Privacy fixes, the UX review and the design round

The owner found that the app's components look good but its features are hard to find. A review of the whole app followed, along with research into the Tesla, BMW and Mercedes apps. The new screens went to the design canvas first: the rule since today is that nothing is built before its screens are approved there. Two privacy gaps found by the review were fixed straight away, because they are fixes, not new features.

Shipped

• Showcases and passports publish only plate-blurred pictures (#87, merged at f004fb8).
  • A showcase (/g/) and a passport's Photos section copy only Studio pictures, whose plates the server blurs. A plain gallery photo stays private, and a car without a Studio picture shows its silhouette.
  • The cron tick deletes the copies of original photos from older showcases and passports, 10 links per tick, until none is left.
  • The Photos switches say that only blurred Studio pictures are shared.
  • Details: showcase, passport.
  • Not deployed yet: the live web still serves the old copies until the Worker is redeployed.

In progress

• The Studio redacts plates on the phone (#88).
  • A new native module (Apple Vision on iOS, ML Kit on Android) blurs plates and VINs before a photo leaves for the AI provider.
  • If redaction fails or the module is missing, the Studio sends nothing.
  • The server accepts only a redacted JPEG of up to 1 MB.
  • Device QA on the simulator and the Android compile run before the merge.
  • It needs a new store build; an update over the air cannot carry a native module.
• Loading, flicker and action feedback.
  • An audit of every screen covers empty flashes on start, late confirmation toasts and missing pending states.
  • The proposed patterns: a cache kept on the phone, skeletons shaped like the screen, optimistic updates through the offline queue, and an instant "Salvo" with undo.
  • The screens come to the canvas for approval.
• Timeline v2.
  • Three directions that still read well with 12 cars over 25 years: one spine with chapters, an ownership strip with a list, and a free direction.
  • The owner found the first timeline neither elegant nor scalable.

Waiting for the owner

The design canvas has a Status page that lists every open decision with a recommendation, page by page:

The owner also has to authorize three things:

• redeploying the web for #87;
• an over-the-air update, which waits for the new build because of #88;
• a new TestFlight build for #88.

To build after approval

Each page's report already holds the tickets (.scratch/ux-review/A–E). They become GitHub issues once the page is approved:

• Navigation: the car as the hub, one Share entry point, a Garage highlights strip, Profile with only account and settings, Finances and Service tinted by the chosen car, the assistant without a dead end, and translated error toasts.
• Smart add: a photo first, then make → model → year, "É o seu carro atual?" and approximate periods ("2022 – meados de 2025").
• Share, gallery and showcase:
  • public photos chosen by the owner, with the plate blurred on the phone (C7);
  • rich link previews for /g/ and /p/;
  • the /g/ page redesign;
  • the Car colour following the open car on every screen.
• Garage: the Híbrida layout (recommended), with the timeline as a second view.
• Tesla-style car screen, "Precisa de atenção", the workshop brief, fuel by period and the widget. The car-maker connection is later (v1.1+).
• Loading and feedback, once its screens are approved.

The research behind this round is in .scratch/research/oem-apps.md (Tesla, My BMW, Mercedes) and .scratch/ux-review/ (one report per area).