Colophon
What Koda is built on.
What runs locally, what we deliberately don't run, and the privacy commitments that hold regardless of the final hardware. Both halves are load-bearing — what we run is the product, and what we don't run is part of the product too.
Five models run locally on the Koda device. Specific libraries and weights will be named in the press kit at launch — what's locked in is that all of them run on the device in your home, none of them call out to a cloud, and the frames they read are discarded after each tick.
- Language model
decides what to say, when to interrupt, which hint rung to climb. Runs locally; never calls a cloud LLM at runtime.
- Handwriting recognition
reads what your child writes on the worksheet, in real time. Runs on the same device; pixels discarded after each frame.
- Face matching
recognizes which child in your family is at the desk. Embeddings are encrypted in the local database; the original enrollment photos are stored as image files in the local profiles directory, and are removed when you delete the profile.
- Voice synthesis
speaks. Local, deterministic; no recordings of your child's voice sent anywhere.
- Math verifier
checks every numerical answer deterministically — no statistical guessing, no LLM voting on whether the math is right.
- Local database
single file on the device for profiles, voice settings, event log. Delete a profile = single-cascade delete; no copy on a server.
- Wake word
an optional 'Hi Koda' listener. Off by default. Runs on the device when on. Doesn't transcribe — fires on a single phrase only.
- Software updates
the only network traffic Koda generates. You control when they run.
- Static-rendered marketing pages
every public route is pre-rendered HTML.
- Atkinson Hyperlegible (body) + DM Sans (display)
Atkinson is research-validated for legibility; DM Sans gives the warmer hardware-product display.
- Workflow videos
rendered programmatically; embedded in the relevant pages.
- Waitlist + transactional email
stores email addresses and audience tags only. No tracking pixels, no behavioral analytics.
Listing the omissions is the point of a colophon, not a footnote. Each line below is a deliberate architectural decision rather than a feature we forgot.
- Cloud LLM at runtime
no OpenAI / Anthropic / Google call during a session — reasoning is local.
- Frame upload
no camera frames leave the device — vision runs locally and frames are discarded after processing.
- Telemetry on session content
we don't log the words your child said, the problems they got wrong, or the work on the worksheet.
- Third-party tracking on this marketing site
no Google Tag Manager, no Facebook pixel, no Hotjar, no session recording.
- Streaks / variable-reward systems
no streak counter, no daily-bonus loop. Effort earns XP; a missed day doesn't punish anyone. (Long version: /blog/no-streaks)
- Targeted ads
we don't sell ad inventory and we won't take partnership integrations that put marketing in front of a child.
The longer notes that go with this list: why we run on-device instead of in the cloud, why a deterministic verifier checks the math instead of the LLM, and how the silence-default supervisor decides when to speak.
If you're an engineer thinking about this kind of architecture and want to talk shop — hello@kodatutor.ai.