The wall between a kid's jars and the household

What a kid can reach

A kid’s version of CubbyJar has three tabs: “Jars”, “Chores” and “Goals”. The Jars tab also holds the kid’s asks, the Save growth a grown-up set, and their own settings. Inside that space, a kid can see their own three jars and their balances, their own feed of everything that has happened to their own money, their own goal and how close it is, their own open payday, their own asks and the answer to each, and their own chores waiting, done, or sent back. That is the entire kid experience, and it is also genuinely all of it: a kid can move money between their own jars in the three directions the app allows, mark a chore done, set or change one goal, ask a grown-up for money from a jar, and place a payday.

What a kid cannot reach

Outside that space, there is nothing. A kid cannot see the household’s accounts, its income, or its debts. A kid signed in with their own PIN cannot see a sibling’s jars; on a tablet a grown-up signed in for all the kids, the siblings share the screen and each taps their own name. There is nothing to buy inside the app and no price to look at anywhere, because CubbyJar is not a store. There is no chat and no message thread.

Where the rule lives

It would be easy to build this as a setting: hide a few screens from a kid’s view and call it finished. That is not how it works here. Every request the app makes to the server carries who is asking. The server, not the screen, decides what comes back. A route built for a kid only ever answers with that kid’s own data, no matter what the request asks for. A route meant for a grown-up refuses a kid outright, before it looks at anything else about the request. The app on a kid’s phone has nothing extra to hide, because the server never sent it anything extra in the first place.

Small choices that follow from it

A few smaller design choices follow directly from taking that wall seriously.

The family code, the one a grown-up shares so a kid can sign in on their own device, is built from an alphabet that leaves out the digits 0 and 1 and the letters O and I, so it still reads correctly off a card taped to the fridge.

A wrong family code, a wrong username, and a wrong PIN all produce the exact same message. The app does not say which part was wrong, so there is nothing for a stranger to learn by guessing, except that a locked account answers with the lockout message during its 15-minute pause.

Five wrong PIN attempts pause sign-in for that kid and email every grown-up in the family, so a locked-out kid is never a surprise to the household. A grown-up can set a new PIN from the family screen, which clears the pause and signs the kid out everywhere, but only a grown-up account can do it. A kid has no self-service way around a lockout, on purpose.

What you can check yourself

None of this asks for trust you cannot verify on your own. Sign in as your own kid, on your own phone, using their username and PIN, and look around. Whatever you find there is the entire kid experience. There is nothing else running behind it, and nothing more for that account to reach.

That is the whole point of building the wall on the server instead of in the screens a kid happens to see. There is no separate “kid mode” toggle to trust, and no extra hidden view to worry about someone finding a way around. The account itself simply cannot ask for anything beyond what a kid is allowed to have.