Noo Principles: a constitution

Preamble

Noo comes from the French nous, "us". It exists so that people can share their lives with the people and places they choose, and with nobody else. This text is Noo's constitution. It outranks the plan, the identity guide, the code and any request, including a request made to a session.

Order of authority

• 1. This constitution (docs/CONSTITUTION.md).
• 2. The laws: plan/, above all the data table (plan/data-and-privacy.md), the ranking (plan/recommendations.md) and the architecture (plan/architecture.md).
• 3. The rulebook: docs/VISUAL_IDENTITY.md and the tokens it governs (identity/tokens.css, identity/tokens.json).
• 4. The code: prototype/, tools/, identity/tools/, and later the app and the server.

When two of them conflict, the higher one wins and the lower one is fixed to match it. When a reading is unclear, the reading that protects the person wins.

Article 1. Privacy first

Adopted by maxime on 26 October 2026.

Each clause has an example from the prototype ("in practice") and a line that says where to check it.

1.1 Only what a feature needs. Noo collects a piece of data only if a feature needs it and the data table gives it a place, its readers and an end date. Data without a row in the table is not collected. In practice: Compose says "Location and camera details are removed from the file before sharing." Check: plan/data-and-privacy.md; every stored field has a row.

1.2 No tracking, no ad profile, no sale, no third-party code. Noo keeps no record of what a person looks at, for how long or what they tap. It builds no advertising or behaviour profile, and it sells, rents or gives personal data to no one. The only exceptions are the providers the data table names for delivery. The app contains no third-party trackers, analytics, ad, crash-reporting or social-login SDKs. It calls no network host but Noo's own and Apple's. In practice: You lists "Kept nowhere: what you tap, how long you look, your contacts, your location history" and "No third-party code in the app". Check: the "Nowhere" rows of the data table; the app's list of network hosts and dependencies.

1.3 The phone ranks the feed, not the server. The server hands the phone only what the person may see. The phone decides the order, using only signals the person chose: their circles, places and follows, Show first, interests, Show less, Nearby when they tap it, counts inside the same audience, and time. Behaviour is never a signal, not even on the phone. In practice: the Why sheet says "Your phone ranked this… Noo never uses how long you look or what you tap." Check: the "Used / Never used" table in plan/recommendations.md; the candidate API carries no behaviour and no plan tier.

1.4 Every suggestion explains itself. Every item in For you opens a plain explanation of why it is there. The explanation states that nobody paid for the item and offers Show less and Not interested. Latest is one tap away and hides nothing. In practice: "Why am I seeing this?" shows the signals, "Paid placement: None", Show less from Le Petit Café and Switch to Latest. Check: each For you card in prototype/feed.html has a Why link.

1.5 The audience comes first. Nothing is posted until the screen names who will see it and how many people that is. Nothing is public by default. In practice: Compose says "Only Family will see this · 8 people". Posting with no circle picked shows "Choose who sees it first". Check: the compose audience line in prototype/app.js.

1.6 Circles are end-to-end encrypted, and the app says where content is not. Photos, videos, captions, comments and reactions in a circle are encrypted on the phone for its members only, and the server can't open them. Places, shops and events are readable by Noo's server. Every screen where a person reads or writes them says so. In practice: Building 12 says "Posts in places are readable by Noo's server". Compose warns "In Building 12 it is readable by Noo's server, not end-to-end encrypted." Check: the "Circles" and "Spaces, businesses and events" sections of the data table.

1.7 Contacts are never uploaded. The app never asks for access to Contacts. People join by link or QR code. There is no "people you may know". In practice: Welcome says "Noo never reads your contacts. Invite people with a link or QR code." Check: the "Address book / contacts: Nowhere" row; no Contacts permission in the app.

1.8 Deletion is real and timely. When a person deletes a post, a circle or their account, Noo removes it from the server within 24 hours, from members' phones at their next sync, and from backups within 30 days. In practice: You says "Deleting removes your posts, media and membership from the server within 24 hours. Backups roll over in 30 days." Check: the "How long it is kept" column; the hourly purge job and the 30-day backup retention in plan/architecture.md.

1.9 The person can export everything. A person can export everything Noo holds about them, decrypted, into a file made on their own phone. In practice: You › Export everything: "a .zip on your phone". Check: every row of the data table that has a person in it is in the export.

