Privacy-Period-Tracker/docs/design/BRAND_GUIDE.md

800 lines
16 KiB
Markdown
Raw Normal View History

chore: rename the project to Privacy: Period Tracker "Period" was always a working name — PRODUCT_PLAN.md §55 said so. The real identity arrived with the brand guide and artwork, and this makes the project call itself by it. The repository is renamed in place on Forgejo (null/Period -> null/Privacy-Period-Tracker), which keeps all 30 commits, all 27 issues, all 8 milestones and the four severity labels — verified by counting them on both sides rather than assuming a rename is lossless. The git remote follows in the same breath, so this commit's automatic push is what proves the new URL works. WHAT DELIBERATELY DID NOT MOVE "Period" is the product name AND the central domain word, and a mass rename would have turned the data model into nonsense. PeriodRecord, PeriodWriteResult, confirmPeriodStart, the period_records table and the button that says "Started period" all describe a menstrual period rather than a product, and all 239 references to them are untouched. So are the Kotlin package and applicationId. dev.privacyllc.period already reads correctly under the new name — privacyllc is the company, period is the app — and changing it would rewrite 68 files, rename the Room schema directory and break the hardcoded path in schema-guard.sh for no gain. period.db stays for a sharper reason: renaming a database file orphans the data on every device that already has it. Sixteen files changed, and the diff is small on purpose. THE NAME HAS A SPACE AND THE ARTWORK DOES NOT Canonical is "Privacy: Period Tracker". The supplied wordmark sets it without one, so logo.webp and banner.webp now disagree with every document and with the app itself. BRAND_GUIDE.md §10 is updated to the space form and says plainly that the drawn mark has not caught up. Filed separately rather than papered over, because closing that gap needs an artist and not a rename.
2026-08-18 15:54:34 -05:00
# Privacy: Period Tracker — Visual Brand Guide
feat: the real brand — Privacy:Period Tracker The project owner supplied artwork and a full visual brand guide mid-session, which answers #8: the three marks an agent must not fake now exist because a person made them. docs/data/img now holds icon.webp (512x512, 11 KB), logo.webp (1024 long edge, 28 KB) and banner.webp (2176x725, 20 KB) — all webp by magic bytes, all far under the 512 KB ceiling. Produced from the supplied art rather than invented. Two things had to be handled rather than converted blindly. The sources render their rounded corners against black, so a naive crop carried black wedges into the banner; the corners are flood-filled to the artwork's own ground first. And the lockup is square, so a 3:1 crop would have cut the wordmark in half — the banner is the whole lockup on a matching ground, which has no seam to see because the artwork's edges ARE that ground. The source PNGs and the guide moved to docs/design/: docs/data/img is for the three marks the Command Center renders, and its README is explicit that reference art and exported sources do not belong there. THE PALETTE, AND ONE DELIBERATE CONFLICT core/designsystem now carries the guide's colours — deep plum, rich purple, period rose, lavender mist, and an eggplant dark theme that is never flat black. §39 of the specification asks for a muted teal or sage fertile window, to hold it apart from the period colour. The guide is plum and rose throughout and gives fertility its own pink. The guide wins: it is newer, it is the owner's, and a teal accent inside this identity would look borrowed from another app. What §39 was protecting is kept by other means, and this is why the conflict is safe to resolve that way: the calendar's states differ in SHAPE. A solid disc, a dotted ring, a continuous ring and a star stay tellable apart in greyscale and to a colourblind user, which is what §43 actually requires. The departure is written down in docs/design/README.md rather than left to be discovered. The launcher icon keeps its vector for now, in brand colours. The supplied emblem has content close to its edges and an adaptive icon masks about a quarter of the canvas away, so dropping it in unmodified would crop the shield. Fitting it to the safe zone is Batch 08's final-artwork work. closes #8
2026-08-18 15:31:52 -05:00
```
Status: Current
Owner: _null
2026-08-20 02:14:08 -05:00
Last reviewed: 2026-08-20
feat: the real brand — Privacy:Period Tracker The project owner supplied artwork and a full visual brand guide mid-session, which answers #8: the three marks an agent must not fake now exist because a person made them. docs/data/img now holds icon.webp (512x512, 11 KB), logo.webp (1024 long edge, 28 KB) and banner.webp (2176x725, 20 KB) — all webp by magic bytes, all far under the 512 KB ceiling. Produced from the supplied art rather than invented. Two things had to be handled rather than converted blindly. The sources render their rounded corners against black, so a naive crop carried black wedges into the banner; the corners are flood-filled to the artwork's own ground first. And the lockup is square, so a 3:1 crop would have cut the wordmark in half — the banner is the whole lockup on a matching ground, which has no seam to see because the artwork's edges ARE that ground. The source PNGs and the guide moved to docs/design/: docs/data/img is for the three marks the Command Center renders, and its README is explicit that reference art and exported sources do not belong there. THE PALETTE, AND ONE DELIBERATE CONFLICT core/designsystem now carries the guide's colours — deep plum, rich purple, period rose, lavender mist, and an eggplant dark theme that is never flat black. §39 of the specification asks for a muted teal or sage fertile window, to hold it apart from the period colour. The guide is plum and rose throughout and gives fertility its own pink. The guide wins: it is newer, it is the owner's, and a teal accent inside this identity would look borrowed from another app. What §39 was protecting is kept by other means, and this is why the conflict is safe to resolve that way: the calendar's states differ in SHAPE. A solid disc, a dotted ring, a continuous ring and a star stay tellable apart in greyscale and to a colourblind user, which is what §43 actually requires. The departure is written down in docs/design/README.md rather than left to be discovered. The launcher icon keeps its vector for now, in brand colours. The supplied emblem has content close to its edges and an adaptive icon masks about a quarter of the canvas away, so dropping it in unmodified would crop the shield. Fitting it to the safe zone is Batch 08's final-artwork work. closes #8
2026-08-18 15:31:52 -05:00
Governs: the visual identity — palette, logo, iconography, typography, tone of artwork
Review trigger: A rebrand; any new artwork; any change to the palette or to the
logo, and in particular any change to the colours the calendar
uses for cycle states
```
> Supplied by the project owner on 2026-08-18, and it supersedes the colour
> direction in [`../planning/PRODUCT_PLAN.md` §39](../planning/PRODUCT_PLAN.md)
> where the two differ. **One difference is load-bearing and is flagged in
> [`README.md`](README.md)**: §39 asks for a muted teal or sage fertile window,
> and this guide is plum-and-rose throughout with a pink fertility colour.
