A VPN on a Kid's Tablet Is a Seat, Not a Nanny

Supervision is: what apps open, how long, which sites, who can call, whether YouTube is even installed. Apple ships Screen Time for that job on iPhone and iPad. Google ships Family Link for a lot of Android and Chromebook households. Schools ship MDM and filters. Those products break on purpose. A VPN is a path. It encrypts toward a server you chose. It does not read the video. It does not close the app at 21:00. It does not send you a weekly report. If that sentence disappoints you, good. Stop here and buy the OS tools. Then decide whether you still want a hop.

Farms rank best VPN for kids because parents search that string. The pages mash encryption, 'safe browsing,' and a family plan into one cape. Some consumer brands do ship a content filter as an extra. Klox does not. I will not invent a SafeKids toggle so we look complete in a comparison table. Completeness would be a lie. The lie is how chargebacks start.

You can still put Klox on a tablet a child uses. The reason is the same as an adult laptop in a cafe: you do not want that LAN to see the hop. School Wi-Fi, grandma's house, a hotel room on a family trip. The tablet is one of five seats while the session is up. The child can still open anything the OS and the school allow. A tunnel can even make some school filters angrier, because the filter wanted to see destinations and now it sees a VPN. That is a school policy problem. I am not the school. I will not tell you to evade a filter. I will tell you a consumer VPN is the wrong tool if evasion was the search.

I have watched adults install a VPN, skip Screen Time, and then write that the product failed when a cartoon autoplayed something they hated. The product did not fail. The purchase did. This article exists so the next purchase is named.

Five simultaneous connections. A kid iPad connected is one. An adult phone is one. A homework laptop is one. The TV is one if you connected an app you control. A router is one and then covers a house, which is the seating-chart article. Install is free of the counter. Connect is not. Sleep is not disconnect. Auto-connect on a tablet on the couch is how you discover the cap at a hotel desk.

Supervision does not free a seat. Screen Time can lock the iPad and the Klox session can still be up. Family Link can limit apps and the tunnel can still hold. The reverse is also true: you can disconnect Klox and the child still has YouTube if the OS allows it. Do not use 'I turned the VPN off' as a bedtime. Bedtime is Screen Time. Off is a hop you stopped paying for.

Shared households fight about the fifth seat. I would rather you write names on paper than invent a kids plan we do not sell. Two adults who commute plus one homework laptop plus one kid tablet is four if all four hold a session. Fine. Add a travel stick and a home router and you are over. Disconnect furniture. The child is not the villain in that math. The forgotten tablet is.

Smart Connect, if the row exists, will treat cafe Wi-Fi as untrusted and connect. On a kid tablet that is either what you wanted or a seat you did not mean to spend every time they join the library SSID. If the row is missing, the child has to press Connect, which means the child can also not press Connect. That is not a parental control. That is a button. Plan for the button.

A lot of households still share one Apple ID between a parent and a kid iPad. Purchases are easy. Everything else is ugly. iCloud, Find My, app settings, and sometimes a VPN login cached in a password manager all collapse into one identity. If the child can open the App Store as you, they can also install and uninstall. If they can see your Keychain, they can see more than a tunnel password.

I am not going to write a full Apple-ID architecture. Apple wants a child account under Family Sharing for a reason. Use that if you can. A shared ID plus a consumer VPN is not a family plan. It is one login on two pieces of glass. When you rotate the Klox password because a device was lost, you rotate it for everyone on that ID. When the child signs out of iCloud to 'fix YouTube,' they may sign your mail out too. That is not a Klox defect.

Do not type the Klox password into a school form or a tablet 'parent gate' that is not our app. Do not store it on a sticky note on the kid case. The portal email is the recovery path. Protect that mailbox. Two-factor on the mailbox is a different article and still true here. A tunnel does not lock the inbox that can reset the tunnel.

If the kid iPad uses a managed Apple ID from a school, you may not be allowed to install Klox at all. That is the school image. I will not tell you to sideload around it. Home tablet versus school tablet is the next section. Shared ID is the home mess. Fix the ID before you add a fifth seat you will resent.

A school tablet is often locked. MDM. A filter. A profile that blocks unknown VPNs. If Klox will not install, that is the profile. If it installs and will not handshake, that may be the filter or a UDP allergy. OpenVPN on TCP is the spare tire on rude networks. It is not a hall pass. If the school forbids personal VPNs, that is their network. I am not your lawyer. I am not the district. I will not invent a policy that says you must tunnel at school. I will not invent a policy that says you must not. Read their acceptable-use page.

A home tablet is yours. Home Wi-Fi may not need a tunnel every hour. The home-Wi-Fi essay is the yes-or-no. A child on home Wi-Fi still has YouTube if you left YouTube installed. Connecting Klox at the kitchen table does not change the cartoon. It changes whether your ISP sees the name of the cartoon's CDN as clearly. Some parents want that. Some do not. Neither choice is a bedtime.

Travel tablets are the honest Klox case. Hotel room number, then tunnel. Cafe splash, then tunnel. Same habit as the adult laptop. The child does not need a different protocol. WireGuard first. OpenVPN when the hotel hates UDP. Pause the kill switch through the portal. The tablet is still one seat. The school tablet in the backpack, if it is holding a session from home, is still a seat. Turn it off or disconnect before you spend the fifth on a lobby laptop.

