Structure That Strengthens Superheroes

01, Executive Summary

Families everywhere face a daily paradox: their kids are brilliant, creative, and full of energy, but the structures designed to support them, chore charts, timers, restriction apps, either overwhelm them or treat them like problems to be managed. The result? Parents become enforcers instead of allies, and children lose trust in the people they need most.

Organicely changes this dynamic. It is a platform that gives every child the clear, predictable structure they need to thrive, and it is especially helpful for kids who find routines hard. It is all wrapped in a superhero metaphor that makes daily routines feel like missions, not chores.

02, The Problem

The Daily Chaos

Every morning in millions of households follows the same script: a parent stands in a doorway, repeating instructions they have already given three times. Brush your teeth. Get dressed. Where is your backpack? The child is not being defiant, they are overwhelmed. For many children, sequencing, time awareness, and getting started on a task are genuinely difficult. The instructions are not the problem. The delivery method is.

By afternoon, the pattern repeats with homework. By evening, it escalates into the screen time battle. "You can play after you finish your reading." But "after" is an abstract concept for a child who lives in the moment. The computer is right there. The game is loading. The reading can wait. And now the parent is the villain again.

Traditional Tools Fail Children

Existing solutions fall into predictable traps:

• Chore charts and to-do apps present a wall of tasks. For many children, seeing twelve things at once triggers avoidance, not motivation. The list itself becomes a source of anxiety.
• Parental control software focuses on restriction, not motivation. It blocks and limits, creating an adversarial dynamic. The child learns to resent the tool, and by extension, the parent who installed it.
• Reward sticker charts work for a week, then lose novelty. They require constant parental involvement to track, verify, and distribute rewards. The parent becomes the system, and the system breaks down when the parent is tired.
• Timer apps treat symptoms instead of causes. Setting a 30-minute screen time limit does not teach a child to manage their own behavior. It just delays the meltdown by 30 minutes.

The Relationship Cost

The deepest damage is not the missed homework or the late mornings. It is what happens to the relationship between parent and child. When every interaction becomes a negotiation or a correction, the child internalizes a narrative: "I always get in trouble. I can never do anything right." The parent internalizes their own: "I am always nagging. I have become the bad guy."

What families need is not another app that adds pressure. They need a system that removes the parent from the role of enforcer and replaces conflict with structure, structure that works the way children actually work.

03, Our Solution

Philosophy: Positive Reinforcement, Not Punishment

Organicely is built on a single principle: children respond to earning things, not having things taken away. Instead of "you lose screen time if you don't do your tasks," Organicely says "you earn screen time by completing your missions." The difference sounds subtle. In practice, it transforms the entire emotional dynamic of daily routines.

The child is not being punished. They are being empowered. Every completed step is a small victory, acknowledged with points and visual progress. The computer does not lock because the parent decided to punish, it stays locked until the missions are done, the same way a car does not start until you put in the key. It is a system, not a sentence.

The Core Loop

Why It Works for Children

• One step at a time. The child only sees the current task, not the entire list. This prevents overwhelm and lets the child focus fully on a single objective.
• Visual progress. A progress bar fills as tasks are completed. Seeing tangible advancement is motivating, the same thing that makes video games compelling.
• Predictable structure. The same routine runs every day at the same time. Predictability reduces anxiety and builds automaticity over weeks.
• Immediate feedback. Points appear instantly. Approval notifications arrive in real time. The gap between action and reward is minimized, which matters most for children who struggle to wait for a reward.
• Autonomy within structure. The child controls when they start and how quickly they move through tasks. They are not being directed, they are navigating their own mission.

The Superhero Metaphor

Every child in Organicely is a hero. Their daily routines are missions. The points they earn are powers. This is not a gimmick, it is a deliberate reframing. Children who struggle with routines are often defined by what they find hard. Organicely flips that narrative. Every child has superpowers, extraordinary energy, deep creativity, relentless curiosity, the ability to hyperfocus for hours. They just need the right structure to channel those powers. Organicely provides the structure. The child provides the superpowers.

04, Product Overview

Organicely is a multi-platform system. Each component serves a specific role, and they work together through real-time synchronization.

Device Pairing

Connecting a child's computer to the family account is designed to be fun. When the desktop agent starts for the first time, it generates a silly pairing phrase, something like "SneezyWaffleOnARollercoaster" or "CosmicPenguinInPajamas". The parent types this phrase into the web app, and the device is paired. No IP addresses, no QR codes, no configuration files. Just a phrase that makes the whole family laugh.

05, Key Features

06, For Parents

A Typical Morning with Organicely

What Changes

The most common feedback from parents using Organicely is not about the features. It is about the absence of conflict. When the system handles enforcement, parents get to be parents again. They can praise instead of correct. They can encourage instead of threaten. The daily power struggle simply disappears, replaced by a structure the child understands and accepts because it is consistent, fair, and rewarding.

