Status: locked P0 build plan; first local iOS slice is implemented
and tested.
Product Center
StringStep is a visible safety Step that automatically becomes a
private, searchable, beautiful timeline:
map;
movement;
audio;
transcript;
check-ins;
sharing events;
delete receipt.
The loop is:
Start -> Record -> Retrace
Everything that does not make that loop feel magical waits.
P0 Promise
P0 is an iPhone-first product:
Tap Start and the active UI appears in under 300 ms.
The phone records audio and location visibly.
Route, audio, and transcript state are captured local-first.
Live location can be shared with one trusted viewer through a
link.
A stopped Step opens a snappy review shell in under 500 ms.
The Step becomes a beautiful replay: map, movement, audio,
transcript, check-ins, sharing events, and delete receipt.
Private storage is encrypted; cloud transcription is optional and
auditable.
Product Quality Bar
StringStep is only a good product if the basic loop feels obvious,
fast, and trustworthy on an ordinary iPhone.
P0 must satisfy four quality bars:
Instant confidence. Tapping Start must visibly
change the app before any network work. The user should immediately see
what is recording, who can see location, whether audio is private,
whether transcription is enabled, and how deletion works.
Beautiful retrace. The Step archive must feel like
the product, not an admin log. Route replay, timeline scrub, transcript
segments, recordings, check-ins, sharing events, and deletion state
should read as one coherent story.
Privacy honesty. The app must never blur the
distinction between encrypted private storage and cloud transcription.
If audio leaves the device for transcription, the user explicitly opted
in and the UI says what happened.
Failure grace. Airplane mode, screen lock, poor
GPS, failed upload, low battery, expired entitlement, transcription
failure, and delete retry should all produce understandable local state
instead of broken screens.
The P0 product is not complete when the API accepts requests. It is
complete when one person can use a real iPhone for a 20-minute
locked-screen Step, lose network, stop, retrace locally, upload
encrypted data later, share live location during the Step, and delete
the Step with a receipt.
Current Build State
Implemented in the repo:
SwiftUI app shell with Start, Steps, and Account tabs.
Local Step model for route points, recordings, transcript segments,
events, live link state, and deletion receipts.
Local Start -> Record -> Retrace behavior in
StringStepHomeModel.
Active Step controls for start, stop, check-in, live link, and Ask
for help / urgent marker.
Step detail surface with route replay, timeline strip, recordings,
transcript segments, event log, live link summary, and delete
action.
API shell for users, devices, sessions, stop, urgent, check-in,
upload URL, chunk commit, grants, transcript queueing, and delete.
Protocol, policy, and crypto-core package tests.
Validation as of 2026-05-16:
swift test in apps/ios: 7 tests
passing.
pnpm test in repo root: passing.
pnpm build in repo root: passing.
The important next jump is from simulated local Step state to real
capture services: CoreLocation, AVFoundation,
encrypted local queue, chunk manifests, and upload reconciliation.
Non-Goals For P0
Cut hard:
web owner dashboard;
trusted contact accounts;
People tab;
live audio streaming;
emergency release rules;
public trails;
social features;
Apple Watch;
Android;
family/child mode;
direct emergency dispatch;
hidden or remote microphone activation;
AI summaries or memory features;
broad export unless needed for review/legal trust.
Product Screens
The iPhone app has three tabs:
Start
Steps
Account
Start
One primary button:
Start Step
Requirements:
active state under 300 ms;
stop always visible;
check-in marker under 150 ms local;
Ask for help / Mark urgent, not Panic;
status chips for Audio, Location, Upload, Access, Transcription,
Delete.
Steps
The archive is the product, not a storage drawer.
Step detail must include:
beautiful route replay;
timeline scrubber;
audio rows aligned to the same timeline;
transcript segments aligned to the same timeline;
check-ins and urgent markers;
sharing events;
retention state;
delete receipt.