chore: rename the project to Privacy: Period Tracker "Period" was always a working name — PRODUCT_PLAN.md §55 said so. The real identity arrived with the brand guide and artwork, and this makes the project call itself by it. The repository is renamed in place on Forgejo (null/Period -> null/Privacy-Period-Tracker), which keeps all 30 commits, all 27 issues, all 8 milestones and the four severity labels — verified by counting them on both sides rather than assuming a rename is lossless. The git remote follows in the same breath, so this commit's automatic push is what proves the new URL works. WHAT DELIBERATELY DID NOT MOVE "Period" is the product name AND the central domain word, and a mass rename would have turned the data model into nonsense. PeriodRecord, PeriodWriteResult, confirmPeriodStart, the period_records table and the button that says "Started period" all describe a menstrual period rather than a product, and all 239 references to them are untouched. So are the Kotlin package and applicationId. dev.privacyllc.period already reads correctly under the new name — privacyllc is the company, period is the app — and changing it would rewrite 68 files, rename the Room schema directory and break the hardcoded path in schema-guard.sh for no gain. period.db stays for a sharper reason: renaming a database file orphans the data on every device that already has it. Sixteen files changed, and the diff is small on purpose. THE NAME HAS A SPACE AND THE ARTWORK DOES NOT Canonical is "Privacy: Period Tracker". The supplied wordmark sets it without one, so logo.webp and banner.webp now disagree with every document and with the app itself. BRAND_GUIDE.md §10 is updated to the space form and says plainly that the drawn mark has not caught up. Filed separately rather than papered over, because closing that gap needs an artist and not a rename.
2026-08-18 15:54:34 -05:00
Use this guide whenever creating additional artwork, icons, onboarding illustrations, feature graphics, store assets, UI decorations, or marketing images for **Privacy: Period Tracker**.
feat: the real brand — Privacy:Period Tracker The project owner supplied artwork and a full visual brand guide mid-session, which answers #8: the three marks an agent must not fake now exist because a person made them. docs/data/img now holds icon.webp (512x512, 11 KB), logo.webp (1024 long edge, 28 KB) and banner.webp (2176x725, 20 KB) — all webp by magic bytes, all far under the 512 KB ceiling. Produced from the supplied art rather than invented. Two things had to be handled rather than converted blindly. The sources render their rounded corners against black, so a naive crop carried black wedges into the banner; the corners are flood-filled to the artwork's own ground first. And the lockup is square, so a 3:1 crop would have cut the wordmark in half — the banner is the whole lockup on a matching ground, which has no seam to see because the artwork's edges ARE that ground. The source PNGs and the guide moved to docs/design/: docs/data/img is for the three marks the Command Center renders, and its README is explicit that reference art and exported sources do not belong there. THE PALETTE, AND ONE DELIBERATE CONFLICT core/designsystem now carries the guide's colours — deep plum, rich purple, period rose, lavender mist, and an eggplant dark theme that is never flat black. §39 of the specification asks for a muted teal or sage fertile window, to hold it apart from the period colour. The guide is plum and rose throughout and gives fertility its own pink. The guide wins: it is newer, it is the owner's, and a teal accent inside this identity would look borrowed from another app. What §39 was protecting is kept by other means, and this is why the conflict is safe to resolve that way: the calendar's states differ in SHAPE. A solid disc, a dotted ring, a continuous ring and a star stay tellable apart in greyscale and to a colourblind user, which is what §43 actually requires. The departure is written down in docs/design/README.md rather than left to be discovered. The launcher icon keeps its vector for now, in brand colours. The supplied emblem has content close to its edges and an adaptive icon masks about a quarter of the canvas away, so dropping it in unmodified would crop the shield. Fitting it to the safe zone is Batch 08's final-artwork work. closes #8
2026-08-18 15:31:52 -05:00
## 1. Brand Personality
The visual identity should feel:
- Private and secure
- Feminine without feeling childish
- Calm and reassuring
- Modern health-tech
- Premium and polished
- Soft rather than clinical
- Personal and discreet
- Fertility/cycle focused without relying heavily on anatomical imagery
The overall aesthetic is **soft botanical femininity + menstrual-cycle symbolism + privacy/security**.
---
# 2. Core Brand Colors
## Primary Plum
**Deep Plum**
- Hex: `#563659`
- Use for: shields, calendar headers, dark text, outlines, stems, icon structure
**Rich Purple**
- Hex: `#704770`
- Use for: secondary icon elements, gradients, leaves, calendar structure
**Dark Mauve**
- Hex: `#815276`
- Use for: secondary typography, outlines, transitions, shadows
---
## Primary Pink
**Period Rose**
- Hex: `#E58698`
- Use for: important cycle indicators, logo accents, highlighted calendar days
**Soft Rose**
- Hex: `#E6A6B8`
- Use for: petals, secondary highlights, softer cycle indicators
**Blush Pink**
- Hex: `#F0B3C5`
- Use for: lighter petals, soft accent areas, glow effects
**Bright Fertility Pink**
- Hex: `#EA5D88`
- Use sparingly for:
- selected dates
- fertility highlights
- active states
- important accent points
---
## Lavender
**Soft Lavender**
- Hex: `#D8BED8`
- Use for: inactive calendar days, secondary elements, subtle decorations
**Light Lavender**
- Hex: `#E4D3E4`
- Use for: soft backgrounds, cards, subtle highlights
**Lavender Mist**
- Hex: `#F0E1F0`
- Use for: very light backgrounds and glow areas
---
## Light Theme Backgrounds
Primary light background:
`#F4E7F1`
Secondary:
`#F4E9E9`
Highlight:
`#F6F2F4`
The light background should usually be a very soft gradient such as:
`#F8F2F6 → #ECDDEB → #F3DFE7`
Avoid pure white whenever possible.
The background should feel like **blush-tinted ivory or lavender mist**.
---
# 3. Dark Theme Colors
The dark version should not use ordinary black.
Use very deep **eggplant/plum-black** colors.
