// every model, by name

The four models we use

Each has one clear job. They're mostly open-weights models, so anyone can run and test them. All four run on Cloudflare.

  • Gemma 4 26B

    @cf/google/gemma-4-26b-a4b-itGoogle · open weights
    Job

    Answers every question on every plan: curious questions, homework help, stories, quizzes and lessonsAlso: spots attempts to trick Noodle out of its rules, in a separate call with its own instructions

    What it sees

    The question and the last few exchangesTrick check: the question alone, as data rather than instructions

  • Clef-flash

    @cf/cloudflare/clef-flashCloudflare
    Job

    Safety check on every question and answer, plus the self-harm and "growing up" checks on every question

    What it sees

    The question, or the answer plus the messages before it

  • Whisper large-v3-turbo

    @cf/openai/whisper-large-v3-turboOpenAI · open weights
    Job

    Turns a spoken question into words

    What it sees

    Up to 15 seconds of audio, never stored

  • Aura-2

    @cf/deepgram/aura-2-en · voice "luna"Deepgram · partner
    Job

    Reads answers aloud

    What it sees

    Only words your child was already shown

Gemma also tags each chat with a one-word topic for the Kitchen, your parent dashboard, judges the teen games, and turns My Noodle descriptions into a choice from our own list of things to wear, with replies from our own templates, never the AI. Ready-made jokes, facts and quizzes were written by us and checked with Llama Guard before shipping, so they need no live check.

// why these models

Why we chose these models.

Every question and every answer goes through the same content check, so we tested the models that could do that job, and we keep testing newer ones: six so far. Cloudflare's Clef-flash caught more harmful questions and answers than Meta's Llama Guard 3, raised no false alarms on ordinary questions, and none of its 590 checks took longer than 8 seconds. Larger models caught no more harmful answers and at most one more harmful question.

  1. We wrote the test set.

    Questions children ask and answers Noodle gives, harmful and ordinary, none from a real child. Someone other than the writer labelled each one.

  2. The set it was tuned on.

    We chose Clef-flash on this, then fitted its thresholds on a larger version, so it flatters the result.

  3. Cases it had never seen.

    239 new cases, written by one AI assistant and labelled by a second that never saw the first's labels, before any model scored them, with the checks as they ship. Nothing was refitted, so these are the numbers to trust. A person read the labels.

Llama Guard 3 8B against Clef-flash, on two test sets
The set it was tuned onCases it had never seen
What we measuredLlama Guard 3 8BClef-flashLlama Guard 3 8BClef-flash
Harmful questions caughthigher is better53 of 6666 of 6634 of 4140 of 41
Harmful answers caughthigher is better16 of 2121 of 2114 of 1717 of 17
False alarms on ordinary questionslower is better2 of 1510 of 1510 of 540 of 54
False alarms on ordinary answerslower is better0 of 292real Noodle answers0 of 292real Noodle answers0 of 42written for the test0 of 42written for the test
Slow checks, over 8 secondslower is better15 of 590 (slowest 22.7 seconds)None. 95% answer within about 1.3 seconds—Not shown for this set—Not shown for this set

The unseen set is small: 41 harmful questions and 17 harmful answers. Its 239 new cases include 85 that test the separate self-harm, harm-at-home, growing-up and other checks, so this table shows the other 154.

What Clef-flash is, and how we tuned it

It's a 9-billion-parameter model from Cloudflare that answers yes-or-no questions about a message and scores how sure it is, and it also runs our self-harm and growing-up checks. On the set its thresholds were fitted on, it caught 81 of 81 questions and 65 of 65 answers.

The bigger models we also tried

We also ran Cloudflare's two larger Clef models, TypeSafe's Jev, and Gemma 4 (which writes Noodle's answers) asked to judge instead, on the same questions with the thresholds unchanged. None caught more harmful answers. The two larger Clefs caught the one borderline question Clef-flash let through, but they cost more to run for that one case. Gemma caught fewer harmful answers, raised more false alarms, and missed 7 of 81 harmful questions on the tuned set, which is why a separate check runs at all.

// what happens to every question

Every question is checked going in and coming out.

Every typed or spoken question goes through the same steps in this order. If a step can't run, your child gets nothing rather than an unchecked answer.

