kudo.kids

A family chore app a parent can trust with their kid's photos, built and run for about the price of a coffee a month.

We own and operate kudo.kids. Nobody commissioned it — which also means every decision on this page, including the ones that cost money and the ones we would take back, was ours to make and is still ours to live with.

The situation

Every family with children and a whiteboard has the same problem: the whiteboard works for about a fortnight. Chores get done inconsistently, nobody agrees on what was actually finished, and the reward at the end is vague enough that no child is motivated by it.

The constraint that shaped everything was trust. A chore app for families holds photographs of children, which means it is not a product where security can be a later phase. It also had to work on one shared device, where a parent and several kids take turns — a sign-in model most consumer apps do not have.

What we built

Daily tasks and habits with streaks. Kudos, a points currency kids earn and spend on wishlist rewards a guardian approves. Photo and video proof of completed work. A kid sign-in by avatar and PIN, while guardians use Google or Apple. Math Lab, an arithmetic drill game. The Learn tab, with 9.8 MB of hand-authored curriculum spanning grades 1 to 10 across maths, physics, chemistry and biology. A family calendar, progress charts, co-guardians, friend leaderboards and a kid journal.

Then the parts nobody sees: the whole cloud backend, the iOS build and submission, the privacy manifest, the App Store listing, and the bill.

Architecture

Three views of the same system: what runs in AWS, how state gets from a phone to the table, and how one stylesheet drives two very different surfaces.

The orange path is the one worth noticing. Proof media never passes through Lambda or DynamoDB: the API hands back a five-minute presigned URL and the phone uploads to S3 directly. That keeps the request small, the function fast and the most sensitive data on one audited path.

The client is authoritative between flushes, which is what makes the app usable with no signal. Actions are queued as typed ops rather than diffed state, so a flush that arrives late still applies in the right order instead of overwriting whatever happened since.

Two surfaces that look nothing alike, driven from one token block. Hierarchy comes from weight and size on a single family — a three-font system shipped briefly and was pulled after cross-browser loading rendered whole sections in Times.

Selected screens

The kid dashboard: today’s tasks on a time rail, kudos earned, and the current streak — The kid view. The time rail across the middle is the design decision that mattered most — a child reads "what is left today" off it faster than off a list, and a parent can see at a glance whether the morning went well.

The guardian dashboard: approvals, per-kid progress and wishlist management — The guardian view. Same design tokens, different stress: the kid surface is a sticker album, this one is an editorial dashboard. Both are driven from a single stylesheet.

Both are the screenshots currently on the App Store listing, so they are what a visitor can verify rather than a mockup.

Where it stands today

Around 50 active users, and growing. That is a small number and we are not going to dress it up as anything else — but it is a real one. These are families who installed it, came back, and are putting their children’s photographs through it, which is a much harder thing to earn than a download count.

It also means the infrastructure numbers on this page are not theoretical. The $2.30 a month is what it costs to serve those people, with photo uploads, a sync queue and point-in-time backups running. The interesting part of that figure is not how small it is today; it is that the architecture has a great deal of headroom before it stops being small.

How it was built: AI-assisted, end to end

This is the project the method was built on, and it is where the numbers come from.

Development runs through a pipeline that drains one card at a time off a project board. Each issue gets a fresh agent session with the repository and the project’s own conventions, and that session implements the change, adds a test, runs the whole suite itself, and pushes. If the suite fails, a second session receives the failure log and nothing else. Green merges to production; an unrecoverable failure halts the queue and waits for a human.

Of the 232 changes that landed on main, 169 were merged by the agent once the suite was green and 63 went through a pull request. 209 of them deployed to production. That is not a demo — it is how the app in the App Store got there.

A second thing is automated, and it is the unglamorous half: the release plumbing. App Store Connect is driven through a zero-dependency API client that signs its own tokens, and a monitor watches review status. The App Store screenshots on this page were themselves generated by a script that seeds a demo family and captures at the exact device sizes Apple requires, so a UI change cannot silently leave the store listing stale.

What AI is not doing here: it is not in the product. Nothing the app ships calls a language model. And it does not decide what to build — the scoping, the architecture, the security model and the review of anything touching a child’s data are ours. The agent works inside gates we wrote. That distinction is the whole of how we work.

Judgment calls

Running no WAF

A web application firewall would have cost around $16 a month for two web ACLs — by a wide margin the largest single line on a $2.30 bill. The AWS managed rule groups mostly target classes this stack does not have: no SQL, because it is DynamoDB; no filesystem routing; Node rather than Java. Meanwhile the things that actually protect this app — server-side token verification, per-kid access assertions, anchored input validators — are untouched by them.

A managed-rule false positive that blocks a real parent mid-task costs a small team more than the scanners it would have stopped. The declaration stays in terraform/waf.tf as a restore recipe, to be revisited at non-family scale or the moment an unauthenticated write path appears. The piece genuinely worth buying then is a rate-based rule, which those ACLs never had.

Three fonts collapsed to one

The redesign briefly shipped a serif, a sans and a handwriting face. Cross-browser font loading then rendered whole sections in Times and Calibri on machines that did not have them cached. Hierarchy now comes from weight and size on a single family. It is cheaper, it is faster, and it cannot fail that way again.

Merging without pull requests

169 of 232 changes went straight to main once the test suite was green. A pull request whose only reviewer is also its author is ceremony, not review. The test gate is the real gate and the deploy log is the real record. Changes that genuinely needed a second look got one.

What we would do differently

Proof media is not swept when an account is deleted — the objects expire on a 180-day lifecycle rule instead. That is a documented trade-off rather than an oversight, and the lifecycle does eventually do the job. But an explicit delete path on account closure is the thing we would build on day one rather than day two hundred.