## Main Dark Background
**Midnight Plum**
- Hex: `#100811`
**Deep Eggplant**
- Hex: `#16071D`
**Dark Violet**
- Hex: `#211124`
**Raised Surface**
- Hex: `#32153E`
Dark background gradient:
`#090611 → #150A1A → #211027`
The center can have a very subtle plum glow behind important artwork.
---
## Dark Mode Accent Colors
**Glow Pink**
- Hex: `#F3BCD8`
**Rose Neon**
- Hex: `#EC6D9A`
**Lavender Glow**
- Hex: `#D9AEDD`
**Mauve Glow**
- Hex: `#A46DA6`
**Deep Purple**
- Hex: `#4A235A`
Glow should remain soft.
Do not turn the design into cyberpunk neon.
---
# 4. Signature Logo Symbol
The main brand emblem combines several ideas.
### Circular Cycle Ring
A nearly complete circular ring surrounds the design.
It represents:
- menstrual cycles
- repeating patterns
- fertility cycles
- learning over time
- prediction
The ring transitions between:
**Pink → Rose → Mauve → Plum**
Example gradient:
`#EA7695 → #C95882 → #704770`
The ring should not look perfectly mechanical. A graceful sweeping shape is preferred.
---
## Calendar
A rounded calendar sits inside the circle.
Characteristics:
- soft rounded corners
- two large rounded binder loops at the top
- dark plum top section
- pale lavender/blush calendar body
- calendar dates represented mostly by circles rather than numbers
Example calendar header:
`#563659`
Calendar body:
`#F0DFEC`
---
# 5. Cycle Dots
Cycle days are represented using small circular dots.
Use different colors to communicate states.
### Neutral Day
`#D8B4D4`
### Period Day
`#DF5A80`
### Strong Period Day
`#A62C61`
### Fertility Day
`#E891AE`
### Predicted Day
`#CFA8D0`
Dots should remain simple, smooth, and slightly dimensional.
Avoid complicated symbols inside the calendar.
---
# 6. Privacy Shield
The shield is one of the most important parts of the brand.
It communicates the core idea behind the name **Privacy**.
The shield should:
- overlap the bottom of the calendar
- be rounded rather than aggressive
- use plum or deep purple
- have a thin pale lavender/pink edge
- contain a simple padlock
Shield gradient example:
`#704770 → #432847`
Lock:
`#F3DDEA`
The shield should feel protective rather than militaristic.
---
# 7. Padlock
Use a very simple lock.
Characteristics:
- rounded body
- rounded shackle
- small central keyhole
- no excessive details
Colors:
Light mode:
`#F5E4EE`
Dark mode:
`#F4C8DE`
The lock communicates that reproductive and menstrual information belongs to the user.
---
# 8. Crescent Moon
A small crescent moon appears near the upper-left portion of the cycle ring.
The moon represents:
- cycles
- time
- feminine rhythm
- repeating biological patterns
Color:
`#FFF0F5`
or
`#F4DDE9`
The moon should remain secondary to the calendar.
---
# 9. Botanical Element
The right side of the logo contains an elegant botanical sprig.
It should contain approximately:
- 23 pink petals
- 24 plum/lavender leaves
- thin curved stem
Example colors:
Pink petal:
`#EE8DA7`
Light petal:
`#F3ABC0`
Purple leaf:
`#704770`
Dark leaf:
`#563659`
The plant should curve naturally along the circular cycle ring.
This botanical element helps prevent the privacy/security theme from feeling overly technical.
---
# 10. Typography
The brand name is:
chore: rename the project to Privacy: Period Tracker "Period" was always a working name — PRODUCT_PLAN.md §55 said so. The real identity arrived with the brand guide and artwork, and this makes the project call itself by it. The repository is renamed in place on Forgejo (null/Period -> null/Privacy-Period-Tracker), which keeps all 30 commits, all 27 issues, all 8 milestones and the four severity labels — verified by counting them on both sides rather than assuming a rename is lossless. The git remote follows in the same breath, so this commit's automatic push is what proves the new URL works. WHAT DELIBERATELY DID NOT MOVE "Period" is the product name AND the central domain word, and a mass rename would have turned the data model into nonsense. PeriodRecord, PeriodWriteResult, confirmPeriodStart, the period_records table and the button that says "Started period" all describe a menstrual period rather than a product, and all 239 references to them are untouched. So are the Kotlin package and applicationId. dev.privacyllc.period already reads correctly under the new name — privacyllc is the company, period is the app — and changing it would rewrite 68 files, rename the Room schema directory and break the hardcoded path in schema-guard.sh for no gain. period.db stays for a sharper reason: renaming a database file orphans the data on every device that already has it. Sixteen files changed, and the diff is small on purpose. THE NAME HAS A SPACE AND THE ARTWORK DOES NOT Canonical is "Privacy: Period Tracker". The supplied wordmark sets it without one, so logo.webp and banner.webp now disagree with every document and with the app itself. BRAND_GUIDE.md §10 is updated to the space form and says plainly that the drawn mark has not caught up. Filed separately rather than papered over, because closing that gap needs an artist and not a rename.
