Kids’ AI · The control surface
Parental controls are a hardware decision — the app only reports what the board allows
Almost every privacy claim in this category is written on the app side, and almost every one is limited by the board. If the microphone shares a rail with the always-on wake engine, “mute” is a software state a bug can undo. If the wake word runs in the cloud, audio is already leaving the room before the toy is asked anything. And if the app can only say “connected”, a parent has no way to answer the question they actually ask: what did it hear last night? The controls that hold up are the ones implemented below the application layer — and they cost a switch, a pin and the discipline to design the failure path first.
Who usually comes to us
Brands selling into regulated markets
Buyers and retailers now ask for the data story in writing before they ask for a sample, and a vague answer stalls the listing.
Brands whose differentiator is trust
When the price is not the lowest, the product has to be defensible in a parent forum thread. That is a design property, not a marketing tone.
Teams being asked “does it record us?”
A question that needs a one-sentence answer, printed on the box, that survives a teardown by someone who does not trust you.
Education and care products
Products used by children and by older adults, where the person operating the settings is not the person being recorded.
Three microphone paths, three different promises
The same phrase on a spec sheet — “voice control” — describes three architectures with completely different privacy properties. Buyers are starting to know the difference, which means the architecture has to be a selling point rather than a footnote.
Always-on local keyword
A small engine on a low-power path listens for one word and nothing else. Audio does not leave the device until the word is heard. The honest sentence for the box: it waits for its name, and only then listens.
Push-to-talk
A physical button gates the microphone entirely, which is the strongest promise and the weakest experience for a child. It survives every review and loses to a competitor’s touch-free demo in a store.
Cloud wake detection
Cheapest silicon and the best wake accuracy, because the detection runs on a server that hears everything. It is legitimate for some adult products and very hard to defend in a child’s bedroom.
Whatever the architecture, put the sentence on the box in the parent’s language, not the engineer’s. The reviewer will read the box first.
The screens a parent app actually needs
- Setup that finishes
- Scan, join, name the child, done — under two minutes, with a fallback for a 5 GHz-only router and a way to recover a device that joined the wrong network.
- What it heard
- Recent topics and transcripts, with a block log beside them. Showing only the good conversations is the mistake that ends trust the first time a parent finds the other list.
- When it listens
- Quiet hours, session length, a hard bedtime, and the mute state mirrored from the hardware switch so the app never contradicts the toy.
- What it may discuss
- Parent-lockable topic groups in plain language, plus the ability to add a family rule the model has to respect — and to see when a rule was triggered.
- Delete, and mean it
- One action that removes the child’s history, the voice profile and the memory, with a confirmation that says what will be lost. A delete button that leaves embeddings behind is worse than no button.
Where the control actually lives
Mute has to open the circuit
A slide switch in series with the microphone’s supply, or a hardware mute pin on the codec that also gates the digital path. Software mute is a state; a switch is a fact. The difference shows in a teardown and in a firmware update that goes wrong.
Wake word local, audio short-lived
The keyword engine runs on the device and hears nothing but the keyword. After a wake, only the utterance is streamed, the buffer is released as soon as recognition returns, and the transcript — text, not audio — is what persists. Storing audio “for quality” is the decision that turns a toy into a liability.
Data minimisation is a schema, not a policy
The database either has a column for raw audio or it does not. It either has a retention field with a default or it does not. Writing the schema first — child profile with a nickname rather than a real name, transcripts with an expiry, no location unless the product needs it — is how the privacy page stops being a promise and becomes a description.
The parent has to be able to reach it
Binding by QR code rather than a manual pairing ritual, more than one adult per child, and a household where the account holder is a grandparent. An app that assumes one technical parent with one phone is an app that half the market cannot finish setting up.
Failure has to be legible
“Can’t reach the server” is not a sentence a parent can act on. The app should say what still works (tap-to-play, wake, volume) and what does not (open conversation), and offer the one action that fixes it. Support load in this category is mostly confusion, not defects.
Directions to start from
AI Talking Plush
A plush your child actually talks to
- Parent app
- Content guardrails
- Offline wake word
- No camera
Ages 3–10
Expressive-Eyes AI Toy
Two LCD eyes carry the whole mood
- Dual LCD eyes
- Emotion engine
- Touch sensing
- Mic array
Ages 6+
Two ways to develop with us
Privacy review of an existing design
We read your schematic, firmware notes and app flows, and give you a written list of what a buyer’s technical reviewer will object to — with the cheapest fix for each.
Best for: The product exists and a retail conversation just got technical.
Controls designed in on a new build
Switch, wake architecture, data schema, app screens and the wording on the box, decided together with the electronics rather than retrofitted.
Best for: You are still at requirement-sheet stage, which is the cheap moment.
Full development including the parent app
Device, firmware, cloud, parent app and the admin console the brand uses to answer support questions, built as one system.
Best for: Trust is the product positioning, so the control surface is the product.
Platforms
Bring the AI stack your market needs
Our firmware is decoupled from any single provider. Depending on where you sell, your data-residency rules and your budget, we connect the device to the right LLM, speech and IoT cloud. These are the kinds of services we have integrated.
For China
- Baidu AI Cloud Solution sales partner Cloud AI and voice services
- Mainstream Chinese LLMs Several to choose from, per project
- Speech recognition & synthesis Major speech engines
- IoT provisioning & branded app Device setup and app under your brand
- Audio / video storage & delivery Audio / video cloud for content
For global markets
- Leading overseas LLMs Chosen per market and language
- Realtime voice dialogue Realtime voice models
- Neural speech synthesis Speech recognition and natural voices
- Device connectivity & fleet management Connect and manage devices at scale
- EU / US data hosting Data kept in the region you sell in
Questions buyers ask
Does the toy record audio and keep it?
By design, no: audio exists only long enough to be recognised, and what persists is the text transcript with a retention period the brand sets and the parent can shorten. That is a schema decision, so it should be stated in the requirement sheet and verifiable in the database — not just written on a marketing page.
Is the mute switch real or a software setting?
Ours cuts the microphone circuit with a slide switch and gates the digital path in the codec. A software-only mute is what makes a product fail a technical review, because the reviewer knows a firmware bug can undo it.
Can parents see what their child talked about?
Yes — topics and transcripts in the parent app, scoped to that child, deletable by the parent. We do not put a live audio feed in the app: listening in real time is a different product with different consent obligations, and it is not what a bedtime companion should be.
Where should the data live for our market?
That is your call as the brand and the importer, and it changes the architecture: region-specific hosting, or on-device-only for markets where any cloud processing of a child’s voice is difficult to paper. Tell us the markets and we will show you what each choice costs in features and in latency.
Does any of this need a certification we do not have?
Compliance for a children’s connected product is filed by the client for the client’s markets, and we do not claim certificates we do not hold. What we do is design toward the applicable requirements — electrical safety, radio, toy safety, and the data-handling obligations your market imposes — and hand over the technical files your lab and your lawyer ask for.
Tell us what you want to build
The category, your market, a quantity and whether an IP is involved is plenty for a first answer. Samples available; proven products are available as OEM, custom ones as ODM. Development and sample arrangements are agreed together once we understand the project.
Start a conversation