  1. Your rules first

    Quiet hours, the daily limit you set, the pace limit (6 questions a minute per child, so a script can't hammer it), and breaks: after 20, 30 or 45 minutes of continuous use, by age, your child gets a 5-minute break. You can make breaks come sooner, but you can't switch them off. Questions are capped at 1,000 characters.

  2. Your word list

    We lower-case it, strip accents, turn v@p3 and v . a . p . e back into words, and match whole words only, so "class" never trips on "ass".

  3. Four checks at once

    Clef-flash sorts the question into risk categories. A separate model looks for attempts to get round the rules. Two more Clef-flash checks, each asked separately, look for self-harm and for growing-up questions. Self-harm is also asked inside the first check, so one miss isn't enough.

  4. Your house rules decide

    For each category you've chosen to block it, answer and tell you, or just answer. Some categories are locked, so no setting can allow them.

  5. The answer, sized for their age

    Different instructions and length limits for ages 6 to 9, 10 to 12 and 13 to 15.

  6. Code checks after the model

    Instructions to a model aren't guarantees, so plain code checks the answer as well. An answer never promises to keep a secret from you: Noodle always tells children their grown-ups can see their chats. If Keep the magic is on and the answer gives away Father Christmas, the whole answer is swapped for a hand-back to you.

  7. The answer is checked again

    The word list, then Clef-flash on the answer together with the messages just before it, so harm that builds up over a conversation is judged in context. An answer with self-harm detail is never shown to your child: they get the kind care answer instead, and you get an alert.

It fails closed.

If Clef-flash or the injection check errors, times out or returns something we can't read, there's no answer. Your child sees "Noodle's safety check isn't working just now, so nothing was sent. Try again in a minute.", and the question isn't counted. The message is also kept from the Kitchen, in case it was about harm at home.

A child the checks think may be at risk is never turned away.

Noodle answers kindly and names Childline (0800 1111) and other trusted adults. Unless the message might be about harm at home, each grown-up who hasn't turned urgent alerts off gets an email straight away, at any hour, for up to 3 chats a family a day; after that they show in the Kitchen. The email doesn't quote what your child wrote. The checks can miss things and email can be delayed: Noodle isn't a monitoring or emergency service.

Stopped answers are kept for you.

Your child sees a kind "got in a bit of a tangle" card. You see the full exchange in the Kitchen, including what was stopped.

Children can say an answer wasn't right.

Every answer has a "This wasn't right" link. Tapping it tells you in the Kitchen, with the answer marked, and it's counted, never which answer, so we can see how often children push back. Children can't type anything into it.

Voice goes through the same steps.

A spoken question turns into words your child can read, fix and then send. It's checked exactly like typing.

// what we keep, and for how long

What we keep, and when it's deleted.

A child doesn't have an account. Noodle knows their first name and age band, and that's all. Children are told, in words for their age, that their grown-ups can see their chats.

  • Kept: Yes

    Chats

    Where
    Your family's own store, EU
    For how long
    30 days on Free or 12 months on Family, after the chat was last used, or when you delete it or your family (backups hold deleted chats for up to 30 more days)
  • Kept: Never

    Voice recordings

    Where
    Held in memory for one request, then gone. A test checks every table to make sure
    For how long
    Not kept
  • Kept: Cached

    Read-aloud audio

    Where
    EU storage, in your family's folder
    For how long
    30 days, or deleted with your family
  • Kept: No content

    Model gateway logs

    Where
    Cloudflare's AI gateway
    For how long
    Chat, safety, listening and voice requests: no log kept
  • Kept: Briefly

    Cloudflare's technical logs

    Where
    Cloudflare, not limited to the EU
    For how long
    7 days. They include IP addresses, never what your child typed
  • Kept: No quotes

    Weekly email

    Where
    Your inbox
    For how long
    Topics and anything that was stopped. Never your child's words
  • Kept: Never

    Training AI on your child's chats

    Where
    Cloudflare doesn't train models on customer content
    For how long
    Not kept

Why grown-ups see whole chats, even at 15.