2026-08-18 15:54:34 -05:00
**Privacy: Period Tracker**
feat: the real brand — Privacy:Period Tracker The project owner supplied artwork and a full visual brand guide mid-session, which answers #8: the three marks an agent must not fake now exist because a person made them. docs/data/img now holds icon.webp (512x512, 11 KB), logo.webp (1024 long edge, 28 KB) and banner.webp (2176x725, 20 KB) — all webp by magic bytes, all far under the 512 KB ceiling. Produced from the supplied art rather than invented. Two things had to be handled rather than converted blindly. The sources render their rounded corners against black, so a naive crop carried black wedges into the banner; the corners are flood-filled to the artwork's own ground first. And the lockup is square, so a 3:1 crop would have cut the wordmark in half — the banner is the whole lockup on a matching ground, which has no seam to see because the artwork's edges ARE that ground. The source PNGs and the guide moved to docs/design/: docs/data/img is for the three marks the Command Center renders, and its README is explicit that reference art and exported sources do not belong there. THE PALETTE, AND ONE DELIBERATE CONFLICT core/designsystem now carries the guide's colours — deep plum, rich purple, period rose, lavender mist, and an eggplant dark theme that is never flat black. §39 of the specification asks for a muted teal or sage fertile window, to hold it apart from the period colour. The guide is plum and rose throughout and gives fertility its own pink. The guide wins: it is newer, it is the owner's, and a teal accent inside this identity would look borrowed from another app. What §39 was protecting is kept by other means, and this is why the conflict is safe to resolve that way: the calendar's states differ in SHAPE. A solid disc, a dotted ring, a continuous ring and a star stay tellable apart in greyscale and to a colourblind user, which is what §43 actually requires. The departure is written down in docs/design/README.md rather than left to be discovered. The launcher icon keeps its vector for now, in brand colours. The supplied emblem has content close to its edges and an adaptive icon masks about a quarter of the canvas away, so dropping it in unmodified would crop the shield. Fitting it to the safe zone is Batch 08's final-artwork work. closes #8
2026-08-18 15:31:52 -05:00
chore: rename the project to Privacy: Period Tracker "Period" was always a working name — PRODUCT_PLAN.md §55 said so. The real identity arrived with the brand guide and artwork, and this makes the project call itself by it. The repository is renamed in place on Forgejo (null/Period -> null/Privacy-Period-Tracker), which keeps all 30 commits, all 27 issues, all 8 milestones and the four severity labels — verified by counting them on both sides rather than assuming a rename is lossless. The git remote follows in the same breath, so this commit's automatic push is what proves the new URL works. WHAT DELIBERATELY DID NOT MOVE "Period" is the product name AND the central domain word, and a mass rename would have turned the data model into nonsense. PeriodRecord, PeriodWriteResult, confirmPeriodStart, the period_records table and the button that says "Started period" all describe a menstrual period rather than a product, and all 239 references to them are untouched. So are the Kotlin package and applicationId. dev.privacyllc.period already reads correctly under the new name — privacyllc is the company, period is the app — and changing it would rewrite 68 files, rename the Room schema directory and break the hardcoded path in schema-guard.sh for no gain. period.db stays for a sharper reason: renaming a database file orphans the data on every device that already has it. Sixteen files changed, and the diff is small on purpose. THE NAME HAS A SPACE AND THE ARTWORK DOES NOT Canonical is "Privacy: Period Tracker". The supplied wordmark sets it without one, so logo.webp and banner.webp now disagree with every document and with the app itself. BRAND_GUIDE.md §10 is updated to the space form and says plainly that the drawn mark has not caught up. Filed separately rather than papered over, because closing that gap needs an artist and not a rename.
2026-08-18 15:54:34 -05:00
Keep the colon between Privacy and Period, with a single space after it.
feat: the wordmark has its space, and logo and banner say so closes #28 The owner supplied a redrawn lockup, docs/design/dist/splash.webp, which sets the name as "Privacy: Period Tracker" — with the space after the colon. NECESSARY AND NOT SUFFICIENT The tempting move was to look at the new artwork and close the issue. #28's Verify names the two DERIVED assets, not the lockup: the wordmark in docs/data/img/logo.webp and banner.webp had to match app_full_name, and both still carried the old spaceless form because they were generated from the earlier source. Regenerated from the new lockup and checked by cropping the colon out of each finished webp and reading it at 1350px wide. THE BANNER IS COMPOSED, NEVER CROPPED The lockup is square and the banner is 3:1, so a crop takes the ends off the wordmark — the trap the first pass at these assets hit. A 660px square card centred on 2176x725, matching how the existing asset did it. No flood-fill this time either: splash.webp has real transparency where the earlier sources rendered their rounded corners against black. icon.webp is deliberately untouched. It carries no wordmark, it is the same visual family, and #28 is about the name — regenerating it would be churn dressed as consistency. BRAND_GUIDE.md §10 carried a callout stating the drawn mark disagreed with the written name. That is now false, so it records what happened instead and marks lockup-light-source.png and lockup-dark-source.png as superseded rather than deleting them; they are the owner's files. Also corrects a path in the previous log entry, which named splash.png in backticks — doc-claims reads that as a claim the file is present, and it is now splash.webp. Named bare, per the convention DOC_TRUST_MAP.md documents for a path that deliberately does not exist. Second time this session; the lesson is that converting a file means grepping the docs for its old name. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-18 22:12:33 -05:00
> **The drawn wordmark agrees with this now.** It did not for a while: the first
> supplied lockup set the name as *Privacy:Period Tracker*, with no space after
> the colon, so `logo.webp` and `banner.webp` disagreed with every document and
> with `app_full_name`. It was filed as #28 rather than papered over, because
> closing that gap needed an artist and not a rename.
>
> The redrawn lockup is [`dist/splash.webp`](dist/splash.webp), and the two webp
> assets are regenerated from it. `lockup-light-source.png` and
> `lockup-dark-source.png` in [`brand/`](brand/) are the **superseded** originals
> — kept because they are the owner's files, not because anything should be cut
> from them again.
feat: the real brand — Privacy:Period Tracker The project owner supplied artwork and a full visual brand guide mid-session, which answers #8: the three marks an agent must not fake now exist because a person made them. docs/data/img now holds icon.webp (512x512, 11 KB), logo.webp (1024 long edge, 28 KB) and banner.webp (2176x725, 20 KB) — all webp by magic bytes, all far under the 512 KB ceiling. Produced from the supplied art rather than invented. Two things had to be handled rather than converted blindly. The sources render their rounded corners against black, so a naive crop carried black wedges into the banner; the corners are flood-filled to the artwork's own ground first. And the lockup is square, so a 3:1 crop would have cut the wordmark in half — the banner is the whole lockup on a matching ground, which has no seam to see because the artwork's edges ARE that ground. The source PNGs and the guide moved to docs/design/: docs/data/img is for the three marks the Command Center renders, and its README is explicit that reference art and exported sources do not belong there. THE PALETTE, AND ONE DELIBERATE CONFLICT core/designsystem now carries the guide's colours — deep plum, rich purple, period rose, lavender mist, and an eggplant dark theme that is never flat black. §39 of the specification asks for a muted teal or sage fertile window, to hold it apart from the period colour. The guide is plum and rose throughout and gives fertility its own pink. The guide wins: it is newer, it is the owner's, and a teal accent inside this identity would look borrowed from another app. What §39 was protecting is kept by other means, and this is why the conflict is safe to resolve that way: the calendar's states differ in SHAPE. A solid disc, a dotted ring, a continuous ring and a star stay tellable apart in greyscale and to a colourblind user, which is what §43 actually requires. The departure is written down in docs/design/README.md rather than left to be discovered. The launcher icon keeps its vector for now, in brand colours. The supplied emblem has content close to its edges and an adaptive icon masks about a quarter of the canvas away, so dropping it in unmodified would crop the shield. Fitting it to the safe zone is Batch 08's final-artwork work. closes #8
2026-08-18 15:31:52 -05:00
Preferred presentation:
**Privacy:** in plum/lavender
**Period Tracker** in rose pink.
Typography should feel like an elegant modern serif.