Account
Account owns:
trial/subscription state;
transcript preference;
retention preference;
support;
privacy policy/terms;
restore purchases.
Transcription Modes
Auto transcription is core. The simplification is not removing
transcription; it is making transcription honest and
privacy-enabled.
1. Private Auto Transcript
Long-term default.
The iPhone transcribes after the Step ends using on-device
recognition when available. Transcript segments are encrypted locally
and uploaded only as ciphertext.
Copy:
StringStep can automatically transcribe your Steps without sending
audio to StringStep servers or a third-party transcription provider,
when your device supports private transcription.
2. Cloud Enhanced Auto
Transcript
Practical MVP/beta path.
The user explicitly enables:
Automatically transcribe new Steps with cloud transcription.
Copy:
To create transcripts, your audio is temporarily decrypted and sent
to our transcription provider. StringStep does not store plaintext audio
or plaintext transcripts. Transcript results are encrypted before
storage.
Do not say nobody ever sees plaintext when cloud transcription is
enabled. Say:
Private storage is encrypted. Cloud transcription is optional and
auditable.
3. Manual Transcript
Fallback for:
ask-each-time users;
expired subscriptions;
low battery;
bad network;
unsupported language;
selected audio windows.
Transcript Preference
Choices
Show during onboarding and in Account:
Private on-device when available.
Cloud enhanced after each Step.
Ask me each time.
Off.
Transcript Badges
Every Step detail screen should show one of:
Transcript ready.
Transcribing on device.
Waiting for Wi-Fi.
Cloud transcription enabled.
Transcript encrypted.
Transcript deleted.
Transcription Architecture
Build transcription as a first-class pipeline, not a bolt-on job.
TranscriptionOrchestrator
Runs after Stop:
Check account-level transcript setting.
Check per-Step transcript override.
Check battery, network, and Wi-Fi constraints.
Prefer on-device transcription if available.
Otherwise, if cloud enhanced transcription is enabled, enqueue cloud
transcription.
Emit transcript segments as start_ms, end_ms, text, source,
revision.
Encrypt transcript segment objects before durable storage.
Align segments to the same timeline as map/audio.
Add audit events for requested, segment stored, completed, failed,
and deleted states without logging transcript text.
OpenAI Path
Use OpenAI transcription only after explicit cloud opt-in.
Implementation notes:
Use realtime transcription when transcript deltas materially improve
the review experience.
Use batch speech-to-text for offline/file workflows where streaming
is not needed.
Long Steps need chunking because file transcription has upload
limits.
Keep plaintext transcript text out of logs, analytics, support
events, and audit event bodies.
Encrypt transcript output before persistence.
Delete queued and completed transcript artifacts when the Step is
deleted.
Maps
Beautiful map replay is core.
P0 map requirements:
native MapKit on iPhone;
lightweight web map for live links;
clear current-position state;
start/end markers;
route line with calm premium styling;
timeline-linked movement;
readable street/area context;
route playback independent of network after local metadata
exists.
graceful degraded state when the base map is unavailable;
route smoothing that does not invent false movement;
visible GPS confidence when accuracy is poor.
MapReplayEngine owns:
normalized route geometry;
sampled replay frames;
timeline sync;
start/end/current markers;
live viewer frame handling.
Map quality gate:
the active map must never look blank after the first route
point;
current-position state must be visually distinct from the replay
head;
route line and transcript/audio timeline must agree on time;
map scrubbing should remain local and smooth after Step stop;
live-link map should prioritize clarity and load speed over
dashboard-style controls.
Latency Targets
Action
Target
Tap Start -> active UI
under 300 ms
First route point visible
under 1 sec
Check-in marker appears
under 150 ms local
Stop -> review shell opens
under 500 ms
First transcript segment after stop
5-15 sec for short Step on good
network
Live viewer location refresh
1-3 sec while active
Scrub timeline/map/audio
60 fps feel; no network dependency
Local state wins first. Network reconciliation comes second.
