iOS · Private waitlist

Anchor

Hold still. Stop scrambling.

The single private source of truth for an adult’s entire real life. Every document, account, obligation, and household fact — on-device, encrypted, retrievable by glance or voice. It speaks only when a missed action would hurt later.

Request early access See the one card

Local-first · Encrypted · One next action · No feed, no streaks

iPhone Lock Screen with a redacted Anchor widget: License, 3 weeks, start replacement.

Home

One card Never a dashboard

Locked glance

Redacted Secrets require unlock

Local Useful with no account Encrypted Employees cannot open a vault One card Badge is 0 or 1 Silent Noticed only in its absence

Who it’s for

Adults already have a life OS. It is broken.

A password manager that does not know the lease expires. A calendar that does not know the passport is in a drawer. An inbox holding the only copy of a warranty.

You

The person who “runs the household.” Illness, travel, or a DMV line should not turn that into a single point of failure.

A partner

Need-to-know, not a shared login. Utility bills without therapy notes. Grants, not a mega-vault.

A parent

View-only medical and legal without handing over email. Caregiving is v1. The personal binder still helps you now.

Future-you

Airport morning. Pharmacy parking lot. Coverage gap. The retrieval path is the product.

Permanent pillars

Six things that do not ship as vapor.

Life inventory

Typed, encrypted entities — identity, property, money, insurance, health, housing, travel, credentials. Searchable on-device.

One next action

A closed ranker. One card. One verb. A $16 bill cannot outrank an uninsured car.

Glance + voice

Unlocked retrieval under 300 ms, airplane mode included. Lock Screen is a redacted snapshot. Secrets need Face ID.

Camera first

Session 1 is a driver’s license and an insurance card. Not Gmail. Not a dashboard setup wizard.

Zero knowledge

The sync server is a ciphertext blob store. Local-only is free forever and useful without an account.

Path, labeled

Family grants, Watch, mail, and finance sit behind an explicit fence. Coming work is marked Coming.

Vault MVP

If it isn’t in the vault, life is guessing.

Every item is a typed, encrypted entity — or a document attached to one. Searchable on this device. Usable in airplane mode.

Secrets are exact-reveal only. Spotlight is not indexed. The last 90 days stay resident; older blobs evict and come back on Wi-Fi. The emergency packet never leaves the owner device.

Identity & legal: names, passport, license, will, POA, advance directive.
Property: real estate, vehicles, warranties with claim windows, titles.
Money: institution + last4. Full PAN discouraged. Bills, tax forms, receipts.
Insurance: auto, home, health, life, umbrella, pet, flood, LTC, dental.
Health: conditions, meds, pharmacy, providers, directives — consumer-held.
Housing, work, travel, family, imported logins. No in-app authenticator in MVP.

Vault tab listing identity, insurance, property, and health collections with 47 records.

On-device search for insurance card returning auto, renters, and umbrella, with SSN locked.

Capture MVP

Point the camera. Confirm. Stop.

The aha is a driver’s license and an insurance card. Under ten minutes. Then the first next-action card.

Camera, Files, and the share sheet. Default path, not a power-user trick.
Rules-only extraction in MVP. No cloud reading the vault.
EventKit is read-only. Calendar events can block an obligation.
Password import from 1Password, Apple, or CSV. Not a 1Password competitor.
Gmail and Microsoft mail sit behind CASA. Not session 1. iCloud Mail unsupported.
Illegal portal scraping is never the product path.

Capture camera framed on a sample driver’s license with yellow viewfinder corners.

Next action MVP

One card. One verb. Never a list as home.

Bills, renewals, refills, registration, passport, insurance, school forms — ranked. Only the most important completable action surfaces.

The ranker is a closed, testable function. Cost of delay is dollars, coverage gap, or legal penalty — not whoever yelled last. Loyalty points due tomorrow do not interrupt. One proactive notification per day, except critical. Badge is 0 or 1. Empty state is the product.

Complete / Snooze / Not now / Wrong. No shame list. No streak for ignoring it.
Lead time is real: a passport that takes three weeks starts hurting before expiry.
Quiet hours wrap midnight. Critical still notifies.
Works tired, stressed, or forgetful. Large type. One verb.

Home card: driver’s license expires 11 Nov 2026, replacement often takes 3 weeks, four verbs.

Empty home: Nothing needs you. Vault is current, badge is 0. — Empty is the product

Driver’s license record with expiry, location, lead time, and Face ID to reveal the number. — The record

Recovery kit of 24 words with a warning that smash without them means the vault is gone. — Recovery kit

Consequence path

Password managers sit on login. Calendars sit on time. Anchor sits on what hurts.