docs: correct 57 claims the code and tracker disagreed with Every document in the tree audited against the source, the tracker and git history, each finding then given to a second reader tasked with refuting it. 74 raised, 12 refuted, 57 applied. No code changed. THE README DESCRIBED A SKELETON Its Status table — the one place a claim about what is built is allowed to live — still read "there is no usable app yet", with Not built against Room, the four core screens, fertility and notifications, and No round run against QA. Five batches had shipped and three QA rounds had run. TWO DOCUMENTS WERE SILENTLY NEVER FIRING architecture/README.md and design/README.md wrote Governs: as prose ("the Gradle module graph", "the design tokens in core/designsystem"). Neither contains a path token, so doc-triggers.py reduced them to globs matching nothing, and one real glob apiece made them look path-governing rather than subject-governing — the state the script's own header calls invisible. Editing a Room entity never fired the document owning the migration table. Both now fire, proved by running the script. SECURITY.md CLAIMED FOUR UNBUILT PROTECTIONS App lock listed among what works offline; biometric/PIN gating described as protecting app launch; the incognito launcher as existing; Play Billing in the third parties table without the "not yet integrated" marker its neighbours carry. All are Batch 06/07 work. The advertising boundary was overstated in SECURITY.md and the README alike: both said the ads module declares no dependency and a guard proves it. There is no ads module. The pre-declared ":core:ads" to emptySet() rule is stricter than the sentence it replaced and matches nothing until Batch 07, which is why the guard is proved by injection rather than trusted. SMALLER, EACH A REAL TRAP WORK_CYCLE.md pointed at docs/architecture/scripts/forgejo-issue.py, a template path absent here — missed by doc-claims.sh, which reads backticked prose and not fenced blocks. ClaudeReport.md's Round notes said "No rounds yet" after three rounds because ClaudeQAPlan.md's after-a-round list never named that section; the playbook is fixed first. The instrumented-test count was eight in three places and is four. HISTORY.md said the repository had no code and that nothing had been tried and dropped, when three approaches had. DELIBERATELY UNCHANGED ClaudeReport.md's last verified build SHA stays at 0451fbe — no round has run since, and moving it would claim a verification nobody performed. Every DEVELOPMENT_LOG entry stays as written. Guards: ./gradlew check, schema-guard.sh, doc-claims.sh (235 claimed paths, all present), doc-triggers.py, and a link sweep over 21 markdown files. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-18 16:33:14 -05:00
> **This governs the wordmark, store assets and marketing artwork.** In-app
> typography is unchanged and still belongs to
> [`../planning/PRODUCT_PLAN.md` §40](../planning/PRODUCT_PLAN.md) — system or
> Material type, no licensed font — which is what `PeriodTypography` in
> `core/designsystem` implements; its one override is the forecast's
> `displayLarge`, because §38 makes the number the hero.
feat: the real brand — Privacy:Period Tracker The project owner supplied artwork and a full visual brand guide mid-session, which answers #8: the three marks an agent must not fake now exist because a person made them. docs/data/img now holds icon.webp (512x512, 11 KB), logo.webp (1024 long edge, 28 KB) and banner.webp (2176x725, 20 KB) — all webp by magic bytes, all far under the 512 KB ceiling. Produced from the supplied art rather than invented. Two things had to be handled rather than converted blindly. The sources render their rounded corners against black, so a naive crop carried black wedges into the banner; the corners are flood-filled to the artwork's own ground first. And the lockup is square, so a 3:1 crop would have cut the wordmark in half — the banner is the whole lockup on a matching ground, which has no seam to see because the artwork's edges ARE that ground. The source PNGs and the guide moved to docs/design/: docs/data/img is for the three marks the Command Center renders, and its README is explicit that reference art and exported sources do not belong there. THE PALETTE, AND ONE DELIBERATE CONFLICT core/designsystem now carries the guide's colours — deep plum, rich purple, period rose, lavender mist, and an eggplant dark theme that is never flat black. §39 of the specification asks for a muted teal or sage fertile window, to hold it apart from the period colour. The guide is plum and rose throughout and gives fertility its own pink. The guide wins: it is newer, it is the owner's, and a teal accent inside this identity would look borrowed from another app. What §39 was protecting is kept by other means, and this is why the conflict is safe to resolve that way: the calendar's states differ in SHAPE. A solid disc, a dotted ring, a continuous ring and a star stay tellable apart in greyscale and to a colourblind user, which is what §43 actually requires. The departure is written down in docs/design/README.md rather than left to be discovered. The launcher icon keeps its vector for now, in brand colours. The supplied emblem has content close to its edges and an adaptive icon masks about a quarter of the canvas away, so dropping it in unmodified would crop the shield. Fitting it to the safe zone is Batch 08's final-artwork work. closes #8
2026-08-18 15:31:52 -05:00
Look for fonts similar to:
- Cormorant Garamond
- DM Serif Display
- Playfair Display
- Libre Baskerville
- Lora
Avoid:
- bubbly fonts
- handwritten scripts
- childish fonts
- highly futuristic fonts
- heavy block fonts
---
# 11. Brand Tagline
Primary tagline:
**KNOW YOUR CYCLE. PROTECT YOUR PRIVACY.**
Display using a clean sans-serif font with generous letter spacing.
Recommended style:
ALL CAPS
Wide tracking
Thin or regular weight
Example fonts:
- Montserrat
- Inter
- Poppins
- Avenir-style sans serif
---
# 12. Decorative Lotus Mark
A very small three-petal or lotus-like symbol can be used as a secondary brand detail.
Typical arrangement:
`──── • lotus • ────`
It can be used:
- beneath the brand name
- between sections
- in onboarding screens
- loading screens
- empty states
- privacy messages
Keep it subtle.