Do not put Klox on a school device to 'protect them at school' if the school already filters and forbids extra tunnels. You will get a detention conversation and a ticket we cannot resolve. Protect the hop on the device you own, on networks you chose to join.

YouTube. TikTok if it is installed. A browser. A game chat. An ad in a free app. HTTPS pages the child is allowed to open. A VPN does not stop those. RFC 8446 still encrypts the site. The child still sees the site. The cafe sees less of the map if the tunnel is up. You, the parent, see nothing new in a Klox dashboard, because there is no Klox dashboard of their taps.

Malware still installs if they sideload and the OS allows it. Phishing still works if they type a password into a fake page. A tunnel does not scan the attachment. I said this in the cafe piece and it is still true on a kid tablet. Encryption is not authentication of the cartoon site. It is not a virus product. It is not a teacher.

A kill switch on the tablet fail-closes that tablet if the tunnel dies. That can look like 'the internet is broken' to a child, which is a support night for you. It is not a content block. When the tunnel is down and the switch is off, the tablet is on the LAN in the clear, still able to open whatever the OS allows. Fail-closed is a leak tool. Do not sell it to yourself as a bedtime.

Smart Connect, if present, will connect on untrusted Wi-Fi. It will not refuse a site. It will not phone you. If you need a phone call when they open an app, that is Family Link or Screen Time notifications, or a human in the room. I will not invent a push alert for 'child watched a video.' We do not have that event.

The sixth connect fails. Someone is kicked. The homework laptop cannot join because the iPad on the couch is still peered. This is the seating-chart fight with a smaller cast. Disconnect the tablet. Or disconnect a ghost phone. Or take the tablet off auto-connect so home Wi-Fi does not keep a session. Do not buy a second Klox account 'for the kids.' We did not design a kids line. Two accounts is two bills and a mess when someone shares a password anyway.

A child who learns they can hold a seat has learned a lever. That is not malice. That is a button that says Connected. If you need the laptop more than the tablet, you have to be the person who disconnects the tablet. There is no parent override screen in our app. There is the portal device list and the app on the glass. Use them. Remove retired iPads when you hand the old one down. Hand-me-downs that still hold a session are how families invent a curse.

I would rather you keep the kid tablet off the VPN at home if home Wi-Fi is a skip you already chose, and connect it on trips. That saves a seat for the adults who leave the house every day. It is also honest: you did not need a hop on the kitchen SSID. You needed a hop at the hotel. The daily-use essay is the adult version of that judgment. Apply it to the tablet without dressing it up as safety theater.

If five is too small because every human has two gadgets and you refuse a router, you are over the product. Unlimited-device brands exist with other tradeoffs. Read those homepages. Do not ask us to pretend five is unlimited for a child. Five is five.

Buy Apple Screen Time if the glass is Apple. Downtime, app limits, communication limits, content restrictions. That is Apple's list. I will not paste their help article into ours. Open Settings. Buy Google Family Link if the glass is Android and you want a parent app. Location, app approvals, bedtime. That is Google's list. Buy a dedicated filter or nanny app if you still want category blocks after the OS tools. Qustodio, Net Nanny, and the rest are other companies. I am not ranking them. I am naming the aisle.

Buy a school-issued workflow if the tablet is the school's. Their filter, their MDM, their ticket. Do not mix a consumer VPN into that aisle unless the school said you may.

Buy Klox if you also want a hop on devices you own, on networks you do not run, and you can live with five seats and no supervision UI. WireGuard first. OpenVPN when the network is rude. Yearly from $2.83 a month. That is the product. It sits next to Screen Time. It does not replace it. A household can own both. A household that owns only the tunnel and expects bedtime will be angry. I would like you not to be angry at a Connect button for a job we never shipped.

White-label operators sometimes want a 'family plan' sentence in their store. That is the positioning essay. You are not that operator. You are a parent with a cart. Do not copy their SKU names onto our pricing page. Our pricing page is five devices. See it. If the number is wrong for your house, leave.

If you read this far and you still want a tunnel on a kid tablet for hotels and cafes, see pricing. Five devices. Yearly from $2.83 a month. 7-day money-back on first purchase. Download the apps. Install on the tablet you own. Count the seat. Set Screen Time or Family Link in the other Settings app. Do not wait for us to merge those screens.

If you read this far and you wanted a nanny, do not buy Klox for that job. Use the OS. Use a filter vendor. If you already bought under the farm story, the consumer window is seven days on first purchase. Live page: /refund. Renewals are not that window. Processing is typically several business days to the original method. Store purchases follow the store. Use the window. Do not chargeback a Connect button for missing bedtime. Chargebacks are a different mess.

I would rather you keep the year if adults in the house will use cafes and hotels anyway. The kid tablet is then an optional extra seat, not the reason you paid. If the kid tablet was the whole reason and you now know it was the wrong noun, refund. That is the adult move. Resentment is how people leave a subscription running and then lie to the next farm quiz.

No city count. No SOC 2 story for a tablet. No dedicated-IP consumer SKU. No kids SKU. Cookies for this site: /cookie. WireGuard, OpenVPN, OpenConnect, and Shadowsocks. Five seats. A hop. Not a nanny.