Privacy
A small machine in your home. That's where your child's data stays.
Koda was built around a hard rule: nothing about your child leaves the device. Not the camera frames. Not the voice. Not the worksheets. Not the face embedding. Not the progress data.
Camera frames never leave the device.
The device in your home does the looking and the thinking. Nothing leaves the device unless you ask it to. No cloud LLM at runtime.
Reasoning runs locally on the device — no cloud round-trip.
Video frames are not stored or transmitted off the device.
Delete a profile and everything cascades. Single switch, no support ticket.
Reasoning, vision, voice — all of it.
The device in your home runs the language model. It runs the worksheet vision. It runs the wake word. It runs face recognition. It runs the speech synthesis. The cloud is not in the loop.
- Local language model
Reasoning runs on the device — no cloud LLM call at runtime.
- Worksheet vision
Handwriting recognition runs on the device. Frames are processed and discarded.
- Voice
Speech synthesis runs on the device. Wake-word detection runs on the device.
- Face recognition
On-device face embeddings, encrypted in the profile row. Optional — tap-the-avatar always works.
No cloud LLM. No frame upload. No analytics on your child.
- We do not call public LLM APIs at runtime.
- We do not store or transmit camera frames off the device.
- We do not log or analyze your child's voice or face beyond on-device matching.
- We do not sell, share, or rent your child's data — there is no place for it to go.
- We do not use your child's work to train a model.
- We do not run third-party trackers on the marketing site you're reading.
Delete a profile and everything cascades.
Profiles live in a single local database on the device. Each profile owns its own photos, embeddings, and event log. When you delete a profile, every row tied to it is removed. There is no separate cloud copy to chase down. There is no support ticket to file. One switch, done.
The device's mic and camera lights are visible whenever they're on. Sessions only run when you start them or when the supervisor wakes on a known face. You can mute the mic from the parent portal at any time. Frames during a session are processed in memory and discarded; only structured events (a problem attempted, a hint requested, an XP delta) are written to disk.
Compliant for kids under 13.
A parent account is required. Children's data is processed locally and never disclosed to a third party. We collect the minimum needed to run the tutor — a name, a chosen avatar, optional photos for face recognition — and that data lives only on your device. Full COPPA disclosures live in our legal page.