Alan Gaudet
AND-03 · Rev 0.9.1

kinlens

A kid-safe AR camera for Android with face lenses, an editor and no network access.

In development

See it on the bench

The Send screen: a snap preview above two big destination buttons labelled by the parent.
Send: only the apps a parent turned on.
Parent mode, Limits tab: longest video, sticker and sound switches, snaps per day, and the lenses a child may use.
Parent mode, Limits.
Parent mode, Log tab: one send with its thumbnail, destination label, time and the receiving app's package.
Parent mode, send log.

Description

Children like the camera and the face lenses in social camera apps. The risk comes from the social graph around them. kinlens keeps the camera, the lenses, an editor and a local Memories vault, and drops every network feature. A parent chooses which installed apps may receive a snap and names each one, and parent mode sits behind a PIN with a send log the child cannot delete.

Block diagram

  1. CameraX frames
  2. Lens pipeline
  3. Editor + export
  4. Memories vault
  5. Approved app

Decisions

No network permission, checked on the built APK

The manifest never requests INTERNET, and the gate reads the permissions of the built APK with aapt2 and compares them with a short allowlist. A library's own request, such as the two media3-exoplayer declares, is removed at the manifest merge. A second allowlist holds every runtime Maven group, so a new dependency is a reviewed line. The cost is that every model, lens and sound ships inside the APK.

MediaPipe's telemetry goes to a local sink

MediaPipe tasks-core reports inference statistics to Google through Firebase datatransport. Excluding that library alone crashed the analysis thread with NoClassDefFoundError, so kinlens ships stand-in classes under the same names that count the events in process. A test proves the binding, and every MediaPipe upgrade has to repeat the javap sweep that found the call.

A snap leaves only through an app the parent named

The Send screen shows one big button per destination the parent turned on, with no chooser and no contact list. The share sink refuses any other package, writes the log row first, then starts ACTION_SEND with setPackage and one read grant from a FileProvider that serves only the media folder. There is no server to run, because the family's own messenger carries the file.

Errata

  • Background lenses read mirrored on the front camera; whether to flip them is still an open decision.
  • The lens tiles do not report their selected state to accessibility services. The TalkBack pass on every screen is scheduled before feature complete.

Revision history

0.9.1 Fixes from the Pixel 8 baseline: hats sit behind the head, a lost face fades out, the tracker idles when no lens reads the face.
0.9.0 Background swap and hair colour from MediaPipe segmenters, synthesized sounds under video, a daily snap cap.
0.8.0 3D lenses rendered by Filament, face paint on the tracked mesh, the parent's lens list turned into a denylist.
0.7.0 Parent mode behind a PIN, Send to parent-approved apps, a share-target Inbox that strips metadata.

kinlens is a working name.