Privacy on the KOMY Phone – what the app sees and what never reaches a server

A microphone in a child’s room is a matter of trust. So here is exactly what the KOMY Phone cannot do, where which data is stored and what leaves the phone and when. As of September 2026, checked against the program code – what becomes legally binding is decided by a lawyer’s review before launch.

Good to know: Komy speaks German. Voice, stories, encyclopedia, learning games and the parents’ app are in German; contract language and legal texts are German as well.

What the KOMY Phone cannot do

No open internet. The phone runs as a locked device. The child sees only Komy’s world; browser, app store, settings and all other apps are out of reach – even after a restart.
No calls, no messages. There is no phone and no chat interface. Only the emergency number 112 remains reachable. SOS to the parents is a button of its own, not a message.
No AI chatbot. No language model runs on the phone. Every sentence Komy says was written in advance, checked by a human and stored on the phone as audio. Komy holds no conversation, answers no questions, grades nothing.
No camera, no image recognition on the child’s phone. You photograph the timetable on your parent phone.
No looking things up online. The children’s encyclopedia (5,107 articles from Klexikon and MiniKlexikon, in German) is stored completely on the phone. What your child looks up is not recorded. Sensitive topics – war and violence, death, body and sexuality, addiction, crime, about 150 articles – stay invisible until you switch them on in the parents’ app; religion is deliberately open.
No permission prompts for the child. Everything is set at the factory; if a permission is missing, the feature quietly switches off.

Where what is stored

On the child’s phone, only there

The memory book from reading aloud, the Magic Sky, Komy’s planned sentences, game progress, the home map from geography, the child’s own stories, the Komy code and the child code. The database is encrypted. None of it goes into a Google backup or travels along when the device is changed.

On your parent phone

An encrypted backup of the child’s data, so that a lost phone does not cost Komy’s memory. It can only be opened with the family recovery key, which lives exclusively on parent phones; the parents’ app shows only the date and size of the backup. Never in it: the child’s typed words, the child’s own stories, codes and keys. It is transferred only in the same room via Bluetooth.

There is no child record in the cloud

The family entry at Google Firebase (EU region) holds per device: model, role, battery level, “last seen”, app version, normal or missing; plus the values you set yourself – weather place, school bag list, holidays, reading level, the chosen Komy figure, optionally a birthday – and a random child ID. Never the child’s name, never words, voice, learning notes or memories. Alongside: appointments, chores, rewards, safe places, location and alarm entries that only your family can read.

What leaves the phone, and when

The child’s position goes to the parents’ app: regularly on Wi-Fi, over the data SIM only with each contact (about every two hours), at once when a safe place is reached or left, every minute only while a parent has the live map open, and at once on SOS. Location entries can only be read by parents.
To our own KOMY server (no third party, only on Wi-Fi and while charging, at night): the text from which Komy’s reminders for the next day are phrased and voiced – first name, weekday, subjects, appointment titles, the current practice topic and one reading memory with the book title. A rare first name is sent once as text to be voiced; around 1,200 common first names are already on the phone. Each request carries only a random installation ID, nothing about the child.
Nothing of the child’s voice. Listening in the Komy call, in games and for the name is pure offline recognition with a fixed word list: recognised on the device, discarded at once, no recording, no file, no upload.
Weather: the child’s phone asks the weather service with the place you chose – never with the child’s position.
Your parent phone: the parent account (e-mail and name, never anything about the child). The timetable photo is processed once to be read and is not stored.

Your rights and switches

Consent for the learning companion: more detailed learning notes are only created after your consent in the parent settings. There you can consent, withdraw and “delete learning traces”; notes are deleted automatically after 90 days.
Delete family: in the parent settings; deletes account, family and cloud entries.
Phone missing: lost mode seals the data vault and shows only a neutral screen; “found” lifts it. “Delete data” makes all the child’s data unreadable. All commands are signed and bound to exactly one device.

Overview

Kind of data	Where	How long	Who sees it
Memory book, Magic Sky, own stories	child’s phone, encrypted	until deleted	only the child (backup on the parent phone, unopened)
Learning notes (only with consent)	child’s phone	90 days	nobody; Komy uses them to choose topics
Komy code, child code	child’s phone, as a hash	until changed	nobody
Position	cloud, location entry	will be fixed before launch	only the family’s parents
Device status (battery, last seen, mode)	cloud, family entry	until the family is deleted	family
Appointments, chores, safe places, rewards	cloud and both phones	until the family is deleted	family
Text for Komy’s sentences, name pieces	KOMY server, temporarily	short	Sysea operations
Parent account (e-mail, name)	Firebase sign-in	until “delete family”	Sysea, Google as processor

Encyclopedia content from the Klexikon and MiniKlexikon of the Zentrale für Unterrichtsmedien (ZUM), licence CC BY-SA. The Klexikon is an independent project; Sysea is not affiliated with ZUM.

How this is enforced technically is on the page How the KOMY Phone is built. The binding privacy policies are in German: KOMY service and website.