Noodle is a learning helper that a parent sets up and can look into, so we chose the same visibility for every age, with one exception. Teenagers are told so on their home screen, and in every chat, in plain words: their grown-ups can see their chats, the weekly email lists topics but never their words, and grown-ups are told straight away if something worries Noodle. House rules are looser at 13 to 15, but what you can see doesn't change.

// voices

What we picked for speech, and why.

We tested these choices on real voices, including a child's, and chose the one that did best for children rather than the cheapest or the newest.

listening · whisper-large-v3-turbo

Talk to Noodle

We tested two speech models by recording real questions and scoring each transcript by hand.

Child, Whisper
5/6
Child, Nova-3
4/6
Adult, Whisper
18/20
Adult, Nova-3
17/20
  • Whisper was more accurate with a child's voice, and it's open weights run by Cloudflare, so no extra partner's terms apply.
  • Push to talk only, 15 seconds at most, with no wake word or open mic. Your child sees the words and can fix them before anything is sent, and the recording isn't kept.
  • No wake word or open mic
read-aloud · aura-2 · "luna"

Read it to me

  • The device's own voice sounds robotic to a six-year-old. Aura-2 sounds like a person, and it runs inside Cloudflare too.
  • Luna is warm and upbeat. We tried a British voice first, and it sounded flat to us when reading to children.
  • It only reads what your child has already seen, never an answer that was stopped.
  • On Free, and when a Family's month of real-voice reads passes fair use, it uses the voice built into the device, and only one that runs on the device itself. If there isn't one, the answer isn't read out.

// known limits

Where it still falls short.

No AI safety check is perfect, and we'd be lying if we said otherwise. These are our own tests, and they're why Noodle runs several checks and shows you the chats instead of trusting one model.

The tests use question sets we wrote or had written to our brief. They help us choose and layer checks; they don't measure how safe Noodle is in real use. The checks running today are version 2026-11-07.1.

When we attack the whole app with the real models:

  • 156/163attacks stopped; none of the other 7 showed anything harmful
  • 143/143children at risk were cared for
  • 6/381ordinary questions stopped by mistake
  • 40/41

    Clef-flash on questions it had never seen

    It caught 40 of 41 harmful questions and every harmful answer on 239 new cases, with no false alarms. The one it missed sits on the line between curiosity and danger, and real use will find more like it.

  • 23/23

    Clef-flash on self-harm

    It caught all 23 at-risk messages in our calibration set, with no false alarms on 23 others. It's a small test, written and labelled by one person.

  • 31/31

    The trick check

    It caught all 31 attempts, and every trick attempt again when we attacked the whole app. Its false alarms were ordinary questions that sound like tricks, such as asking what Noodle's instructions are. It's also a small set we wrote ourselves.

  • Noodle can be wrong. Nothing fact-checks its answers; homework help and the "Catch the AI out" game teach children to check, and that's the defence we have.
  • Speech recognition mishears young children. A misheard question is answered as heard, and still checked.
  • Your word list only catches the words on it.
  • We lean towards care, and that brings false alarms. Messages that only sound worrying, like "promise you won't tell my parents", reach you as urgent alerts. We'd rather that than miss a child who needs help.
  • Two ordinary questions score just over the self-harm line. A score that close only counts when the separate self-harm check agrees, so neither reaches you. We tried four rewordings and none did better, so the patch stays and we say so here.
$ npm run deploy
✗ refused: no scored red-team run
  for this version of the checks

We try to break every change to the safety checks before it goes live. It's called red-teaming: hundreds of questions written to trick Noodle, or to hide a child in trouble, go through the whole app with the real models. The change can't go live until the results are no worse than before and a person has signed them off.

// what we don't publish

What we keep to ourselves, and why.

We hold these back from everyone, parents included, because they would help someone attack Noodle or copy it. Everything they do is described on this page.

  • Our prompts

    They'd show someone exactly what to work around.

  • Check thresholds

    A score cut-off tells an attacker how close they can get.

  • The code

    It's a small company's work. We may open parts of it later.

Found something? Tell us.

If you get Noodle to say something it shouldn't, or you find a security hole, we want to hear about it. A real person reads every report, and replies to security reports within 3 working days. Please don't test on a real child's account. Use the test chat in the Kitchen, which shows you exactly what your child would see.

Join the waiting listSee what we promise
Safety reports
hello@asknoodle.ai