Sign-in and onboarding

1. Sign in

The first screen shows the app icon, the word Incico, the tagline Never ask “new number?” again. and the sign-in options as full-width buttons at the bottom: Continue with Google (secondary, when configured) and Continue with e-mail (primary), with “No account yet? An unknown e-mail creates one.” and a Privacy policy link under them (mock: mobile/design/redesign/redesign-round-5.html). There is no separate “register” screen: entering an unknown e-mail creates the account.

Option	Flow
Continue with Google	Native Google sign-in (Credential Manager / Google Sign-In SDK) → ID token → signInWithIdToken.
Continue with Apple	ASAuthorizationController (iOS) or Apple’s web JS flow inside ASWebAuthenticationSession equivalent on Android → signInWithIdToken. Apple’s “hide my e-mail” relay addresses are accepted.
Continue with e-mail	Enter e-mail → choose “Send me a code” (magic link / 6-digit OTP) or “Use a password”.
(Microsoft)	Present but hidden behind a build flag until decided.

The Google and Apple buttons render only for the providers named in the build’s provider list; both stay hidden until Google and Apple sign-in are configured on the Supabase project, so a build with none configured shows only the e-mail option.

E-mail with code: the app sends an OTP; the screen shows six auto-advancing digit boxes (v2’s verification input), a countdown before “Resend code” (60 s), and accepts the link from the e-mail as an alternative (universal link opens the app and completes sign-in). New accounts land in onboarding; existing ones in the dashboard.

E-mail with password: password field with show/hide. Because Supabase never reveals whether an e-mail already has an account, the app always tries to sign in first; an invalid_credentials response is read as “wrong password or new e-mail” and the screen offers “New to Incico? Create an account with this e-mail” — confirming the password, creating the account, then verifying the same six-digit code as the “send me a code” flow before the account can continue. “Forgot password?” sends a reset link that opens the app’s reset screen; once the new password is set, the app shows a “Password changed” confirmation before returning to sign-in.

Errors are inline, specific and non-technical (“That code isn’t right. Check the e-mail or request a new one.”). After five failed OTP attempts the code is invalidated. An address at a disposable e-mail domain is refused by the sign-up hook (before_user_created_hook) on both the code and the password path, and the screen says so rather than showing the generic error: “Disposable e-mail addresses are not accepted. Use an address you keep.” (Dutch: “Wegwerp-e-mailadressen worden niet geaccepteerd. Gebruik een adres dat je houdt.”). The hook gives the refusal no code of its own, so the app recognises it by its message.

Sign-in never asks for a name; names come from onboarding. If Google or Apple supplied a display name it is offered as the pre-filled default name in the Names sheet of Build your card.

2. Onboarding

v2’s 13-step flow, compressed. Since 2026-10-29 (A104) the six detail steps of v2 and of the first v3 design (2.2.1 About your details to 2.2.7 Your photos, “Step 3 of 9”) are one hub, Build your card, with every category optional (v2 required at least one item per category, which blocks people who do not want to enter, for example, an address yet). Back always works. The flow can be left with “Finish later” from the hub onward; the dashboard then shows a banner “Your profile is incomplete” until the user completes or dismisses it. Resuming opens the first step not yet passed; accounts.onboarding_completed flips at step 2.5.

2.1 Welcome

The mark, the heading “Your details, in one place, always current”, and three promises, each with an icon in a tint tile and one example line: You keep your details in one place (Names, numbers, addresses, birthdays.) / You choose which circle sees what (Family gets your home address, Work does not.) / Everyone stays up to date (Change your number once; it reaches their phones.). Button Get started.

2.2 Build your card

One screen, the title “Build your card” and the line “Add what you like, skip the rest. Below is what Friends will see so far.”

• Live preview: a card with the avatar, the default name and a one-line summary of what the chosen circle sees (“+31 6 2345 6789 · Amsterdam”), and filter chips Family / Friends / Work under it to switch the circle being previewed. The preview is computed on the device from the details entered so far and the circles chosen on them; it is a guide, not preview_circle (the server preview stays on Circle details and Profile).
• Checklist: one row per category (Names, Phone numbers, E-mail addresses, Addresses, Special dates, Photos), each with a check (filled primary once the category has at least one item, a dashed ring otherwise), the category icon, its name and a second line: what is there (“1 number”, “marieke@gmail.com (sign-in)”) or Add in primaryText. Names and E-mail addresses arrive filled (the provider’s name, the sign-in address).
• Tapping a row opens that category’s detail sheet (the same sheet as on the Profile tab, Profile §3.4.1), which saves on its own; adding a second item reopens the sheet empty.
• Footer: “3 of 6 · you can add more later” and Continue, always enabled.

The rules each sheet enforces per category are below; they are the same in onboarding and on Profile.