---
# 13. Light Mode Visual Style
Light mode should use:
- blush ivory backgrounds
- soft lavender shadows
- muted plum
- dusty rose
- pale pink
- very subtle gradients
Avoid stark white backgrounds.
Preferred feel:
**soft morning light + blush + lavender mist**
---
# 14. Dark Mode Visual Style
Dark mode should use:
- near-black plum
- deep eggplant
- faint purple gradients
- soft pink highlights
- lavender glow
- subdued botanical outlines
Preferred feel:
**quiet nighttime + plum velvet + soft rose glow**
Never use ordinary flat `#000000` unless required by the platform.
---
# 15. Shadows and Depth
Artwork uses subtle semi-3D depth.
Elements may include:
- soft inner highlights
- subtle outer shadows
- gentle glow
- slightly raised surfaces
Do NOT use:
- harsh drop shadows
- metallic chrome
- hard bevels
- excessive glass effects
The artwork should remain halfway between:
**clean vector illustration**
and
**soft polished 3D UI artwork**
---
# 16. Corners and Shapes
Almost every shape should use rounded geometry.
Use:
- rounded calendar corners
- rounded shield
- rounded dots
- soft petal shapes
- curved stems
- circular framing
Avoid sharp aggressive angles.
---
# 17. Background Decoration
Splash screens and large promotional images may include extremely subtle:
- botanical line art
- circular arcs
- crescent shapes
- tiny four-point sparkles
- translucent leaves
- cycle rings
These decorations should remain low contrast.
They should never compete with the primary logo.
---
# 18. App Icon Design Rules
For a small mobile app icon, **do not include the full app name or tagline**.
The icon should simplify the brand.
Preferred icon composition:
1. Rounded square background
2. Circular pink/plum cycle ring
3. Simplified calendar
4. Privacy shield and lock
5. Optional tiny crescent
6. Optional single botanical leaf/petal
The lock and calendar should remain recognizable at very small sizes.
### App Icon — Light
Background:
`#F4E7F1`
Cycle ring:
`#E46F91 → #704770`
Calendar:
`#F3E4EF`
Header:
`#563659`
Shield:
`#563659`
Lock:
`#F8E8F0`
Period indicator:
`#DF5A80`
---
### App Icon — Dark
Background:
`#100811`
Cycle ring:
`#EC709A → #704770`
Calendar:
`#DDBFDB`
Header:
`#4A235A`
Shield:
`#432847`
Lock:
`#F4C8DE`
Selected cycle dot:
`#E95484`
Add a very faint pink-purple glow behind the emblem.
---
# 19. Simplified Small Icon
For extremely small icons such as notifications or feature buttons, simplify further.
Use only:
**calendar + shield/lock**
or
**cycle ring + lock**
Do not attempt to fit:
calendar + shield + moon + flowers + text
into very small UI icons.
---
# 20. Feature Icon Style
Future feature icons should look like they belong to the same family.
Examples:
### Period
docs: correct 57 claims the code and tracker disagreed with Every document in the tree audited against the source, the tracker and git history, each finding then given to a second reader tasked with refuting it. 74 raised, 12 refuted, 57 applied. No code changed. THE README DESCRIBED A SKELETON Its Status table — the one place a claim about what is built is allowed to live — still read "there is no usable app yet", with Not built against Room, the four core screens, fertility and notifications, and No round run against QA. Five batches had shipped and three QA rounds had run. TWO DOCUMENTS WERE SILENTLY NEVER FIRING architecture/README.md and design/README.md wrote Governs: as prose ("the Gradle module graph", "the design tokens in core/designsystem"). Neither contains a path token, so doc-triggers.py reduced them to globs matching nothing, and one real glob apiece made them look path-governing rather than subject-governing — the state the script's own header calls invisible. Editing a Room entity never fired the document owning the migration table. Both now fire, proved by running the script. SECURITY.md CLAIMED FOUR UNBUILT PROTECTIONS App lock listed among what works offline; biometric/PIN gating described as protecting app launch; the incognito launcher as existing; Play Billing in the third parties table without the "not yet integrated" marker its neighbours carry. All are Batch 06/07 work. The advertising boundary was overstated in SECURITY.md and the README alike: both said the ads module declares no dependency and a guard proves it. There is no ads module. The pre-declared ":core:ads" to emptySet() rule is stricter than the sentence it replaced and matches nothing until Batch 07, which is why the guard is proved by injection rather than trusted. SMALLER, EACH A REAL TRAP WORK_CYCLE.md pointed at docs/architecture/scripts/forgejo-issue.py, a template path absent here — missed by doc-claims.sh, which reads backticked prose and not fenced blocks. ClaudeReport.md's Round notes said "No rounds yet" after three rounds because ClaudeQAPlan.md's after-a-round list never named that section; the playbook is fixed first. The instrumented-test count was eight in three places and is four. HISTORY.md said the repository had no code and that nothing had been tried and dropped, when three approaches had. DELIBERATELY UNCHANGED ClaudeReport.md's last verified build SHA stays at 0451fbe — no round has run since, and moving it would claim a verification nobody performed. Every DEVELOPMENT_LOG entry stays as written. Guards: ./gradlew check, schema-guard.sh, doc-claims.sh (235 claimed paths, all present), doc-triggers.py, and a link sweep over 21 markdown files. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-18 16:33:14 -05:00
Calendar dot or filled cycle disc — never a droplet.
[`../planning/PRODUCT_PLAN.md` §42](../planning/PRODUCT_PLAN.md) forbids blood
drops, and [`README.md`](README.md) applies that list to every in-app
illustration and marker.
