Our Life shipped on the Apple App Store on July 6, 2026. We pulled it from sale on July 7. This is a short account of what did not match, and what we're doing about it.
The app worked. The sync worked. The photo-to-event feature worked. Talia was using it. That was not the problem.
The problem was that during a review of the architecture, I confirmed the marketing pages had drifted into claims the code did not yet support. The words in the store listing, the words on the landing page, and the words in the press pitches described a product with stronger privacy guarantees than the running code delivered.
What did not match
- The marketing described end-to-end encryption of family content. The code stored family calendar, list, and meal data as plaintext on the server.
- The marketing described the family credential as being stored in iOS Keychain. The code stored it in browser localStorage inside the Capacitor WebView.
- The marketing described the family code as a cryptographic key. It was in fact a bearer credential — closer to an unguessable share link — with no key derivation, no key material, and no encryption on top.
- The marketing implied the server could not read family data. It could.
None of those claims were malicious. They were aspirational. They described the product I intended to build. They just did not yet describe the product that had shipped.
Why that mattered enough to pull the app
Our Life is a family calendar. It holds children's schedules, appointments, addresses, routines, and the daily rhythm of a household. Families who chose Our Life for its privacy commitment deserved a product whose implementation matched that commitment. Half of it did. Half of it did not.
What we did
- Removed the app from sale on the Apple App Store. Existing testers (Talia, the household, a small controlled cohort) continue on TestFlight.
- Froze every public claim that was not backed by an implementation. Audited 21 HTML files and 8 internal documents. Corrected 47 occurrences.
- Published a Decision Ledger at ourlifeapp.ai/decisions documenting every material choice, with context, alternatives, and tradeoffs.
- Established the Red Lines — what this company does not do, permanently, at ourlifeapp.ai/manifesto.
- Set the target for v1.1 — Late Summer 2026 — for the release whose implementation earns the claims.
What we're doing now
Ten milestones (M0 through M9.5) covering the credential storage rewrite, the server schema migration to opaque ciphertext, the pairing protocol, the client-side encryption layer, conflict handling, tombstone-based deletion, server-side feature triage, recovery flow, migration for beta users, and an independent security review before the next App Store submission.
Every milestone has a customer-outcome sentence that a non-engineer can read. Every claim we publish about the milestone must be traceable to the code that implements it. Every architectural choice gets a Decision Ledger entry. The weekly journal — this is entry #1 — documents progress in plain terms.
What we're not doing
Apologizing at length. Rebranding as a privacy company. Attacking competitors. Cutting corners to hit a shorter timeline. Talking about the pause more than we talk about the product it protects.
The product is a family calendar that turns paper school flyers into events, syncs across a household in real time, and asks for no personal identifying information to work. That is what Our Life does when it works. The rebuild is so that it can do that at the standard we described.
If you want to follow the process, the Decision Ledger updates as decisions are made and the journal updates weekly. If you want early access to the rebuild, the waitlist is on the home page. If you want us to just tell you when it's back, that works too.