How it works
What actually happens to the tablet
No magic and no vague language. This page is the mechanism, including the parts other products leave out.
Before you start
- A USB cable and the tablet in your hand. This is not done over the air.
- USB debugging switched on: Settings, About, tap "Build number" seven times, then Developer options, USB debugging.
- No personal account signed in on the tablet yet. Android refuses to hand supervision to anyone while an account is present — this is the rule that usually means a factory reset.
Why the reset is unavoidable. Device Owner can only be granted on a device with no accounts on it. That is Android's own protection against exactly the thing we do, and we would rather explain it than work around it. After setup you sign back into Google — or Amazon — normally.
The four steps the setup app runs
-
It looks, and it tells you what it found
Model, Android version, whether an account is present, whether the OEM has a blocker in the way. If your tablet cannot be fully supervised, you are told here — at the start, when you can still change your mind — and told what it can do instead.
-
It provisions supervision
The child app is installed and made Device Owner. Android now treats it the way it treats a work phone's management profile.
-
It applies the restrictions and reads them back
Every restriction is set and then read back through the same interface the tablet itself uses. What you are shown is what the device reports, not what we intended.
-
It shows a pairing code
Short, expires in fifteen minutes, works once. Type it into your dashboard and the tablet is linked to your account.
Exactly what is put in force
These are Android's own user restrictions. We list them by name because a vague claim cannot be checked.
| Restriction | What it stops | When |
|---|---|---|
no_add_user | Creating a second user profile to escape the managed one | Always |
no_safe_boot | Booting into safe mode, where third-party apps are disabled | Always |
no_factory_reset | Wiping the tablet from its own Settings | Always |
no_install_unknown_sources | Sideloading an APK downloaded from a browser | Always |
no_usb_file_transfer | Moving files on or off over USB | Always |
no_config_date_time | Winding the clock forward to defeat a schedule or a daily limit | When you switch it on |
no_config_private_dns | Pointing the tablet at a different DNS resolver to bypass filtering | When you switch it on |
Two things we deliberately do not set
no_install_appsis not set, so the Play Store keeps working.no_modify_accountsis not set, so you can sign into Google after setup.
How we know this list is true. It is not maintained by hand. An automated test provisions a real supervised device, reads every restriction back through Android's own UserManager, and fails if any of the five permanent ones is missing — or if either of the two we promise not to set has appeared. If this page and the product ever disagree, the build breaks before the page does.
What the child sees
A home screen with their things on it
FrameBright replaces the launcher. The apps you allowed are there, large and plainly labelled. Nothing else is.
A clear answer when something is blocked
Not a browser error and not a silent failure — a page that says this is not allowed right now, so a child knows the tablet is working and can ask rather than assume it is broken.
A way to ask
A request goes to you rather than to a dead end. The most common cause of a defeated filter is a child with no legitimate route to the thing they need.
Undoing it
Every installer has a reverse. The setup app can relinquish supervision and hand the tablet back; the Windows and Mac installers each ship their undo and install it before they change anything. You are never one bad step away from a device you cannot recover.