Skip to main content

​
On the robot

The robot is a passive sensing + decision node. It never uploads media.
A moment is counted only when it’s genuinely worth counting: a real adult faced the screen, close enough and long enough, while the robot was steady. Everything else is telemetry, not a billable moment.

​
The gated install

No source ships to the robot. The installer fetches a signed, ABI-matched, compiled artifact gated by your fleet key:
If the key is invalid/revoked or the runtime is unsupported, nothing is installed.

​
Revocation

The running SDK checks in with Kovio on a short interval. If the key or robot is revoked, the SDK stops on its own within one interval — a leaked copy is inert without a live key.
Security posture, stated plainly: this raises the cost of copying and makes a leaked artifact useless without a live, revocable key. It is not represented as making on-device code secret — the operator has root on their own robot.