Design principles

The person owns the detail; the circle decides who sees it. Every screen that shows a detail also shows, right next to it, which circles can see it, by name and in the circle’s colour. Changing that is one tap, never buried in settings.

Default to sharing less. New details are shared with no circle until the user chooses. New connections go into the circle the user picks at invitation time; there is no automatic “Friends” default. Names are the exception: the default name is always shared once connected, otherwise a contact card would be empty.

Nothing about you is public. There is no profile page a stranger can browse. Search works only with an exact e-mail address or phone number the person made searchable, or whole words of a searchable name.

Twin apps, one behaviour. A feature behaves the same on both platforms with the same wording. Platform differences are limited to gestures, navigation mechanics, secure storage and push transport (Saymail’s rule). Since 2026-09-18 the platforms no longer have to ship together: Android is finished first and iOS, paused after phase 4, catches up to the same behaviour when it resumes (see Questions and answers, “Platform order”).

Server rules, not client rules. If a rule protects someone’s data it lives in Postgres and has a test. The client may mirror it for a better error message, never replace it.

Fast and readable offline. Contact cards load from the local cache in under 100 ms and work in flight mode. Editing needs a connection and says so.

Tablets are not big phones. Above 600 dp the list and the detail sit side by side; nothing is hidden behind a push that a wider screen can show at once. Below 600 dp the phone layout is used unchanged, including on an iPad in Split View.

Boring technology, exact copies of what works. Supabase for the backend, Saymail’s project structure, build scripts and coding rules for the apps, Astro for the website. Novelty only where Incico’s problem is new (snapshots, hashed search, on-device sync).

Explain, then ask. Every permission dialog (contacts, notifications, camera, photos) is preceded by a screen in the app saying what will happen and why, and can be declined without losing the rest of the app.

Delete means delete. Account deletion is in the app, on the website, immediate for live data, and finite for backups. Export exists so deletion is never a hostage.

Say it in words; stay quiet about others. A control carries its verb beside its icon, an action that cannot run now stays visible with its reason, and every card’s second line says its state (the Saybook rules, Visual design). What happens between two people is not announced to anyone else’s disadvantage: ending a connection sends no notification (A102), and ignoring a request tells the sender nothing (A103).