07, For Schools & Professionals

Supporting Individualized Plans

Many children have individualized education plans (IEPs), 504 plans, or equivalent support structures. A recurring challenge with these plans is consistency: what works at school needs to continue at home, and vice versa. Organicely provides a shared structure that bridges both environments.

• Routine data for professionals. Therapists, psychologists, and school counselors can review routine completion rates, mood patterns, and behavioral trends with parental consent. This data replaces subjective reports with measurable progress.
• Consistent structure across environments. A child using Organicely at home develops habits that transfer to school. The one-task-at-a-time approach, the visual progress tracking, and the reward-based motivation all align with evidence-based behavioral strategies.
• Mood tracking for clinical insight. The mood tracking feature (1–5 scale, daily entries, optional notes) provides longitudinal data that therapists can use to identify triggers, measure the impact of interventions, and adjust treatment plans.
• Screen time data for balanced assessments. When screen time is a concern, Organicely provides objective data: how much time, on which applications, at what times. This replaces "I think he plays too much" with actual usage reports.

Privacy-First Design

Organicely never shares data with schools, therapists, or any third party without explicit parental consent. There is no "school portal" that automatically receives reports. Parents control what is shared, with whom, and when. If a therapist wants to see mood data, the parent exports it and shares it directly. This is a deliberate design choice: the family owns their data.

08, Technical Architecture

Organicely is built for reliability, security, and real-time responsiveness. The architecture is straightforward by design, no unnecessary complexity, no microservice sprawl. Every component has a clear job.

  CLIENTS                       SERVER                    DATA

  +----------------+
  | Web App        |           +----------------+      +--------------+
  | React 19       |----+      | Nginx          |      | PostgreSQL   |
  | Vite + Zustand |    |      | Reverse proxy  |      | 24 tables    |
  +----------------+    |      | TLS termination|      | Drizzle ORM  |
                        +----->| Rate limiting  |----->+--------------+
  +----------------+    |      +-------+--------+
  | Android App    |    |              |              +--------------+
  | React Native   |----+              |              | Redis 7      |
  | Expo           |    |      +-------v--------+     | Sessions     |
  +----------------+    +----->| Fastify API    |---->| Rate limits  |
                        |      | TypeScript     |     | Pub/Sub      |
  +----------------+    |      | WebSocket /ws  |     +--------------+
  | Desktop Agent  |----+      | Background     |
  | C# .NET 8      |           | workers        |      +--------------+
  | Windows Service|           +----------------+      | File Storage |
  +----------------+                                   | Encrypted    |
                                                       +--------------+

Key Technical Decisions

Passwordless Authentication (WebAuthn / Passkeys)

There are no passwords in Organicely. Users authenticate with passkeys, fingerprint, Face ID, or hardware security keys. This eliminates the most common attack vector in consumer applications: stolen, weak, or reused passwords. The WebAuthn standard is supported by all major browsers and operating systems. For accounts on a new device or after a passkey is lost, a one-time email code provides a secure recovery path without ever introducing a long-lived password.

Sliding and Absolute Sessions

Browser sessions use a short-lived access token with a sliding inactivity timeout and a hard absolute lifetime. Refresh tokens rotate on every use, and reuse of a previously rotated token immediately revokes the entire session family, a stolen token only buys an attacker a single request before the legitimate user's next call locks them out. Desktop agents use a separate, longer-lived rotating refresh token tied to the device's hardware-bound machine ID.

End-to-End Encryption of PII

Sensitive personal information (dates of birth, etc.) is encrypted at the application layer using AES-256-GCM before it reaches the database. Even if the database were compromised, encrypted fields would be unreadable without the application's encryption key, which is stored separately.

Real-Time Communication

The WebSocket connection at /ws provides bidirectional real-time communication. When a child completes a task, the parent's dashboard updates instantly. When a parent approves a task, the desktop agent unlocks within seconds. The heartbeat mechanism ensures device status is always current, with a policy version check every 60 seconds for rapid configuration propagation.

Verified Agent Auto-Update

The desktop agent checks /agent/version for the current installer manifest. Each release is registered with a SHA-256 hash of the installer bytes; the agent refuses to run an update whose bytes don't match. This prevents a compromised mirror or man-in-the-middle from substituting a malicious installer, even if it could otherwise reach the download URL. New releases roll out without any user action.

Device Security Telemetry

The agent reports security-relevant events, failed integrity checks, unexpected restarts, tamper attempts, to a dedicated endpoint. Parents see a "device needs attention" indicator in the dashboard before issues escalate, and operators can correlate events across the fleet during an incident.

Device Pairing

The silly phrase pairing system uses a three-word combination (adjective + noun + place) drawn from curated word lists. The combinatorial space is in the millions, and phrases expire after ten minutes. Matching is case-insensitive and whitespace-tolerant. Once paired, the device is authenticated via a machine ID tied to the hardware.