1.10 The app never says more than the system does. No screen, notification or store text promises more privacy than the data table and the code deliver. Where there is a limit, the screen that makes the promise states it. Examples of limits: what the server knows, what the network provider sees, screenshots. In practice: Circles says "The server knows who is in each circle, only to deliver posts." Compose says "People can still take a screenshot." Check: each privacy sentence in prototype/ against the data table (plan/privacy-review.md, docs/constitution-audit.md).

Article 2. Security first

Adopted by maxime on 26 October 2026.

maxime: "We want to be security first."

Noo is built to resist attack from the first line of code. 2.1 Every service, account and key gets only the access it needs (least privilege). 2.2 Data is encrypted in transit (TLS) and at rest (disk and backups). 2.3 No secret is ever in the code, the repository or a build image. Secrets live in the Keychain or a secrets store. 2.4 Every endpoint checks who is calling (authentication) and what they may do (authorisation). A test exists for each one. 2.5 No release ships with a known vulnerability in its dependencies (govulncheck, a dependency audit). 2.6 A breach is handled openly: the people affected are told what happened, what is safe and what happens next. Check: plan/architecture.md (Security basics); CI logs; the breach-response note.

Article 3. GDPR first, lawful by design

Adopted by maxime on 26 October 2026.

maxime: "We want to be GDPR first."

Noo meets the GDPR by design and by default. 3.1 Every piece of personal data has a stated purpose and legal basis, written in the data table. 3.2 Data stays minimal, and stays in the EU where possible. 3.3 People use their rights in the app itself, not by email: access, export, correction, erasure and objection. 3.4 Every processor is listed with what it sees: for example Apple (push) and any tunnel or hosting provider. 3.5 Children's consent follows the national age: 15 in France. Below that age, a parent's consent is required. 3.6 A breach is notified to the supervisory authority (CNIL) within 72 hours. In practice (decisions of 26 October 2026): under 3.5, Noo is for people aged 15 and over at launch, so no child under 15 has an account and no parental consent is collected. Under 3.4, the public API is reached through Tailscale Funnel with TLS ending on the Mac, so the tunnel provider relays encrypted bytes and sees only connection metadata (IPs, timing, volume). Check: a purpose/legal-basis column in plan/data-and-privacy.md; a processors list; the You screen; the child-account flow.

Article 4. People over attention

Adopted by maxime on 26 October 2026. Amended by maxime on 29 October 2026.

Noo is built to be put down. It has no streaks, no unread badges counting up and no autoplay with sound. Its feed is never tuned to hold attention: what is in it and how it is ranked are the person's own choice, shown on screen, and nothing learns from what they look at, tap or how long they stay. A person may scroll as long as they like; the feed says when they have seen everything new. It sends no notification meant to bring a person back: every push comes from a person or a place they chose. Check: a test proves the ranking takes no input from views, taps, time spent or scrolling; the feed names its ranking rule and shows a "You've seen everything new" marker; the notification list in plan/features.md.

Article 5. No paid reach

Adopted by maxime on 26 October 2026.

Money buys tools, never attention. There are no boosts, sponsored posts or promoted pages. A business's plan tier is never an input to ranking. Shops appear in a place only when its organisers invite them, and in an order that nobody pays for. Check: "Rules that stop businesses buying reach" in plan/recommendations.md; plan/business.md.

Article 6. Honest by design

Adopted by maxime on 26 October 2026.

Noo publishes, inside the app, how For you works (the formula) and what it stores (the data table). It announces any change to either in the app before the change applies. Weights are tuned by asking people whether the order was right, never by A/B tests on engagement. Check: an in-app How For you works page and a What Noo stores page that match plan/.

Article 7. You own your circles

Adopted by maxime on 26 October 2026.

A person can leave any circle or place, and can leave Noo itself, at any time and with their data. Exports use open formats (JPEG/HEIC, MP4, JSON). No feature makes leaving harder than joining. Check: the export format; the leave and delete flows on You and in each circle.

Amendments

• Only maxime adopts, changes or repeals an article.
• Each change is dated, gives its reason and is added to the log below. Text that was replaced stays readable in git history.
• Sessions may propose a new article or a change, in a report or under Proposed articles. They never edit the text of an adopted article.

Amendment log