Data Model
Minimal P0 tables:
users;
devices;
sessions;
sensor_chunks;
live_frames;
share_links;
transcript_jobs;
transcript_segments;
deletion_jobs;
audit_events;
billing_entitlements.
Defer:
trusted_contacts;
recipient_grants beyond simple link scope;
recovery/escrow;
owner web dashboard key state;
social/public stream tables.
Protocol
Private storage path:
Capture route/audio locally.
Write encrypted chunks locally.
Upload ciphertext chunks.
Commit chunk manifests.
Store metadata and audit events.
Never require server-side plaintext for private
route/audio/transcript storage.
Transcript path:
Consent decision.
On-device transcription when available.
Cloud fallback only after explicit opt-in.
Segment output.
Encrypt segment objects.
Store encrypted transcript artifacts and segment metadata.
Delete transcript artifacts with the Step.
Local Capture And Queue
The iPhone owns the truth of an active Step. The server is a sync
target, not the thing that makes recording feel real.
Capture Services
StepCaptureCoordinator should orchestrate:
permission preflight for microphone and location;
instant active UI state;
AVAudioEngine or AVAudioRecorder chunk
capture;
CLLocationManager foreground and background route
capture;
check-in and urgent markers;
live-link frame emission when enabled;
stop-to-review transition.
Capture services should expose small event streams rather than large
controller objects:
audioChunkReady;
routePointReady;
uploadStateChanged;
permissionStateChanged;
captureFailure.
Encrypted Local Queue
The local queue must survive:
airplane mode;
app restart;
app backgrounding;
temporary upload failures;
low battery mode;
short server outages.
Queue records should include:
Step id;
sensor type;
sequence number;
local file URL or encrypted payload pointer;
ciphertext hash;
previous ciphertext hash when available;
capture timestamps;
upload attempts;
deletion tombstone state.
No raw private audio, exact route batch, or transcript text should be
written to app logs. Debug builds may expose local diagnostics, but not
plaintext user content.
API Surface
P0 routes:
GET /health
GET /v1/me
POST /v1/devices/register
POST /v1/sessions
GET /v1/sessions
GET /v1/sessions/:id
POST /v1/sessions/:id/stop
POST /v1/sessions/:id/check-in
POST /v1/sessions/:id/urgent
POST /v1/sessions/:id/upload-url
POST /v1/sessions/:id/chunks/commit
POST /v1/sessions/:id/transcripts
DELETE /v1/sessions/:id
GET /live/:token
Use session internally if helpful, but user-facing copy says
Step.
Failure Modes
These are product requirements, not edge cases.
Failure
Required behavior
Microphone denied
Start screen explains audio is unavailable and allows location-only
Step only if policy permits.
Location denied
Start screen explains route/live sharing is unavailable and blocks
P0 Step unless location is enabled.
GPS accuracy poor
Active UI shows low-confidence location and keeps trying; replay
marks low-confidence segments.
Network offline
Step continues locally; upload chip says queued/offline; live link
chip says unavailable or stale.
App backgrounded or phone locked
Audio/location continue under declared background modes while active
Step remains visible through iOS indicators/notification where
allowed.
Upload fails
Queue retries with backoff; review remains local; user can still
delete.
Transcription fails
Step remains usable; transcript badge shows failed/retryable without
losing audio or route.
Delete partially fails
Local delete receipt shows pending server/object cleanup until
confirmed.
Entitlement expired
Existing Steps remain reviewable/deletable; new Step, live link, and
new transcription jobs are blocked.
Security And Privacy Gates
Every implementation slice should answer these before merge:
What plaintext exists, where, and for how long?
Which logs, analytics events, crash reports, audit events, and
support payloads could accidentally include user content?
Can deletion remove or tombstone every local and remote
artifact?
Does the server need plaintext to complete the feature? If yes,
why?
