KOMY Phone
How the KOMY Phone is built.
For everyone who wants to know exactly: which promises the KOMY Phone makes and how they are enforced in the program code and the test suite. As of November 2026.
Good to know: Komy speaks German. Voice, stories, encyclopedia, learning games and the parents’ app are in German; contract language and legal texts are German as well.
The product in three sentences
The KOMY Phone is a preconfigured, locked children’s phone with the companion Komy, plus the parents’ app on Google Play. Both are one code base in two variants; the parent variant contains no child content and is fixed to the parent role. Komy is a friend who needs the child’s help – never a tutor and never an answer machine.
Promises and how they are enforced
| Promise | Mechanism | Enforced by |
|---|---|---|
| No language model runs on the child’s phone. | Komy’s sentences, the vocabulary, 100 stories and around 1,200 name clips are stored on the phone as audio. A language model works only in our workshop, before bundling. | A manifest without audio breaks the build; tests check every situation list. |
| Offline listening is limited. | Speech recognition runs only with a fixed word list and only while a screen is visibly listening – in the routine for at most 10 seconds after each question, with the notice “Komy hört zu …” (Komy is listening). No transcript, no file, no upload. | A test ensures every word list ends with “unknown” and games know only their round’s words. |
| Every composed sentence is grammar-checked. | All combinations of sentence opening and word are exported and sent through a grammar check that writes a stamp. | An outdated stamp fails the test suite. |
| Komy is never an answer machine. | Everything Komy says is written in advance, checked by a human and stored on the phone as audio. No language model phrases anything at runtime – neither on the phone nor on our server. | A test fails as soon as anything outside the named exceptions reaches our server or calls a language model. |
| Data boundaries. | Memory book, Magic Sky and learning signals enter no sync path; from them the parents’ app shows only on how many days this week your child read aloud – never the content. No child’s name in the cloud; Android backup and device transfer carry nothing. | A test reads the source of both sync paths and the backup rules and fails as soon as a forbidden wiring appears. |
| No cloud copy of the child’s data. | The only copy outside the child’s phone is an encrypted, signed backup on the parent phone (AES-256-GCM, key only on parent phones). No server holds it or a key to it. | Tests for the envelope, the content and the handover of the backup. |
| The picture codes are bound to the device. | Komy code (parents) and child code are separate four-picture sequences, stored as a hash in the device keystore, never synced, never logged. | A test ensures no outgoing path knows the code. |
| Kiosk and locked device shell. | Komy’s world is the home screen; parent mode with automatic re-lock after 15 minutes; resetting via the settings is blocked. | Test of the allow-list. |
| Database encrypted at rest. | SQLCipher; the passphrase lives only under a key in the device keystore. | Tests for detection and migration. |
| Signed remote commands, “vermisst” (missing), crypto erase. | Every command is bound to the family and exactly one device, not replayable, time-limited. A phone marked as missing shows only “Dieses KOMY Phone wird gesucht.” and an SOS button; the erase shreds the keys first. | Tests for another family, another device, forgery, replay, expiry. |
| The child’s phone never asks for permissions. | Everything is granted in advance by the device owner; if a permission is missing, the feature quietly switches off. | Source rule for every request. |
| No image leaves the child’s phone. | Image analysis exists only in the parent variant; the child variant returns nothing. | Test: the image key is empty in the child release. |
What our server sees
There is exactly one server the child’s phone reaches: the KOMY service of Sysea, self-operated in Germany, shielded behind an access service. Since 28 September our server no longer phrases anything either. Without it Komy still speaks – only updates and a rare name are missing then. There is no fallback to a third-party provider. Every request carries a random installation ID and a device attestation – nothing about the child.
| Request | From | Content | When |
|---|---|---|---|
| Voice a rare school subject | child’s phone | only the word, e.g. “Chemie” (chemistry) | once, on Wi-Fi |
| Voice a rare name | child’s phone | only the name itself, such as the first name of the child or of a caregiver | once, as soon as the phone is online |
| Check for and download updates | child’s phone | the installed version | on Wi-Fi while charging, about every 12 hours, or by hand behind the Komy code |
| Read a timetable or a letter to parents | only the parent phone | the downsized photo; our server passes it on to Anthropic (Claude) for analysis | when scanning |
Whatever the phone still has voiced – a rare name or a rare school subject – goes to a speech service provider as a single word, never as a sentence about the child. Outside our server the KOMY app talks only to Google Firebase (EU region, for family, appointments, safe places, remote commands), the Google Play services for location (with your consent also Google’s location accuracy) and a weather service with the place you chose. Android itself also connects to services of Google and the manufacturer, for example for the time and system updates.
What we are still working on
- The backup on the parent phone is built; restoring it onto a new KOMY Phone is still being built.
- We do not store a location history – there is only the last position per phone. Safe-place and SOS alerts are deleted automatically after 30 days, commands to the phone and their replies after 90 days; “Familie löschen” (delete family) removes everything at once. A lawyer will review these periods before sales start.
- A safety escalation for serious situations is deliberately not built: Komy then points to a trusted adult, he does not monitor.
More than 5,000 automated tests run on every change. Many of them read the source code itself and fail as soon as a boundary would be crossed – long before a child could notice.