An editorial take on the neighborhood-safety app — warm paper tones, confident navy, a living serif for the words that matter. Fewer icons, more craft. Parents first.
Six semantic tokens, two modes. Light is paper & navy; dark is a warm charcoal-on-cream inversion — intentionally not stark black/white. Sage and clay shift slightly brighter in dark mode for legibility without losing their identity.
Fraunces carries the emotional weight at large sizes (optical size 72–144, soft axis 70–80); Instrument Sans handles UI without drawing attention to itself. Italic Instrument Serif shows up in small moments — an arrow, a caption, a felt accent.
Three touch points: the first impression, the everyday home, and the detail view you open when your kid is somewhere else.
Home is who's watching.
a neighborhood kid-tracker for your trusted circle — nothing public, nothing sold.
by continuing you agree to the terms & privacy policy
The current screen stacks six equally-weighted cards in an iOS Settings-app cadence, with five different tinted icon circles (blue, green, orange, orange, purple). Rebuilt: editorial group headers, unified icon treatment, a segmented toggle that inherits the app's own "lamplight" vocabulary, and a sign-out that stops shouting.
the knobs & the dials.
One unified icon treatment. Today: five different tinted circles. Proposed: a single cream-on-paper circle with a 1.8-stroke line icon, ink-soft in both modes. The eye stops hunting for the "colorful one" and just reads the labels.
Editorial group labels. Six cards in a flat stack becomes four groups — your home · your circle · you · the app — set in italic Fraunces at caption size. Same scanning pattern as a magazine table of contents.
"Add a Trusted Household" moves off the top. The current bright blue CTA above the list is a launcher for a connection action that already lives one tap deeper. It's removed here; the "+" affordance belongs inside the Trusted Households flow.
Pending invites become a quiet pill. The orange "1 pending invite" banner is loud for something that's usually zero. Now it's a small clay-colored counter on the Trusted Households row — visible, not shouting.
Appearance: renamed and recolored. Light / Dark / System → Daylight / Lamplight / Auto, matching the header toggle's vocabulary. Selection is ink-on-cream, not system-blue-on-gray.
Sign out is whispered. Today: bold red text. Proposed: small italic link in muted grey. Red gets reserved for genuinely destructive actions (deleting a child profile, removing a household). This is just a door out — it shouldn't feel like a tripwire.
Subtitles get italic serif treatment. The current secondary-gray metadata ("1559 Carrington Pl, Perrysburg") switches to italic Fraunces at 11px — reads more like a descriptor than a field value, which is what it is.
Trusted-household tagging is the product's center of gravity. Here's the twenty-second moment it happens, told from both sides of the street — from Priya's phone (the host) through to Maeve's (the parent).
tap to select · just pulled up is marked.
Asa and Theo pull up together. Priya selects both, confirms once. Default mode is multi-select — no "edit mode" toggle — so a single-kid tag-in still works without a mental shift.
tap to select · tap again to deselect.
tagging in two at once
No separate "select mode" toggle — every row tap is a selection. The single-kid case still works: tap one, bar reads "1 kid selected," confirm, done. That's +1 tap vs today, but the confirm screen is a required stop anyway.
Rolling up to "2 of these kids have allergies" saves pixels but raises skim-risk. Per-kid rows keep the allergy attached to the face — you can't skim past Asa's peanut allergy without also seeing Asa's face. The cost is vertical space; worth it.
Service layer writes N TagEvent docs sequentially, returning per-event success/failure. Partial success is recoverable: failed kids stay in a retry pill on the host's dashboard. Firestore batch writes would be atomic but too strict — one bad network hiccup shouldn't un-tag the others.
Apple & Google take the primary slot on the welcome screen; phone auth becomes a fallback. The upside is real money — OTP SMS runs $0.01–0.06 per verification, free for SSO — so every user who picks Apple/Google is pure margin. Phone number still gets captured (for invites) but verification can be lazy: only OTP if and when they receive their first invite. Full happy-path flow below; fallback shown separately.
Home is who's watching.
a neighborhood kid-tracker for your trusted circle — nothing public, nothing sold.
by continuing you agree to the terms & privacy policy
we filled in what Apple gave us — tidy up if needed.
how invites find you — we won't text unless one arrives.
create your own home, or accept someone's invite.
we'll pin it on the neighborhood map.
derived from your last name · tap to rename
one at a time — you can add more later.
your home is on the map — encrypted and private. invite a neighbor next; you'll need one trust connection to start tagging kids in.
Two extra screens — phone entry + OTP — before step 2. Same downstream flow. This path costs a few cents in SMS per user; only users who decline SSO hit it.
Alternative cost optimization: keep this path free of OTP by treating phone as claimed, not verified at onboarding, and only send an OTP the first time an invite arrives for that number. Deferred SMS = deferred cost, and most users never trigger it.
we'll text you a code.
we texted it to +1 555 · 0100
Firebase phone auth bills per-OTP (roughly $0.01–0.06 per verification). Apple & Google are free. If 80% of users pick SSO, your onboarding SMS spend drops ~80% against a phone-first baseline. Phone number still gets captured for the invite system — we just don't verify it eagerly.
Apple returns firstName, lastName, and email (first-time sign-in only). Google returns all three plus a profile photo URL. Phone is the one field SSO cannot give — users still type it. We mark pre-filled fields with a quiet "Apple" or "Google" badge so it's clear what came from where, and every field stays editable.
Instead of OTP on every signup, phone is marked claimed. The first time an invite arrives for that number, we send an OTP then. Most users never receive an unsolicited invite, so most accounts never trigger a paid SMS. Requires a small addition: users/{'{'}uid{'}'}.phoneVerifiedAt: Timestamp | null.
Once they're signed in at §07, they stay signed in. Face ID is a local app lock — default on, togglable in Settings — not a Firebase re-auth. The user doesn't see Apple or Google again unless they explicitly sign out, switch devices, or the session token expires (~60 days). The 99% case is: open app → Face ID → dashboard.
welcome back,
Face ID to open
still signed in · locked since 8:12 am
The Firebase session stays valid for weeks. Face ID just gates the app's UI — same pattern as banking apps. No token refresh, no Apple/Google prompt, no OTP round-trip. If biometrics fail, the device passcode acts as the local fallback (handled by the OS, not a phone-number code).
Not every user wants the friction — shared family iPads, kid-friendly profiles, users who keep their phone in a case with a face-read shadow. Settings → the app → Require Face ID to open flips it off; when off, launching the app drops straight to the dashboard with no gate. State lives in a single users/{'{'}uid{'}'}.appLockEnabled: boolean, default true.
Only three moments Apple/Google (or phone OTP) come back: (a) user explicitly signs out from Settings, (b) Firebase ID token expires (~60 days of inactivity), (c) they install on a new device from backup. Everything else is Face ID → dashboard, or — if the lock's disabled — dashboard directly.
The product is called KidTag, so the mark is literally a tag — with a notched corner, a punch hole, and a single italic Fraunces "k" where the name would go. It reads as tactile and human, not as a tech icon.