Questions for the product owner
All 20 questions are decided. Each shows the choice and how the app carries it out.
- Q1Domain
Which domain is the primary one for the website and e-mail addresses?
decidedincico.euThe website, the account page's CORS and the e-mail templates use incico.eu (A1).
- Q2Supabase
Create a new Supabase project "Incico" in the existing Sefaja organisation (region eu-west-1, same as Saymail)?
decidedYes, create a new projectincico-staging (eu-west-1) since 2026-09-12; the production project is created in phase 7.
- Q3Authentication
Which sign-in methods at launch?
decidedE-mail (magic link + password) plus Google and AppleE-mail with a six-digit code or a password, and Google. Google appears once its client is configured; Apple is for iOS when it resumes, Android does not offer it (A3, A43).
- Q4Monetisation
Ads and monetisation at launch?
decidedNo ads, free; optional supporter purchase laterNo ads SDK and no purchase in the app; the entitlements hook is reserved (A4).
- Q5Contact services
Which external contact services in the first release?
decidedDevice contacts (iOS/Android) plus Google ContactsPhone contacts and Google Contacts are built. Microsoft stays behind a flag that is off (A77).
- Q6Profiles
Keep multiple profiles per account (for example managed profiles for children) in v3?
decidedYes, as in v1/v2Managed profiles and the profile switcher are built (A43).
- Q7Family relations
Family relation types and family auto-connect from v1?
decidedKeep a simple relation type (parent/child/partner) on a connection, no auto-connectA relation label on a connection, no auto-connect (A7).
- Q8Languages
App and website languages at launch?
decidedEnglish and DutchApp, website and e-mails in English and Dutch, with key parity tested.
- Q9Application identifier
Application identifier (Android package / iOS bundle id)?
decidednl.sefaja.incicoNew store records; v1 installs do not update in place.
- Q10Phone verification
Verify phone numbers by SMS?
decidedNot at launch: phone numbers unverified, e-mails verified via Supabase AuthPhone numbers are unverified; e-mail is verified by Supabase Auth (A43).
- Q11Web app
Web version of the app?
decidedNo web app; only a web page for account deletion and data exportThe website has only the account page: sign in with a code, export, delete (A11, A91).
- Q12Analytics
Product analytics and crash reporting?
decidedPostHog EU with typed events only, opt-in at onboarding, like SaymailPostHog EU with typed events and the app's own crash handler, consent asked at onboarding, default No (A89).
- Q13Tablets
Tablet layouts?
decidedTwo-pane list/detail on tablets, as in the Saymail tablet specRail plus list and detail on tablets, rebuilt in the circle-first redesign (app/18).
- Q14Repository layout
Repository layout?
decidedMonorepo C:\Source\IncicoV3 with web/, supabase/, mobile/android, mobile/ios, mobile/design, docs/
- Q15Branching
Branching strategy?
decidedmain + develop + feature/fix/chore/hotfix, as in Saymail
- Q16Mac mini
Mac mini access for iOS builds: what are the SSH host and user, and does it already have Xcode 16+ and an App Store Connect API key? Which Apple team should v3 use: U96BHA22RF (Incico v1/v2) or 47HUKYRBQZ (Saymail)?
decided47HUKYRBQZReachable over key-based SSH, Saymail team 47HUKYRBQZ.
- Q17Minimum OS versions
Minimum OS versions?
decidedAndroid 8.1 (API 27) and iOS 17minSdk 27 on Android, deployment target 17.0 on iOS.
- Q18Retention
Data retention after account deletion?
decidedImmediate deletion, backups purged within 30 daysDeletion removes live rows at once; backups age out within 30 days (platform/33).
- Q19Profile photos
Profile photos?
decidedUp to four photos per profile, in Supabase Storage with signed URLsFour photos of 1024 px, EXIF stripped, private bucket, enforced in the database (A18).
- Q20Android release builds
R8 obfuscation on Android release builds?
decidedShrink and obfuscate, with mapping uploadR8 shrinks and obfuscates release builds; the mapping travels in the bundle for Play and is uploaded to PostHog with every release build, so crash reports read with real names (A19).