Platform limitations

Limitations imposed by Google, Apple or other platforms that obacht runs into. One entry per limitation: platform, what we wanted to do, what blocks it, workaround (if any), source.

iOS/iPadOS: web push only for apps on the home screen

• Date found: 2026-10-15
• Wanted: notify parents in the browser about new extra-time requests (web push).
• Blocked by: Safari on iOS/iPadOS (16.4+) only offers the Push API to web apps added to the home screen, not to pages opened in the browser.
• Workaround: the parent app tells iPhone/iPad users to add obacht to the home screen first. A native parent app with APNs is the alternative later.
• Source: https://webkit.org/blog/13878/web-push-for-web-apps-on-ios-and-ipados/

Android (Play): device admin only deters uninstalling

• Date found: 2026-10-15
• Wanted: keep a child from uninstalling the agent on a phone that is not set up as device owner (play flavor).
• Blocked by: a regular app can only become a device admin. Android lets the user turn the admin off in the security settings and then uninstall the app; the app gets a warning text in, but cannot stop it. Only device owner (or Google's own Family Link) can block uninstalling.
• Workaround: the owner flavor (device owner via adb or QR provisioning). In play, the device stops syncing, so the parent app shows it as last seen at that time.
• Source: https://developer.android.com/reference/android/app/admin/DeviceAdminReceiver#onDisableRequested(android.content.Context,%20android.content.Intent)

Android (Play): the child can change the phone's clock

• Date found: 2026-10-16
• Wanted: rules that can't be dodged by setting the clock back (out of bedtime) or ahead (to a new day with fresh budgets), an old trick against Family Link.
• Blocked by: only a device owner can lock the date and time settings (DISALLOW_CONFIG_DATE_TIME, used by the owner flavor). A regular app can't.
• Workaround: the agent keeps its own time (TrustedClock): every answer from the server fixes it to the server's clock (HTTP Date), and in between it advances with elapsedRealtime, which keeps counting in deep sleep and which no setting changes. After a reboot it applies the last known difference to the phone clock until the next sync. A clock changed in the seconds between a reboot and the agent's start goes unnoticed until that sync. The difference is reported (clock_offset_secs), and parents are told when it is more than five minutes. On Windows only administrators can change the clock, and the child's account is a standard user (see below).
• Source: https://developer.android.com/reference/android/os/UserManager#DISALLOW_CONFIG_DATE_TIME, https://developer.android.com/reference/android/os/SystemClock#elapsedRealtime()

Android (owner): factory reset from recovery mode

• Date found: 2026-10-15
• Wanted: keep the child from resetting the device to get rid of obacht.
• Blocked by: DISALLOW_FACTORY_RESET only covers the settings app. A reset from the recovery menu still works; only Factory Reset Protection then asks for a Google account (setFactoryResetProtectionPolicy), which ties enforcement to a Google account.
• Workaround: none yet; decide with the QR provisioning test whether to set an FRP account.
• Source: https://developer.android.com/reference/android/os/UserManager#DISALLOW_FACTORY_RESET

Steam: playtime only from public profiles, in minutes, no family API

• Date found: 2026-10-15
• Wanted: count a child's Steam playtime toward their limits (M2), ideally through Steam Families, which already knows parents and children.
• Blocked by: the documented Web API (IPlayerService/GetRecentlyPlayedGames) only returns lifetime minutes per game, and only when the profile and its game details are public. Steam Families' own API (IFamilyGroupsService, e.g. GetPlaytimeSummary) is undocumented and refuses Web API keys (HTTP 401); it only works with a signed-in Steam session token.
• Workaround: obacht polls the public API every 5 minutes and counts the difference, so Steam time arrives in whole minutes with a few minutes' delay, and can only be used for budgets, not to stop a game on the PC. On a PC with the obacht agent, Steam games are measured live and named like the import (steam:<appid>, from Steam's app manifests), so they can be blocked there and their time counts once (the import only adds what the PC did not measure).
• Source: https://partner.steamgames.com/doc/webapi/IPlayerService ; tested 2026-10-15

Windows: the child's account must be a standard user

• Date found: 2026-10-15
• Wanted: keep the child from stopping or removing obacht on the family PC.
• Blocked by: an administrator can stop any service, end any process and delete any file. Windows offers no protection against an account's own administrator.
• Workaround: obacht runs as a SYSTEM service from boot, its files sit in Program Files and in %ProgramData%\obacht (readable only by SYSTEM and administrators), so a standard-user child cannot stop it, read its device token or replace it. The child's account has to be a standard user; parents keep the administrator account. The tray icon runs as the child and can be ended in Task Manager, but the service starts it again within seconds.
• Source: https://learn.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works

