Decision: biometric lock default scope #10

New issue

Closed

opened 2026-07-23 14:46:25 +02:00 by cloudbot · 1 comment

cloudbot commented

2026-07-23 14:46:25 +02:00

Collaborator

Decision — what is the default biometric-lock scope out of the box?

Biometric lock is user-configurable (§10). Each family member supplies their own Outline API key stored in Android Keystore; the lock gates access on top of that. The scope options are settled — the open question is only the default before the user changes anything.

Configurable scopes (§10)

Whole app — biometric prompt on every launch, gating everything.
Stream tab only — the read feed (which surfaces everyone's entries) is locked, but Home/Log and template creation stay open.

Candidate defaults

Off by default — no biometric prompt until the user opts in. Lowest friction; relies on the device lock screen for at-rest protection.
Whole-app by default — most protective, most friction on every open.
Stream-only by default — protects the aggregated read view (the most sensitive surface) while keeping quick logging frictionless.

What to decide

Which of the three is the shipped default.

Blocks: the biometric-lock implementation and the first-run/settings UX.

Recommendation: Stream-only by default. The Stream aggregates everyone's entries and is the surface most worth protecting from a casual glance, while leaving Log/template entry unlocked keeps the app's core "low-friction capture" promise intact. Users who want more can switch to whole-app; users who want less can turn it off.

Source: Solution Design — Family App v1 §10 (doc vpBNbG4TsV).

**Decision — what is the *default* biometric-lock scope out of the box?** Biometric lock is user-configurable (§10). Each family member supplies their own Outline API key stored in Android Keystore; the lock gates access on top of that. The scope options are settled — the open question is only the **default** before the user changes anything. ### Configurable scopes (§10) - **Whole app** — biometric prompt on every launch, gating everything. - **Stream tab only** — the read feed (which surfaces everyone's entries) is locked, but Home/Log and template creation stay open. ### Candidate defaults 1. **Off by default** — no biometric prompt until the user opts in. Lowest friction; relies on the device lock screen for at-rest protection. 2. **Whole-app by default** — most protective, most friction on every open. 3. **Stream-only by default** — protects the aggregated read view (the most sensitive surface) while keeping quick logging frictionless. ### What to decide Which of the three is the shipped default. **Blocks:** the biometric-lock implementation and the first-run/settings UX. **Recommendation:** **Stream-only by default.** The Stream aggregates everyone's entries and is the surface most worth protecting from a casual glance, while leaving Log/template entry unlocked keeps the app's core "low-friction capture" promise intact. Users who want more can switch to whole-app; users who want less can turn it off. **Source:** Solution Design — Family App v1 §10 ([doc vpBNbG4TsV](https://outline.marquezkeenan.family/doc/solution-design-family-app-v1-vpBNbG4TsV)).

cloudbot added this to the M0 · Open Questions & Decisions milestone

2026-07-23 14:46:25 +02:00

cloudbot added the

spike

label

2026-07-23 14:46:25 +02:00

cloudbot added a new dependency

2026-07-23 14:46:41 +02:00

#21 Biometric lock (configurable scope)