KOMY Phone
How the KOMY Phone is built.
For everyone who wants to know exactly: which promises the KOMY Phone makes and how they are enforced in the program code and the test suite. As of 15 September 2026.
The product in three sentences
The KOMY Phone is a preconfigured, locked children’s phone with the companion Komy, plus the parents’ app KOMY Phone – Eltern on Google Play. Both are one code base in two variants; the parent variant contains no child content and is fixed to the parent role. Komy is a friend who needs the child’s help – never a tutor and never an answer machine.
Promises and how they are enforced
| Promise | Mechanism | Enforced by |
|---|---|---|
| No language model runs on the child’s phone. | Komy’s sentences, the vocabulary, 100 stories and around 1,200 name clips are stored on the phone as audio. A language model works only in our workshop, before bundling. | A manifest without audio breaks the build; tests check every situation list. |
| Offline listening is limited. | Speech recognition runs only with a fixed word list and only while a screen is actively listening. No transcript, no file, no upload. | A test ensures every word list ends with “unknown” and games know only their round’s words. |
| Every composed sentence is grammar-checked. | All combinations of sentence opening and word are exported and sent through a grammar check that writes a stamp. | An outdated stamp fails the test suite. |
| Komy is never an answer machine. | The few phrasings created at night on our server run exclusively through a core prompt with five hard rules. | A test checks that every task carries all five rules verbatim and no deficit wording reaches the child. |
| Data boundaries. | Memory book, Magic Sky and learning signals enter no sync path and no parent screen; no child’s name in the cloud; Android backup and device transfer carry nothing. | A test reads the source of both sync paths and the backup rules and fails as soon as a forbidden wiring appears. |
| No cloud copy of the child’s data. | The only copy outside the child’s phone is an encrypted, signed backup on the parent phone (AES-256-GCM, key only on parent phones). No server holds it or a key to it. | Tests for the envelope, the content and the handover of the backup. |
| The picture codes are bound to the device. | Komy code (parents) and child code are separate four-picture sequences, stored as a hash in the device keystore, never synced, never logged. | A test ensures no outgoing path knows the code. |
| Kiosk and locked device shell. | Komy’s world is the home screen; only the app and the emergency dialler are allowed; parent mode with automatic re-lock after 15 minutes; factory reset protection. | Test of the allow-list – the emergency call always stays. |
| Database encrypted at rest. | SQLCipher; the passphrase lives only under a key in the device keystore. | Tests for detection and migration. |
| Signed remote commands, lost mode, crypto erase. | Every command is bound to the family and exactly one device, not replayable, time-limited. Lost mode seals the vault; the erase shreds the keys first. | Tests for foreign family, foreign device, forgery, replay, expiry. |
| The child’s phone never asks for permissions. | Everything is granted in advance by the device owner; if a permission is missing, the feature quietly switches off. | Source rule for every request. |
| No image leaves the child’s phone. | Image analysis exists only in the parent variant; the child variant returns nothing. | Test: the image key is empty in the child release. |
What our server sees
There is exactly one server the child’s phone reaches: the KOMY service of Sysea, self-operated in Germany, shielded behind an access service. Without it Komy is silent – there is no fallback to a foreign provider. Every request carries only a random installation ID.
| Request | From | Content | When |
|---|---|---|---|
| Phrase Komy’s reminders for tomorrow | child’s phone | first name, weekday, subjects, appointment titles, practice topic, one reading memory with book title | at night, only on Wi-Fi and while charging |
| Voice a line | both phones | the text of the line; for a rare first name once “Name,” and “Name.” | at night, once per name |
| Read the timetable | only the parent phone | the downsized photo of the timetable | when scanning |
Voicing new lines currently runs via a speech service provider; the text of the line goes there, nothing about the child except a rare first name. Outside our server the child’s phone reaches only Google Firebase (EU region, for family, appointments, safe places, remote commands), the Google Play services for location, and a weather service with the place you chose.
What we are still working on
- Restoring from the backup is built but has not yet been run through in the field with two phones.
- Three phrasings (night planner, appointment reminders, parent text) are still created at night on our server; they are to be replaced by pre-checked sentence blocks. No model runs on the phone itself in any case.
- We will fix the retention period for location entries in the cloud before launch.
- Releasing the phone as a normal Android device when the child outgrows Komy is specified and will be part of every phone we deliver; it is not built yet.
- A safety escalation for serious situations is deliberately not built: Komy then points to a trusted adult, he does not monitor.
Around 640 automated tests run on every change. Many of them read the source code itself and fail as soon as a boundary would be crossed – long before a child could notice.