Windows: no foreground window from the service

• Date found: 2026-10-15
• Wanted: measure which program is in the foreground from the service alone.
• Blocked by: services run in session 0, which has no access to the user's desktop; GetForegroundWindow only works inside the user's session.
• Workaround: the service starts a small helper in the child's session (CreateProcessAsUser), which reports the foreground program over a pipe and shows the tray icon. Closing programs and locking the session stay in the service.
• Source: https://learn.microsoft.com/en-us/windows/win32/services/interactive-services

iOS: apps are opaque tokens

• Date found: 2026-10-15
• Wanted: apply the same per-app rules on iOS as on Android (the policy names apps by id).
• Blocked by: the Screen Time API only hands out opaque ApplicationTokens from FamilyActivityPicker; the app cannot read bundle ids or names from them.
• Workaround: a parent picks the apps for each obacht category, limited app and blocked list on the child's device; the selections stay on that device (plan in the iOS notes).
• Source: https://developer.apple.com/documentation/familycontrols/familyactivityselection

iOS: no usage numbers leave the device

• Date found: 2026-10-15
• Wanted: report per-app usage time from iPhones/iPads, like the other agents, so budgets count across devices and parents see which app was used how long.
• Blocked by: exact usage is only available inside a DeviceActivityReport extension, which can render a view but cannot send data out. The app only gets callbacks when a selection reaches a threshold it set in advance (DeviceActivityEvent).
• Workaround: thresholds in steps per category; the device reports per-category time in those steps (e.g. 5 minutes). Parents see categories, not apps, for iOS devices.
• Source: https://developer.apple.com/documentation/deviceactivity/deviceactivityreport

Android TV / Google TV: no always-visible notification, settings screens may be missing

• Date found: 2026-10-16 (from Android's TV documentation; to verify on a Google TV)
• Wanted: the same child-visible indicator as on phones (a permanent notification), and the usual setup through the usage access and accessibility settings screens.
• Blocked by: Android TV has no notification shade: the agent's ongoing notification only shows in the TV's notification panel (Google TV: under settings), not on screen at all times. Some TV models also leave out the usage access or accessibility settings screens, so the agent can't send the parent there.
• Workaround: obacht shows up on the TV home screen with its own banner, and opening it shows the same status as on a phone. When a settings screen is missing, the agent shows the adb command a parent can run instead (adb shell appops set <package> GET_USAGE_STATS allow, adb shell settings put secure enabled_accessibility_services <package>/io.obacht.agent.BlockService). The owner flavor doesn't need accessibility.
• Source: https://developer.android.com/training/tv/notifications

Android 13+: the permanent notification needs the notification permission

• Date found: 2026-10-16 (emulator test of the real setup, PlayOnboardingTest)
• Wanted: obacht's ongoing notification is always visible on the child's phone, from the moment it is paired.
• Blocked by: since Android 13 (POST_NOTIFICATIONS), a foreground service's notification is hidden until the app is allowed to post notifications. The child can also deny the permission, or turn the notification off later in the settings. obacht keeps running and enforcing, but the notification shade no longer shows it (it is still listed under active apps in the quick settings).
• Workaround: the app asks for the permission during setup and keeps showing its "Allow notifications" card until it is granted.
• Source: https://developer.android.com/develop/ui/views/notifications/notification-permission

Android (Play): safe mode, other users and profiles, developer tools

• Date found: 2026-10-16 (bypass review, project file security/bypass-review.md)
• Wanted: keep limits in force when the child restarts in safe mode, opens a guest user, a second user, Private Space (Android 15), a clone profile (Dual Apps) or a work profile, or uses adb / wireless debugging (also on the phone itself, e.g. Shizuku) to switch obacht's permissions off.
• Blocked by: a regular app can't set user restrictions; only a device owner can (DISALLOW_SAFE_BOOT, DISALLOW_ADD_USER, DISALLOW_ADD_CLONE_PROFILE, DISALLOW_ADD_PRIVATE_PROFILE, DISALLOW_DEBUGGING_FEATURES). Apps in other users and profiles are invisible to obacht. Time used in safe mode is still counted after the next normal start (from Android's usage stats), but nothing is blocked meanwhile.
• Workaround: the owner flavor sets all of these restrictions while paired.
• Source: https://developer.android.com/reference/android/os/UserManager

Android (Play): a picture-in-picture window can't be closed

• Date found: 2026-10-16
• Wanted: close a blocked app that keeps playing in a small picture-in-picture window or beside another app in split screen.
• Blocked by: a regular app can only bring its own screen to the front; it can't close another app's window. Android 9 and older also don't say whether a paused app is still on screen, so there split screen and picture-in-picture time counts only for the focused app.
• Workaround: obacht counts every app on screen (Android 10+), keeps showing its blocked screen while the app is visible and takes audio focus, which makes video apps pause. The owner flavor suspends the app instead.
• Source: https://developer.android.com/develop/ui/views/picture-in-picture