Names

• Pre-filled with one name (from the identity provider if available).
• Each name row: text field (max 100 characters; letters, spaces, hyphens, apostrophes, periods; Unicode letters allowed), Default radio (exactly one), Searchable switch, type picker (Personal / Work / custom), and the circle selector (multi-select chips; v2 made names exclusive to one circle, v3 allows several because a name is harmless to share and v2’s own data model already used sharedCircles: string[]).
• Add another name (the sheet again). Delete is disabled on the last remaining name and on the default name until another is made default.
• Validation on Save: no empty names, no duplicates, one default. The default name is always visible to every connection regardless of circles; its sheet says “Always visible to your contacts” in place of Who sees it.

Phone numbers

• Row: type picker (Mobile / Home / Work / custom), country picker (defaults to device region), number field with live E.164 formatting via libphonenumber, Searchable switch, circle selector.
• Validation: must parse as a possible number for the chosen country. Duplicates rejected.
• No verification at launch; a small “Unverified” label explains that verification will come later. (v2 planned SMS codes; see questions page.)

E-mail addresses

• The sign-in e-mail is pre-filled, verified, searchable, and cannot be removed here (it can be changed in Settings). It arrives with Searchable on so that the address a person signs in with is the one address their friends can find them by; the switch stays theirs to turn off (ruling A70).
• Additional rows: address field (RFC-style check, lower-cased on save), type picker, Verify button which sends a 6-digit code (edge function verify-email-detail) and shows the six-box input; once verified the address becomes read-only with a check badge. Only verified e-mails can be Searchable (v2 rule kept).
• Circle selector per row. Duplicates rejected.

Addresses

• Row: type picker (Home / Work / custom), country picker (search list), then country-specific fields in the country’s order: Netherlands: postal code, house number (+ addition), street, city; United States: line 1, line 2, city, state, ZIP; Germany, Belgium, UK: their conventional order; default: line 1, line 2, postal code, city, region. Changing country clears fields with a short cross-fade (v2 behaviour).
• Netherlands: entering postal code and house number offers a street/city lookup; the result is a suggestion the user accepts, never a silent overwrite (v1 overwrote silently).
• Sharing mode segmented control: Whole address (one circle selector) or Per field (a circle selector under each field with an “Apply to all fields” link). Per-field mode is how someone shares only city and country with Friends.
• Skippable.

Special dates

• Row: type picker (Birthday / Anniversary / custom), date wheel with day, month and an optional year column (“Year” can be left blank), then two circle selectors: Day and month and Year. A privacy tip explains sharing the day widely and the year narrowly. Year circles are constrained to a subset of day-month circles (a circle that cannot see the day cannot see the year); the UI disables the others.
• Skippable.

Photos

• Up to four tiles (v2 limit). Tap a tile: Camera or Library (each preceded by an explanation before the OS permission dialog). Square crop, 1024 px, EXIF removed on device, uploaded on Save with a progress ring.
• Each photo: type (Personal / Work / custom) and circle selector. The first photo is the avatar shown to every connection that can see at least one photo; connections that can see none get initials.
• Skippable.

2.3.1 About connected services

Active. Explains that Incico can fill the phone’s address book (and Google Contacts) with the cards of chosen circles and can find who is already on Incico. Buttons Connect a service / Not now.

2.3.2 Connect a service

Active. The add-service sheet (see Connected services); after connecting, the flow returns here with the service listed and the option to add another.

2.3.3 Invite people you know

Active. Runs the cross-reference for the connected service(s) and lists matches with “Invite” buttons and a circle picker per match; “Invite all in Friends” style bulk action; Continue at any time. Skipped automatically when no service was connected.

2.4 Notifications and privacy

Two cards: Notifications (explains what you will be told about, then requests the OS permission on tap of “Allow notifications”; “Not now” keeps in-app notifications only) and Help improve Incico (telemetry consent, default off).

2.5 All set

Summary counts (names, phones, e-mails, addresses, dates, photos, services, invitations sent), Go to my contacts. The profile is marked onboarding_completed.

Adding a managed profile

“Add profile” — offered both in the profile switcher and, once the account has more than one profile, in the Profile tab’s Profiles card — asks for the relationship (Child / Parent / Partner / Other) and then opens the Build your card hub with the new profile as target and the same circle names seeded. Managed profiles skip 2.3.x and 2.4.

A managed profile has no sign-in address: the account’s belongs to its main profile. The e-mail sheet in a managed run therefore marks no row as the sign-in address, keeps every row editable, and lets every row be deleted (2026-09-13).

Persistence during onboarding

Every detail sheet saves to the server on its own Save (details are inserted with circle_ids), so a crash or a phone switch loses at most the sheet that was open, and the hub shows what is already there. v2 stored steps in AsyncStorage; v3 stores nothing sensitive locally before it is on the server, except the in-progress form of the open sheet.