Set up their device from yours
You create your child’s account from your own phone and it is signed with your key. There is no sign-up a child can complete alone, and no “I am an adult” box a child can tick.
Chat. Call. Be Close.
Not released yet — in development
A phone for your kid that only calls people you’ve hugged.
Video, voice and messages between your child and the people you choose. Nobody else. Nothing else. There is no search, no discovery and no friend suggestions, so there is no way for a stranger to reach your kid.
No search, ever
There is no directory and no username lookup. A contact starts by scanning a code in the same room, face to face.
A grown-up says yes to every contact
Every contact involving a child only exists once a grown-up says yes on their own phone, with their own fingerprint or face.
We cannot listen in
Calls and messages are scrambled so that only the two phones involved can unscramble them. Because you set each contact up face to face, the phones know exactly who they are talking to — so nobody can slip in between, including us.
No trackers, no ads
No advertising, no analytics, and nothing from anybody else running inside the apps or on this page. Nothing here has asked your browser for anything off our own server.
How it works
Three steps, and one of them happens in person.
Add people by scanning a code in the same room
Grandma’s phone shows a code that works once; your phone scans it. That moment is also how the two phones learn to recognise each other for good, which is what keeps everybody else out of the call later.
You approve every single contact
Nothing connects until a grown-up says yes. Two children need a grown-up on each side. Any of them can cut a contact later, and it stops working straight away, even mid-call.
There is no search. There is no discovery. There are no strangers, because there is no way for a stranger to exist here.
What we keep
We keep almost nothing about your family.
This is the short version. The long version is a page with the real database printed on it, and you are welcome to go and check.
No names, no photos, no ages
Your child’s name and picture are set on your own phones and passed straight to the other phone. They never reach us — which is also why you can call Grandpa “Opa” and we will never know.
No list of your child’s friends
Who your child may call is decided on your phone and stays on the two phones involved. We do not have a list of your child’s friends — not a private one, not a locked one. We simply never made that list.
No messages, no calls
Calls and messages are locked between the two phones. A message waiting for a phone that is switched off sits here as a sealed box we cannot open, and it is deleted the moment it arrives.
If you would rather see it table by table, with the columns and the timers, the whole thing is written out.
Let’s get technicalApproval needed
An adult wants to connect with Emma.
If you approve, Marijn can call and message Emma directly, without you present.
No children on this account. This adult is not a parent of one of Emma’s friends.
I know who this is and I am choosing to allow it.
Approvals
When an adult asks to contact your child, this is what we show you.
We designed this screen to make you pause. The two buttons weigh the same. Approve is delayed by five seconds and needs an explicit tick, and the sentence doing the work is without you present — because that is the actual consequence, and it is the one a tired parent skims past at 9pm.
It also tells you what it knows about who is asking. An adult with no children on their account is not a scandal, but it is exactly the case worth reading twice, so we say it rather than leaving a blank.
Approvals never arrive as a button in a notification, and they cannot be swiped through. When a child adds another child, both families see this screen in a warmer form — and a child is never shown a refusal. A declined request and an expired one look identical: the tile simply fades. Grown-ups deliver social news, not software.
Money
How Rilo is paid for.
Rilo will be paid for by the families who use it. We have not set a price yet; when we do, it will be on this page before it is in an app store.
What it will not be is free because something else is paying. No advertising, no data partner, no analytics contract, no free tier funded by something you cannot see — because every one of those means building exactly the profile this whole design exists to make impossible.
Questions
The things parents ask first.
What age is this for?
Roughly four to ten. The child’s side is built for someone who cannot read yet: a grid of large photo tiles, navigation by face, no menus, and text that is decoration rather than instruction. The grown-up side is an ordinary app for you.
Do they need their own phone?
No. A shared family tablet works — each child gets a profile picked by tapping their own photo. You can also use an old phone with no SIM: everything runs over Wi-Fi.
My mother cannot work her phone. Will she manage this?
Her side is one screen: a photo of your child, and a green button when it rings. Setting her up needs the two of you in the same room once, with two phones, and that is on purpose — that moment is the whole point, not a chore we forgot to remove.
Can my child add someone without asking me?
They can start it, but nothing happens on their own. A child can scan a friend’s code, and it then sits on their screen as a little hourglass until a grown-up on each side says yes. If nobody does, it quietly disappears — a child is never shown that they were turned down.
What happens if I ignore an approval?
It lapses after 72 hours and the child sees the same thing they would have seen if you declined: the tile quietly fades. If you approve while the other phone is switched off, the decision waits up to 30 days for that phone to come back, then gives up.
Can I remove a contact later?
Any responsible adult can cut any of the child’s contacts, including during a call in progress. It disappears from the child’s screen with no explanation, because explaining is a parent’s job and not a dialog box’s. Children can remove their own contacts too — but never their grown-ups.
Can I read my child’s messages?
No, and neither can we. Messages are scrambled so that only the two phones involved can open them, and that wall has no side door — not for us, not for a court order, not for a parent. What you do decide is who your child can talk to at all, which at this age is the part that actually protects them. If you want to read along, do it the old way: sit down together with the phone.
Can we get old messages back if a phone breaks?
No. Messages live on the two phones and nowhere else — nothing is copied to us, so there is nothing for us to hand back. A new phone starts empty.
What happens if I lose my phone?
If a second grown-up is on your child’s account, they can cut the lost phone off with one tap. For your child’s own phone we offer you a recovery code to print when you set them up — keep it with the passports. If you have neither, there is no way back in and you start over. We cannot let you back in, because we never had the key in the first place.
What do you do with our data?
There is very little to do anything with. No names, no photos, no ages, no messages, no record of who your child talks to. We do not sell anything, we do not run ads, and no analytics company is watching you read this page. If you would like to see the whole list rather than take our word for it, it is written out in full. See everything we store
What if the grown-ups don’t agree?
Any grown-up on the account can add another, and can step away themselves, but nobody can remove anybody else. That is deliberate. We are not going to referee a family disagreement, and we are not going to build a button that lets one parent lock another out of their child’s account.
Is it really impossible for a stranger to reach my child?
Reaching your child takes two things at once: a code scanned in the same room, and a yes from a grown-up you had already trusted with that account, given on their own phone. There is nothing to guess, nothing to search, and no list of children anywhere to leak. Even somebody who stole everything we have could not create a single contact — we do not hold anything capable of granting one.
Which platforms, and where?
Native apps for iPhone and Android, phone and tablet. English, Dutch, French and Spanish from the first release. Launching in the EU.
When can I get it?
It is not finished. There is no waiting list to join and nothing to sign up for, because collecting your address to tell you about a privacy app later would be a strange way to begin.