Android: no system-wide DNS-over-HTTPS

• Date found: 2026-10-16
• Wanted: point a phone at obacht's DNS filter.
• Blocked by: Android's Private DNS setting only takes a DNS-over-TLS hostname, not a URL; obacht's built-in filter is DNS-over-HTTPS only, and a per-device DoT hostname would need a wildcard certificate, port 853 and would leak its secret in plain DNS lookups.
• Workaround: the Android agent filters websites itself: a local VPN (VpnService) that routes only one made-up DNS address into the app, decides each query with the engine on the phone and forwards allowed ones to the network's resolver. It only runs while the child has website rules. Limits: a phone has one VPN slot, so another VPN app turns the filter off (reported to parents as website_filter_off); in the play flavor the child can also set a Private DNS hostname or a browser's own secure DNS, which skip it. The owner flavor makes obacht the always-on VPN and locks Private DNS to automatic. Answers too big for UDP (rare) fail, as TCP queries aren't answered.
• Source: https://developer.android.com/reference/android/net/VpnService, https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setAlwaysOnVpnPackage(android.content.ComponentName,%20java.lang.String,%20boolean)

Windows: booting another system

• Date found: 2026-10-16
• Wanted: keep obacht in force on the family PC.
• Blocked by: whoever can boot the PC from a USB stick or Windows install media can reach the disk and the system files without signing in.
• Workaround: setup advice for parents: BitLocker (device encryption), a UEFI/BIOS password, and no booting from USB.
• Source: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/

Android 13+: restricted settings for apps installed from a file

• Date found: 2026-10-16
• Wanted: let a parent turn on usage access and the accessibility service for obacht installed from an APK (sideloaded play flavor, before it is in the Play Store).
• Blocked by: Android 13 and later lock these switches as "restricted settings" for apps installed from a downloaded or local file: the switch is greyed out ("Controlled by restricted setting") or Android shows "App was denied access". Newer versions lock usage access too, not only accessibility.
• Workaround: Settings, Apps, obacht, ⋮, "Allow restricted settings", confirm with the PIN. The menu entry only appears after trying the switch once. The agent shows these steps and an "Open app info" button next to both switches when it was installed from a file (PackageInstaller.PACKAGE_SOURCE_*_FILE). Installs through a store, adb or the owner flavor's QR provisioning are not affected.
• Source: https://support.google.com/android/answer/12623953

Android (Play) and Windows: installs can't be stopped, only new apps blocked

• Date found: 2026-10-16
• Wanted: let parents decide which apps a child can install in the first place.
• Blocked by: on Android, only a device owner (or Google's own Family Link) can turn off installing (DISALLOW_INSTALL_APPS, DISALLOW_INSTALL_UNKNOWN_SOURCES); a regular app like the play flavor can't. On Windows, a standard account can't install anything that needs administrator rights, but per-user installers, Microsoft Store apps, Steam games and portable programs need none. AppLocker/WDAC could stop them but are not on Windows Home.
• Workaround: the owner flavor turns installing off (Play Store, other stores and APKs) while a child's new apps need approval; this can also hold back updates of installed apps from the Play Store. Everywhere, "New apps need my approval" in a child's settings blocks a new app from running until a parent approves it: the engine blocks apps without a rule, so it holds offline. On Android only apps with a home-screen icon wait (system dialogs and the settings app never do); on Windows, programs in the Windows folder never wait.
• Source: https://developer.android.com/reference/android/os/UserManager#DISALLOW_INSTALL_APPS

AI built into other apps can't be limited on its own

• Date found: 2026-10-17
• Wanted: limit AI chatbots wherever a child uses them (the ai category).
• Blocked by: assistants built into other apps (Snapchat's My AI, Meta AI in WhatsApp and Instagram, Gemini in Android and Chrome, Copilot in Windows and Edge) run inside their host app or the system. Telling them apart would mean reading what happens inside the app, which obacht never does.
• Workaround: only the host app's limits apply. Standalone AI apps and the known AI websites (crates/obacht-engine/src/ai.rs) count as ai. Websites are limited by the DNS filter (built-in DoH, AdGuard Home sync); on Android phones without website rules the filter isn't running, so AI sites in a browser only count against the browser's limits. The vendors' own teen controls can do what obacht won't (see AI apps and chatbots).
• Source: design decision (privacy rules in CLAUDE.md).

This page is part of obacht's documentation, licensed under CC BY 4.0. Source on GitHub · CC BY 4.0 · Version: main (976f125)