feat: the real brand — Privacy:Period Tracker The project owner supplied artwork and a full visual brand guide mid-session, which answers #8: the three marks an agent must not fake now exist because a person made them. docs/data/img now holds icon.webp (512x512, 11 KB), logo.webp (1024 long edge, 28 KB) and banner.webp (2176x725, 20 KB) — all webp by magic bytes, all far under the 512 KB ceiling. Produced from the supplied art rather than invented. Two things had to be handled rather than converted blindly. The sources render their rounded corners against black, so a naive crop carried black wedges into the banner; the corners are flood-filled to the artwork's own ground first. And the lockup is square, so a 3:1 crop would have cut the wordmark in half — the banner is the whole lockup on a matching ground, which has no seam to see because the artwork's edges ARE that ground. The source PNGs and the guide moved to docs/design/: docs/data/img is for the three marks the Command Center renders, and its README is explicit that reference art and exported sources do not belong there. THE PALETTE, AND ONE DELIBERATE CONFLICT core/designsystem now carries the guide's colours — deep plum, rich purple, period rose, lavender mist, and an eggplant dark theme that is never flat black. §39 of the specification asks for a muted teal or sage fertile window, to hold it apart from the period colour. The guide is plum and rose throughout and gives fertility its own pink. The guide wins: it is newer, it is the owner's, and a teal accent inside this identity would look borrowed from another app. What §39 was protecting is kept by other means, and this is why the conflict is safe to resolve that way: the calendar's states differ in SHAPE. A solid disc, a dotted ring, a continuous ring and a star stay tellable apart in greyscale and to a colourblind user, which is what §43 actually requires. The departure is written down in docs/design/README.md rather than left to be discovered. The launcher icon keeps its vector for now, in brand colours. The supplied emblem has content close to its edges and an adaptive icon masks about a quarter of the canvas away, so dropping it in unmodified would crop the shield. Fitting it to the safe zone is Batch 08's final-artwork work. closes #8
2026-08-18 15:31:52 -05:00
### Fertility
Small flower/petal or ovulation circle
### Predictions
Calendar with subtle sparkle
### Symptoms
Simple heart/pulse or body indicator
### Privacy
Shield + lock
### Insights
Small chart enclosed in cycle ring
### Mood
Simple rounded face or heart
### Notes
Rounded document
### Temperature
Rounded thermometer
### Medication
Rounded pill/capsule
All feature icons should use:
- rounded geometry
- 23 colors maximum
- plum outline or base
- rose highlight
- lavender secondary fill
---
# 21. Image Generation Style Description
When asking another AI to generate artwork, include language similar to:
**“Premium feminine health-tech illustration, elegant period and fertility tracking aesthetic, privacy-first branding, soft rounded vector forms with subtle semi-3D depth, dusty rose, mauve, plum and lavender palette, smooth gradients, soft glow, botanical accents, menstrual cycle symbolism, sophisticated rather than childish, clean modern mobile-app design.”**
---
# 22. Master Prompt for Future Agents
Use this as the starting prompt when creating new visual assets:
chore: rename the project to Privacy: Period Tracker "Period" was always a working name — PRODUCT_PLAN.md §55 said so. The real identity arrived with the brand guide and artwork, and this makes the project call itself by it. The repository is renamed in place on Forgejo (null/Period -> null/Privacy-Period-Tracker), which keeps all 30 commits, all 27 issues, all 8 milestones and the four severity labels — verified by counting them on both sides rather than assuming a rename is lossless. The git remote follows in the same breath, so this commit's automatic push is what proves the new URL works. WHAT DELIBERATELY DID NOT MOVE "Period" is the product name AND the central domain word, and a mass rename would have turned the data model into nonsense. PeriodRecord, PeriodWriteResult, confirmPeriodStart, the period_records table and the button that says "Started period" all describe a menstrual period rather than a product, and all 239 references to them are untouched. So are the Kotlin package and applicationId. dev.privacyllc.period already reads correctly under the new name — privacyllc is the company, period is the app — and changing it would rewrite 68 files, rename the Room schema directory and break the hardcoded path in schema-guard.sh for no gain. period.db stays for a sharper reason: renaming a database file orphans the data on every device that already has it. Sixteen files changed, and the diff is small on purpose. THE NAME HAS A SPACE AND THE ARTWORK DOES NOT Canonical is "Privacy: Period Tracker". The supplied wordmark sets it without one, so logo.webp and banner.webp now disagree with every document and with the app itself. BRAND_GUIDE.md §10 is updated to the space form and says plainly that the drawn mark has not caught up. Filed separately rather than papered over, because closing that gap needs an artist and not a rename.
2026-08-18 15:54:34 -05:00
**Create an image for the mobile app “Privacy: Period Tracker” using its established visual identity. Use a sophisticated feminine health-tech aesthetic focused on menstrual-cycle tracking, fertility awareness, and strong personal privacy. The brand palette consists of dusty rose, blush pink, mauve, deep plum, lavender, and soft ivory in light mode, or midnight plum/eggplant with luminous rose and lavender accents in dark mode. Use smooth rounded vector shapes with subtle semi-3D depth, soft gradients, gentle highlights, and restrained glow. Incorporate established motifs where appropriate: circular cycle rings, rounded calendar shapes, circular cycle-day indicators, privacy shields, simple padlocks, crescent moons, and elegant botanical leaves or petals. Keep the design premium, calm, private, modern, and feminine without becoming childish, cartoonish, overly clinical, or overly sexualized. Maintain generous whitespace and clean mobile-app composition.**
feat: the real brand — Privacy:Period Tracker The project owner supplied artwork and a full visual brand guide mid-session, which answers #8: the three marks an agent must not fake now exist because a person made them. docs/data/img now holds icon.webp (512x512, 11 KB), logo.webp (1024 long edge, 28 KB) and banner.webp (2176x725, 20 KB) — all webp by magic bytes, all far under the 512 KB ceiling. Produced from the supplied art rather than invented. Two things had to be handled rather than converted blindly. The sources render their rounded corners against black, so a naive crop carried black wedges into the banner; the corners are flood-filled to the artwork's own ground first. And the lockup is square, so a 3:1 crop would have cut the wordmark in half — the banner is the whole lockup on a matching ground, which has no seam to see because the artwork's edges ARE that ground. The source PNGs and the guide moved to docs/design/: docs/data/img is for the three marks the Command Center renders, and its README is explicit that reference art and exported sources do not belong there. THE PALETTE, AND ONE DELIBERATE CONFLICT core/designsystem now carries the guide's colours — deep plum, rich purple, period rose, lavender mist, and an eggplant dark theme that is never flat black. §39 of the specification asks for a muted teal or sage fertile window, to hold it apart from the period colour. The guide is plum and rose throughout and gives fertility its own pink. The guide wins: it is newer, it is the owner's, and a teal accent inside this identity would look borrowed from another app. What §39 was protecting is kept by other means, and this is why the conflict is safe to resolve that way: the calendar's states differ in SHAPE. A solid disc, a dotted ring, a continuous ring and a star stay tellable apart in greyscale and to a colourblind user, which is what §43 actually requires. The departure is written down in docs/design/README.md rather than left to be discovered. The launcher icon keeps its vector for now, in brand colours. The supplied emblem has content close to its edges and an adaptive icon masks about a quarter of the canvas away, so dropping it in unmodified would crop the shield. Fitting it to the safe zone is Batch 08's final-artwork work. closes #8
2026-08-18 15:31:52 -05:00
Then add the specific asset request.
