KidlyooKioskWatchdog
A background service that listens for foreground-app changes via the Accessibility API. If the foreground app isn't on the approved list, the service bounces it back to Kidlyoo within milliseconds.
How it works
The technical reality, without scaring you or oversimplifying. Two layers of defence, four permissions, and an honest list of what we deliberately don't try to defend against.
A background service that listens for foreground-app changes via the Accessibility API. If the foreground app isn't on the approved list, the service bounces it back to Kidlyoo within milliseconds.
Some Android phones aggressively kill background services. As a fallback, we run a foreground service that polls the Usage Stats API once per second. If the Watchdog gets killed, the fallback still bounces escapes.
| Attempt | What happens |
|---|---|
| Press Home button | Watchdog detects within ~100ms, bounces back to Kidlyoo. If Kidlyoo is your Home app, no escape happens at all. |
| Swipe up to Recents | Same as Home. Detected and bounced. |
| Pull notification shade | Doesn't bypass kiosk - Kidlyoo's main screen ignores notification taps until PIN. |
| Tap a notification | If the notification opens another app, the Watchdog bounces it back. |
| Double-tap power for camera | Watchdog bounces back. |
| Force-stop Kidlyoo from Recents | Bounce-resume kicks in: when Kidlyoo restarts, it goes straight back to the kid session if the watchdog flag is fresh. |
| Restart the device | On boot, Kidlyoo doesn't auto-launch. You start the next session intentionally. (An Android safety behaviour, not a Kidlyoo limitation.) |
| Find the parent PIN | Out of scope. We can't stop a kid who watches a parent type the PIN. We do offer auto-pin and biometric for extra layers. |
We ask for exactly what we need to enforce the kiosk. No more.
When Kidlyoo is the Home app, every Home-button press opens Kidlyoo. The kid never flashes through your home screen.
Lets the Watchdog know which app is in the foreground. Used for one thing only - bouncing back to Kidlyoo when an off-list app comes forward. We never read your screen, capture text, or send anything anywhere.
A backup signal for the Watchdog. If the OS kills the Watchdog, the Usage Access fallback (a foreground service) keeps bouncing escapes. We only ever read the current foreground app, never history.
Tells Android not to kill our background services. Without this, the Watchdog gets terminated and the lockdown breaks. Battery cost is small (about 0.5 to 1% per hour while a kid's session is running).
Lets approved calls happen inside the kiosk so the kid doesn't break out. We never request this if you have phone access set to Off for every child.
For the deep-dive on each, see Help - Permissions.
Each phone holds its own approved-apps list. Why? OEM apps differ across devices. Samsung's calculator is com.sec.android.app.popupcalculator; Oppo's is com.coloros.calculator. A single cross-device list would show phantom tiles that fail when tapped.
When you install Kidlyoo on a second phone, a one-tap "Copy approvals from your other device" intersects the source list with locally-installed packages, so we never copy something that isn't on this phone.
Three ways back in, in order:
Fingerprint or face, if you set it up earlier.
Your Kidlyoo sign-in password.
Standard reset to your sign-in email.
So in practice, "I forgot my PIN" is never a dead end. PINs are hashed and salted at rest; we never store them in plaintext.
Honesty matters more than over-promising. Here's where Kidlyoo stops trying.
Our target is preventing accidental escape and casual probing, not defeating a security researcher.
Free tier, no card, every safety feature included.