Expiry. Coverage. Proof. Incapacity. After the third time it shows an insurance card in a pharmacy parking lot, Photos and email feel insane as a filing system.

Glance MVP Watch later

It lives on surfaces you already look at.

Lock Screen widget. Siri. Share sheet. Camera. Action Button. You should not have to open an app for stimulation.

While locked, the widget reads a redacted snapshot — no SSN, no vault key. After reboot, the widget is empty until unlock. Secrets require Face ID. Spotlight is declined on purpose; it would leak the inventory.

Unlocked retrieval under 300 ms, including airplane mode.
Locked glance under 50 ms. Redacted. No vault key on the Lock Screen.
Siri / App Intents. Person parameter for dependents.
Watch, Live Activities, Dynamic Island: v1, same snapshot rules.

Lock Screen at 9:41 with a redacted Anchor widget: License, 3 weeks, no secrets while locked.

Session 1

Under ten minutes. Then stop.

Promise, then vault

What it is and is not. No feed. No cloud reading the vault. Biometrics. Keys in the Secure Enclave.

Write the 24 words

Recovery kit, print QR, challenge three words. Smash without them = gone, said out loud. Sync cannot turn on until this is done.

Scan license + insurance

Camera-first. One next-action card appears: “License expires 11 Nov 2026. Replacement often takes 3 weeks.”

Pin the widget. Try Siri.

Glance on the Lock Screen. Ask for the expiry. Then stop. No family, no Plaid, no mail in session 1.

Ownership

Employees cannot open a vault. That is a design constraint.

Not a slogan. The local vault is free forever and useful without an account. Sync is ciphertext.

Local-first

Airplane mode

Inventory, search, and the ranker run on-device. The vault is excluded from backup. Restore is proximity or the recovery key.

Enclave

Keys stay keys

24-word BIP-39 recovery key wraps a vault key in the Secure Enclave. Vault key never comes from an email password.

Zero knowledge

Ciphertext only

The sync server stores ops and padded blobs. It can see device IDs and sizes. It cannot decrypt the vault.

No training

Vault is not a corpus

Zero social, zero feeds, zero streaks, zero ads, zero training on vault contents.

Need-to-know

Grants, not sharing

One vault per adult. Collection keys wrap to a grantee. UI filters are not access control. v1, not MVP.

Packet

Named people

MVP: a sealed PDF / paper QR you can physically hand someone. Apple Medical ID remains first-responder.

Read the full privacy and ownership page →

Settings MVP

Local-only is free. Sync is the paid surface.

No ads. Charge later for sync, family, and blob quota. Single-device may defer the recovery kit with a typed risk acknowledgment — that state cannot enable sync. Support sees routing email, a device list, and a support code. Not the vault.

Settings: local-only vault, Secure Enclave, recovery kit ready, sync off, quiet hours 22:00–07:00.

What this is not

Not a social network, feed, or streak machine.
Not a to-do list, notes app, or habit tracker.
Not tax filing, medical advice, or a law practice.
Not a 1Password replacement in MVP.
Not illegal scraping of banks, insurers, or the DMV.
Not a coparenting or court product.
Not Android-first. Web designee view comes before Android.

Family v1

Need-to-know is cryptographic. Not a shared password.

One vault per adult. No household mega-vault. Aging parents grant view-only medical and legal. Kids’ SSNs never ride in grants. Fast revoke is the mitigation. Honest about that limit.

Grants

Each collection has its own key. A grant wraps that key to the other person. Therapy notes are never on the caregiver template.

Household

Utilities, rent, kids’ forms live on shared streams. Personal identity does not.

Emergency

A pre-sealed subset for named people. Dual-control recommended. No dead-man’s switch. No fake vault.

Web designee

Decrypt via WebAuthn. Pasting the 24-word key in a browser is forbidden. Ships before Android.

Roadmap Labeled

Labeled coming. Not sold as live.

MVP Personal encrypted binder, closed ranker, one-card home, Lock Screen widget, Siri, camera, pairing, E2EE sync, local sealed-PDF packet.
Stretch HealthKit meds. Gmail / Microsoft after CASA. Killable if the paperwork does not land.
v1 Capability grants, household streams, dual-control emergency packet, web designee, Watch, Live Activities, AutoFill. Maybe a finance relay.
v1.5 Insurer / pharmacy links, tax-year and travel bundles, Android after protocol freeze.
v2 Attorney-assisted incapacity, government where APIs exist, executor mode. Still no social.

Waitlist

iOS first.

Anchor is specified and in build. Request a slot. We get App name, phone OS, and your email — nothing else. Local-only will be free forever. Android is later; you can still ask to be notified.

Waitlist iOS 18+ Later Android