Example:
**“Create a fertility prediction icon using this visual system.”**
or:
docs: record why the database is not encrypted, and drop the claim that it is Asked whether encryption at rest could be added. It can, and it should not be yet — so the reasoning goes in the document that owns the claim, before it is forgotten and re-derived from scratch. The architecture decides it. ReminderCoordinator collects Room flows at every process start, including processes started with no Activity after a reboot, and ReminderWorker reads the forecast on a schedule. The key would have to be readable with no user present, which is the availability condition the platform key already has. A key anything running as this app can reach unattended defends a file, not a process — and against every adversary this document already lists, it adds nothing. What it would genuinely add is narrow: a file copied off the device and read elsewhere, a phone with no screen lock, and crypto-shredding on delete. The cost is about +1 MB downloaded and +2 MB installed on a 2 MB app, and a new class of total loss — a Keystore key can be lost in the field, platform backup is off, and there is no telemetry that would tell us it happened. Today a database that will not open is a bug. Afterwards it would be somebody's history. The condition that reverses it is written down too: a key bound to the app lock's user secret, once export has given the user a copy they control. BRAND_GUIDE carried an artwork brief reading "explaining encrypted local data storage" — a false claim waiting for somebody to draw it, on the one subject where a padlock reads as a promise. Replaced with what is true and is a better story anyway: the data never leaves, so there is no server to breach and nothing to sell. SECURITY_CHECKLIST gains the row that would have caught it. Nothing shipped ever claimed encryption; grep over app, core and domain for strings and illustrations comes back empty. This closes the gap between that and the documents. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-19 03:08:22 -05:00
**“Create an onboarding illustration explaining that cycle history stays on this device using this visual system.”**
Note the wording, because it changed. This example used to say *encrypted local
data storage*, and the database is **not** encrypted — see *Deliberately out of
scope* in [`../security/SECURITY.md`](../security/SECURITY.md), which owns that
claim and explains why.
A prompt is a claim the moment somebody draws it. A padlock on an onboarding
screen is a promise, and this one would have been a promise the product does not
keep — which is worse than saying nothing, because the true story here is
genuinely good: the data never leaves, so there is no server to breach and
nothing to sell. Draw that instead.
feat: the real brand — Privacy:Period Tracker The project owner supplied artwork and a full visual brand guide mid-session, which answers #8: the three marks an agent must not fake now exist because a person made them. docs/data/img now holds icon.webp (512x512, 11 KB), logo.webp (1024 long edge, 28 KB) and banner.webp (2176x725, 20 KB) — all webp by magic bytes, all far under the 512 KB ceiling. Produced from the supplied art rather than invented. Two things had to be handled rather than converted blindly. The sources render their rounded corners against black, so a naive crop carried black wedges into the banner; the corners are flood-filled to the artwork's own ground first. And the lockup is square, so a 3:1 crop would have cut the wordmark in half — the banner is the whole lockup on a matching ground, which has no seam to see because the artwork's edges ARE that ground. The source PNGs and the guide moved to docs/design/: docs/data/img is for the three marks the Command Center renders, and its README is explicit that reference art and exported sources do not belong there. THE PALETTE, AND ONE DELIBERATE CONFLICT core/designsystem now carries the guide's colours — deep plum, rich purple, period rose, lavender mist, and an eggplant dark theme that is never flat black. §39 of the specification asks for a muted teal or sage fertile window, to hold it apart from the period colour. The guide is plum and rose throughout and gives fertility its own pink. The guide wins: it is newer, it is the owner's, and a teal accent inside this identity would look borrowed from another app. What §39 was protecting is kept by other means, and this is why the conflict is safe to resolve that way: the calendar's states differ in SHAPE. A solid disc, a dotted ring, a continuous ring and a star stay tellable apart in greyscale and to a colourblind user, which is what §43 actually requires. The departure is written down in docs/design/README.md rather than left to be discovered. The launcher icon keeps its vector for now, in brand colours. The supplied emblem has content close to its edges and an adaptive icon masks about a quarter of the canvas away, so dropping it in unmodified would crop the shield. Fitting it to the safe zone is Batch 08's final-artwork work. closes #8
2026-08-18 15:31:52 -05:00
---
# 23. Critical Consistency Rules
Future agents should preserve these rules:
- Privacy/security is always visually important.
- Pink should be sophisticated dusty rose, not hot bubblegum pink.
- Purple should lean plum and mauve rather than electric violet.
- Avoid bright primary colors.
- Avoid excessive red.
- Avoid generic medical blue.
- Avoid anatomical uterus graphics as the primary identity.
- Avoid cartoon characters.
- Avoid overtly sexual imagery.
- Keep botanical imagery elegant and secondary.
- Prefer circles, curves, shields, petals, and rounded rectangles.
- Use subtle gradients rather than flat colors everywhere.
- Dark mode should feel luxurious rather than gloomy.
- Light mode should feel soft rather than sterile.
- All icons should appear to belong to the same visual family.
---
# 24. Brand Visual Formula
When unsure, use this formula:
**Cycle + Calendar + Privacy + Soft Botanical Femininity**
Visually:
**Circular cycle motif**
+ **rounded calendar**
+ **shield/lock**
+ **rose/plum botanical accent**
+ **soft lavender/pink gradients**
2026-08-20 02:14:08 -05:00
That combination is the core visual identity of **Privacy: Period Tracker**.
---
# 25. Google Play Listing Assets
The Play listing exports live in [`brand/play-store/`](brand/play-store/). They
derive from this guide rather than adding a new campaign direction: the feature
graphic uses the existing lockup composition, the Play icon uses the existing
app-card mark, and the screenshots come from seeded demo data.
The same claim discipline applies here as inside the app. Listing artwork may
say the app predicts a period window and protects privacy; it must not imply a
medical diagnosis, contraception, certainty about fertility, or real user
history.