Background Workers

Routine scheduling, task expiration, notification delivery, and weekly report generation all run as background workers within the Fastify process. These workers ensure that routines appear on schedule, expired tasks are marked appropriately, and parents receive timely updates without manual intervention.

Infrastructure

• Production server: Ubuntu 24.04 LTS, managed with systemd
• Database: PostgreSQL 16 and Redis 7, running in Docker Compose
• Reverse proxy: Nginx with TLS termination, rate limiting, and security headers
• Deployment: Compiled TypeScript, production builds, automated restart on failure
• Backups: Automated daily PostgreSQL backups with off-site replication
• Monitoring: Structured logging, health checks, and uptime monitoring

09, Security & Privacy

Authentication

Organicely uses WebAuthn passkeys as its primary authentication method. There are no long-lived passwords anywhere in the system. Users register and authenticate using biometric credentials (fingerprint, facial recognition) or hardware security keys. This approach eliminates password-related attacks entirely: no credential stuffing, no reused-password breaches, no password database to leak. A one-time email code is available as a fallback for recovery and first sign-in on a new device, and is single-use and short-lived by design.

Sessions use cryptographically signed access tokens with a short sliding inactivity timeout and a hard absolute lifetime. Refresh tokens are stored as HTTP-only secure cookies, rotate on every use, and are bound to a session family, reuse of a rotated token immediately revokes the entire family, so a stolen token cannot outlive the legitimate user's next request. Desktop agents use a separate rotating refresh token tied to a hardware-bound machine ID.

Encryption

• In transit: All connections use TLS 1.3. HSTS headers ensure browsers never downgrade to HTTP.
• At rest: Sensitive personal data is encrypted with AES-256-GCM at the application layer, with a 12-byte random IV and authenticated encryption tag per record.
• Key management: Encryption keys are environment variables, never stored in code or version control. Key rotation procedures are documented and tested.

GDPR Compliance

Organicely is built by a Swedish company, hosted on EU servers, and fully compliant with the General Data Protection Regulation:

• Right to access: Users can export all their data at any time through the settings panel.
• Right to deletion: Users can delete their account and all associated data. Deletion is irreversible and includes all children, routines, completions, and device records.
• Data minimization: We collect only what is necessary to provide the service. No tracking pixels, no third-party analytics, no ad networks.
• Data portability: Exported data is provided in standard formats that can be imported into other systems.
• Retention policy: After subscription cancellation, data is retained for 30 days to allow reactivation, then permanently deleted.

Security Audits

Organicely has completed a comprehensive three-phase security audit covering:

1. Phase 1: Authentication and session management, WebAuthn implementation, token lifecycle, CSRF protection
2. Phase 2: API security, input validation, authorization boundaries, rate limiting, injection prevention
3. Phase 3: WebSocket security, connection authentication, message validation, broadcast isolation, reconnection handling

Additional Security Measures

• Rate limiting on all API endpoints and authentication attempts
• Input validation with strict schemas on every request
• SQL injection prevention through parameterized queries (Drizzle ORM)
• XSS protection via Content Security Policy headers and output encoding
• CORS policy restricting API access to authorized origins only
• Household isolation ensuring users can only access their own family's data
• No third-party data sharing, no analytics SDKs, no advertising networks, no data brokers

SOC Considerations

As Organicely scales toward enterprise and institutional customers, we are evaluating SOC 2 Type II certification. Our existing security practices, access controls, encryption, audit logging, incident response procedures, already align with SOC 2 trust service criteria. Formal certification is on our roadmap for 2027.

Data Residency

All Organicely infrastructure is hosted within the European Union. Data never leaves EU borders. This is not a configuration option, it is an architectural decision. For families subject to GDPR and other EU data protection regulations, this provides certainty that their data is protected by the strongest privacy framework in the world.

10, Subscription Tiers

Organicely uses a simple, transparent pricing model. One subscription covers the entire household, no per-child or per-device fees. Every family starts with a free 14-day trial.

11, Roadmap

12, About Unbreached AB

Organicely is a product of Unbreached AB, a Swedish company founded by David Jacoby.

David has 35 years of experience in cybersecurity as an entrepreneur, inventor, researcher, author, and advisor. He has worked with enterprises, government agencies, and critical infrastructure providers across Europe. He is also a father of two children.

Organicely started as a kitchen-table hack. David was tired of being the parent who always nags. He built a simple system to lock his son's computer until the morning tasks were done. It worked. His son stopped fighting the process and started following it. The yelling stopped. The mornings got calmer. David realized other families needed the same thing.

The company is based in Sweden, and the Organicely trademark is owned by Unbreached AB. The team includes David as founder and his brother Simon as technical lead, combining cybersecurity expertise with deep engineering experience.

13, Contact & Getting Started