Does the UI disclose the privacy behavior in plain language?
Cloud transcription has an extra gate:
explicit account opt-in;
per-Step override;
consent version stored with the job;
no plaintext transcript text in server logs or audit event
bodies;
encrypted transcript artifact before durable storage;
deletion of queued, processing, completed, and failed transcript
artifacts.
Billing
Keep the accepted pricing:
90 days free;
no credit card required;
then $10/month or $90/year.
Use RevenueCat for iOS launch unless there is a strong reason not
to.
The 90-day no-card trial is a server entitlement, not an App Store
intro trial.
Expired users cannot:
start new Steps;
live share;
create new transcription jobs.
Expired users must still be able to:
review existing Steps;
play existing audio;
view existing transcripts;
delete;
export if export exists;
manage subscription;
restore purchases;
contact support.
First Implementation Slices
Slice 1:
Local Step Reality - Implemented Skeleton
Exit criteria:
local active state appears before network work;
route/check-in/live-link/urgent events exist in the Step
timeline;
Stop creates a reviewable Step shell;
transcript status can be queued from preference;
delete creates a visible receipt;
Swift tests cover start/stop, live share, check-in, transcript
queueing, and deletion receipt.
Current status:
implemented with simulated route/audio state;
tested with swift test;
not yet real device capture.
Slice 2: Real iPhone Capture
Exit criteria:
microphone permission and location permission flows are in
context;
no audio or location capture before Start;
no capture after Stop;
locked-screen 20-minute Step succeeds on a real iPhone;
first local route point appears under 1 second when GPS is
available;
check-in marker appears under 150 ms local;
audio chunks are written locally;
route points are persisted locally;
active UI shows capture failures plainly.
Slice 3: Encrypted Queue And
Upload
Exit criteria:
encrypted audio chunks;
encrypted route chunks;
chunk manifests;
upload URL;
batch commit;
offline retry;
no plaintext audio/route/transcript in logs.
Implementation details:
use separate keys or key scopes for audio, exact route, live frames,
and transcript artifacts;
include sequence numbers and previous ciphertext hashes in
manifests;
commit metadata only after ciphertext upload succeeds;
preserve local replay even when upload is still pending.
Slice 4: Retrace Experience
Exit criteria:
Steps archive;
beautiful map replay;
synchronized timeline;
audio rows;
real local audio playback;
transcript badges;
sharing events;
delete receipt;
60 fps feel while scrubbing local data.
Product gate:
a normal Step should be useful even without emergency features;
search/replay should make the Step feel worth keeping until
auto-delete;
route/audio/transcript/check-ins must align to the same
timeline.
Slice 5: Transcription
Exit criteria:
transcript preference onboarding;
TranscriptionOrchestrator;
on-device preferred path;
cloud enhanced opt-in path;
segment schema;
encrypted transcript artifact storage;
transcript deletion;
audit events without text.
Implementation details:
on-device recognition is preferred when available and
practical;
cloud fallback requires opt-in and consent version;
transcript segments use start_ms, end_ms, text, source, revision
before encryption;
Step detail renders transcript status even when no transcript
exists.
Slice 6: Live Link
Exit criteria:
one-time live location link;
1-3 second refresh while active;
current position/status;
check-in/urgent markers;
expiration/revoked state;
no live audio.
Implementation details:
P0 link can be token-scoped rather than account-scoped;
recipient sees current location/status only;
owner sees whether link is active, expired, or revoked;
stale live frames must be visually obvious.
Slice 7: Deletion End-To-End
Exit criteria:
local cache removed or cryptographically erased;
upload queue tombstones deleted Step artifacts;
server metadata marks delete requested/deleted;
object deletion is queued and confirmed where possible;
transcript jobs/artifacts are deleted;
live link is revoked;
user sees a deletion receipt.
Slice 8: TestFlight Readiness
Exit criteria:
real iPhone capture passes 20-minute locked-screen test;