Local before cloud
Data you create belongs on the device you created it on. Syncing is a feature some people need, not a precondition for opening an app. Nothing we ship requires a server to function, which means nothing we ship can go down, get breached, or quietly change its terms.
Small surface, deep floor
We would rather build six features that work completely than twenty that work partly. Every setting we add is a decision we have handed to the user, and most users did not ask for the decision.
Permissions are a cost
Every permission an app requests is something the user has to trust us with. We treat the manifest as a bill we have to justify, not a shopping list. If a feature needs access we cannot defend in one sentence, the feature does not ship.
No engagement theatre
No streak guilt, no artificial scarcity, no notifications engineered to pull you back. If our app is open, it should be because you have something to do in it. Time spent in the app is not a metric we optimise.