Id really prefer my kids to not have a stock Android phone. Id sooner do iOS, but I don’t wanna encourage them to get into an ecosystem straight away.
I’m thinking GrapheneOS.
Set up a separate user profile and turn off their ability to install their own apps. That way nothing gets installed without my knowing.
Obviously they can access anything through the browser really anyway. But it’s less convenient and I think would discourage them.
Ideally I would take their phones off them at night. If they want a podcast they can pre arrange downloading the file and playing it on an mp3 player.
Are there any other measures I can implement on GOS? I don’t want to shelter them too much but at the same time I don’t want them doomscrolling until 2am.
I would not recommend GrapheneOS for parental control. There is no such setting in AOSP, you would be better served on stock android to limit your kids screen time and app installs.
This will not work, every time you power up the phone you need to unlock the owner profile.
If they know the password to the secondary profile, they can create a private space which has a browser. If you’re giving browser access, it’s a lost cause. You can remove the browser from that user profile using ADB, it’s quite simple commands than an AI can guide you through. You could give them just fingerprint and optionally 2nd factor pin as secondary unlock, and don’t tell them the password for the primary unlock and maybe create the private space initially with the primary unlock so they can’t use it.
It’s quite a complicated setup but it would prevent installing new apps without owner password and prevent web browsing.
I don’t see a huge reason why they should get web browsing as a dumb phone doesn’t have it and those work fine. With this setup they would get the benefits of a phone like advanced mapping, Signal, excellent camera, with only apps you allow them to install and no web access. If any apps don’t follow android best practice and allow visiting any website within them, that’s a way to continue web browsing.
Once MDM[1] is added to GrapheneOS, that should be a much simpler solution.
If they aren’t technical enough to figure out the private space method, then it is a lot simpler and that’s the only bypass I know of within the user profile. You’d still have to keep them out of the owner profile and unlock it before use after a restart or turn off.
iPhones are really great options for removing browser and app store because of apple configurator (mac needed). Here’s a post explaining it. That’s what i would recommend. Do not rely on screen time, though. It is not effective at preventing bypasses, but I heard it’s getting updated soon so time will tell.
TLDR: It’s not been added yet and a experienced community member estimates it is 35% done. MDM would allow you to retain recommended security practices, like not using ADB, while effectively restricting private spaces, apps, and browsers. ↩︎
Thanks for sharing. Though time limits are only a subset of what parental controls do. One of the main thing is blocking the install of new apps and restricting the subset of websites they can access.
Maybe my setup can be of help to you, this is what I do on my GrapheneOS “dumbphone”, to only use my phone as a tool and not for entertainment.
I first have an Admin Profile, the “Main user”. On this user I install all the apps that I want to use on my phone.
Next step I setup NextDNS and block all the sites I tend to scroll on (in your case, the sites you don’t want your kiddo to visit). Once NextDNS has been setup, you put the DNS domain inside the Private DNS setting under “Network and Internet” in settings. The DNS on the main profile will also be the DNS on the secondary user you create in a bit, but the DNS server cannot be changed from the secondary user.
Then I start creating a secondary user profile with the “Only allow apps for 1st party sources only” - then the only apps that kiddo can install are from GOS App Store (which is limited, lol). They CAN install Google Play, but cannot install apps from Google Play.
With the secondary user profile created now, you can now change the password on the main user to something only you know (in my case, only my partner has the passcode for the main user profile) and then your kiddo can create a passcode for their profile.
So now you have a phone that:
You can, from any other device, see and control what websites your kiddo does visit. (They can’t change the DNS in the second profile, so they’re locked) - No smart workarounds creating a private space or anything similar.
They can’t install apps. And if they want an app on their phone, you have to login and download it. Also, you can update the apps (from Obtanium, F-droid, Play Store whatever) when the kiddo is put to sleep.
This has worked wonders for me. I wish I could completely remove the browser however, without the help of ADB, or disable it with only the admin passcode being able to reenable it. But who knows, maybe when GrapheneOS implements App Lock when AOSP 17 QPR3 arrives, there can be some options there?
This setup has worked well for me and my “trying make my phone only a tool”-adventure, maybe it can help you too!
The only small issue with the above option is that if the phone dies/runs out of battery, they can’t access it again if they get power to their phone, before you enter the passcode on the main profile again. I don’t have a problem running out of battery, I can just wait till I get home. Maybe have your phone number on a slip of paper inside the phone case, so that your kiddo can call you in case of an emergency?