Privacy as an architecture, not a promise
Confirmation numbers, notes, photos and people's names never leave the device. Only non-personal lookup keys — a city, a date, a public title — go out, and only for enrichment like weather. This is enforced structurally: every outbound lookup passes through a single choke point, so a private detail cannot leak by accident. Four independent security reviews were run against that boundary.
Confirm-first intake
The app reads your calendar to find things worth anticipating, but it never auto-adds. Detection proposes; you dispose. What counts as worth looking forward to is not a judgement the app is entitled to make for you.
Colour means one thing per surface
An early version used colour to encode two different things across two tabs — a subtle inconsistency that made the whole system unlearnable. The fix was a deliberate split: on the Timeline colour means time; on the Calendar it means category. One rule per surface, applied without exception.
Restraint over features
The hardest calls were the ones not to build: no in-app booking, no becoming a full trip planner, no modules cluttering a clean surface. A half-working destination-soundtrack feature was cut after three honest attempts rather than shipped mediocre. A premium feel comes from what you leave out.
A matte finish that kept its depth
The most recent design pass added flat fills, a single soft shadow, hairline separation and a faint paper grain — achieved by softening finish while holding colour lightness byte-for-byte identical, so the surface changed without flattening the gradient underneath it.