Parental controls and managed devices

For parents and school IT. Breadstick can install web browsers that Android's parental controls and school filters do not reach.

This page is for parents, guardians, and school and district IT administrators.

Please consider not allowing Breadstick on a child's managed device.

Breadstick installs a complete Linux system, and whoever is using it can add software to that system, including web browsers such as Firefox and Chromium. Those browsers run inside Breadstick rather than as Android apps, so most of the controls that protect a child's device never see them. Breadstick is built for people who want a full computer, and it has no way to apply restrictions that were set up for Android apps.

What a browser inside Breadstick gets around

• Browser filters. Family Link's website restrictions, and the web filtering a school pushes to Chrome through device management, apply to Chrome on Android. A browser inside Breadstick is a separate program and does not follow them.
• Account settings. SafeSearch and other settings tied to a child's Google account only apply while the child is signed in to that account, and a browser inside Breadstick can simply be used without signing in.
• App approvals. Requiring approval for downloads covers apps from Google Play. Software installed inside Linux does not come from Google Play, never asks for approval, and does not appear in the device's list of apps.
• DNS filtering. Linux inside Breadstick uses the DNS servers of the network the device is on, so a filter that runs on a home or school network's DNS server does apply to it. Android's own Private DNS setting does not: Linux asks the network's servers directly. And Breadstick's Settings let the user point Linux at any DNS servers they choose, which sidesteps a filter that depends on the network's server.
• Network filters. A filtering app that routes the whole device through a VPN, or a filter on the Wi-Fi network, still carries Breadstick's traffic. But tools that run inside Linux, such as proxies, SSH tunnels and Tor, can hide where that traffic is going.

What still works

• Blocking and time limits. Family Link, Digital Wellbeing and device management can block Breadstick, or limit its screen time, like any other app.
• Removing it. Uninstalling Breadstick deletes its Linux system along with every browser and program installed inside it. Files saved to the device's shared storage stay where they are.

How to keep Breadstick off a device

• Google Family Link. Require your approval for app downloads from Google Play, and decline Breadstick if it is requested. If it is already installed, block it in the child's list of apps in Family Link.
• School and managed devices. Block the app by its package name, io.breadstick, in your device management console, or use an allowlist so that only approved apps can be installed.

If you manage devices for a school and need something from us to do this, write to hello@breadstick.io.