backstop.family / un-features
Every ‘no’ below is a design decision. Together they describe the product.
An un-feature is something Backstop could have built,
competitors did build, and Backstop chose not to. Every one below is
architectural — the code path isn’t there, not a
“we haven’t gotten around to it.” Every product in
this space that got bad press got it by saying yes to something on
this page.
On what we watch
- No message reading. Not SMS, iMessage, WhatsApp, DMs, or email. We don’t touch messaging APIs on any platform. Bark does; we don’t.
- No keylogging. No input hooks, no accessibility-service snooping, no capture of what your child types.
- No microphone access. No camera activation. No call recording. Backstop’s binary declares none of these permissions.
- No location tracking. Backstop has no geolocation code path. Life360 built a company on selling this; we don’t collect it.
- No app-usage or website histograms sent to us. The endpoint sees what’s on screen; the server sees nothing about your child’s habits.
On the tool itself
- No covert mode. No stealth install. No hidden process. Bark ships a “hidden” install option; we architecturally refuse. The child can see Backstop running, uninstall it, and tell you they did.
- No anti-tamper. No ELAM manifest. No kernel-level self-protection. We are visible software running as a normal user. If the child kills it, you find out because the endpoint stops sending heartbeats — not because the OS wouldn’t let them.
- No forced-update lock-in. The updater is a plain check; the parent can pin a version or uninstall entirely.
On where the screen contents go
- No screenshots leave your child’s device. They go from the screen buffer to your BYOK LLM, and the LLM’s answer is the only thing that travels further. Recall stored screenshots forever; Bark ships them to its cloud; Gaggle ships them to a school district; we send them nowhere we control.
- No screenshots stored on the endpoint after evaluation. Deleted immediately when the LLM answers. Not queued, not cached, not on disk.
- No screenshots in Backstop’s cloud. Ever. There is no bucket, no private folder, no “backup” path. The code cannot upload one because the network route doesn’t exist.
- No plaintext alerts on our servers. Encrypted with your family key before they leave the endpoint. We store bytes we cannot read.
- No plaintext configuration on our servers. Your taxonomy and blocklists ride the same E2EE envelope as the alerts.
On what “harm” means
- No vendor-defined harm taxonomy. You write what counts. The endpoint reads your rules, not ours. Gaggle’s model failures are well-documented; we refuse to be the one making those calls for you.
- No hidden category updates. Config is versioned; every change is something you did in the parent app, not something we pushed to your child overnight.
- No shared “community” blocklists baked in. The default taxonomy is a starting point you edit, not a policy Backstop keeps changing.
On who else sees your data
- No sale of data to brokers. Life360 did; we don’t have the data to sell.
- No ad targeting off your child’s behavior. No ads on any surface.
- No selling to schools or districts. Backstop is a parent-facing product. Gaggle is B2B for districts; we are not that product and won’t become one.
- No customer-support access to your alerts. Even if you email us screaming, we cannot look at your alerts to help. They are ciphertext to us.
On the AI
- No vendor-locked model. Bring your own key: OpenAI, Anthropic, Google, or any OpenAI-compatible endpoint you point us at.
- No LLM key transmitted to Backstop. It stays on the endpoint’s OS keychain.
- No prompt or response body logged by us. We’re not in the middle of that request.
On recovery
- No “we can restore your data if you forget your password.” Your family key is derived from a 24-word BIP-39 mnemonic you saved at signup. We do not hold a copy. This is the same property that makes the subpoena page short. It’s not a bug; it’s the guarantee.
The pattern
We started from what we wouldn’t ship. Worked backwards to what we would.
Every parental-control product that got bad press did it by saying yes to something on this page. That’s why the feature list is short and the un-feature list isn’t.