# Settings PRD v0.1

*Product requirements and interaction specification — 26 July 2026*

## Decision

Settings is the fourth top-level destination and the control centre for the account, app preferences, integrations, entitlement, privacy, and data ownership.

Settings does not own daily food records or plan decisions. Food owns diary correction. Journal owns plan review, new-plan creation, and recommendation-algorithm reset.

## Product outcome

A person can:

- understand which account and authentication method they use;
- choose units and regional display preferences;
- inspect and change Apple Health access;
- control notifications and non-essential assistance;
- disable or reset food-personalization features;
- inspect Premium or Duo entitlement;
- import portable CSV records from previous apps;
- export their complete record;
- delete records or the account through an explicit, protected flow.

## Information architecture

Settings uses one overview with seven grouped destinations:

1. Account
2. Units and region
3. Apple Health and integrations
4. Notifications
5. Experience controls
6. Premium
7. Privacy and data

Do not place plan targets, goal destination, new-plan creation, algorithm reset, diary editing, or progress measurements in Settings.

## Screen-by-screen requirements

### 1. Settings overview

Show:

- account identifier and authentication source;
- current unit system;
- Apple Health connection status;
- notification summary;
- experience-control summary;
- current Free, Premium, or Duo entitlement;
- privacy and data destination;
- sign-out action.

Every row names its current state. Avoid generic labels such as “General.”

### 2. Account

Show:

- account identifier;
- authentication method, including Continue with Apple when used;
- Apple private-relay email status when available;
- sign-in and security-management destination;
- sign out.

Continue with Apple remains authentication only. It does not imply Apple Health access.

Account deletion belongs in Privacy and data, not beside Sign out.

### 3. Units and region

Provide independent controls for:

- body weight: kilograms or pounds;
- height and body measures: metric or imperial;
- food weight: grams or ounces where supported;
- energy display: kilocalories;
- date, time, decimal, and thousands formatting from the active locale;
- first day of week, if the product supports a manual override.

Changing units changes presentation, not stored source values, historical meaning, plan evidence, or formula provenance. Direct numeric entry remains locale-aware.

Open decision: whether region and first-day-of-week are system-only or manually overridable.

### 4. Apple Health and integrations

Show:

- connection state;
- last successful sync;
- granted, limited, denied, or unavailable status by supported category;
- the exact data the product uses, such as available weight, height, steps, workouts, and activity context;
- actions to review permissions, reconnect, or disconnect;
- manual-entry fallback.

Rules:

- request access only in context;
- never imply that Continue with Apple granted access;
- never imply that all Apple Health data is present;
- keep imported values sourced, editable, and attributable;
- do not silently source the private equation-sex input;
- do not add wearable exercise calories directly to an activity-adjusted target;
- disconnecting stops future sync but does not silently delete previously imported, attributed records.

Open decisions: supported write permissions, third-party integrations, sync frequency, and imported-record deletion behaviour.

### 5. Notifications

Provide independent controls for:

- meal or logging reminders;
- Weekly Check-in ready;
- integration or sync problems;
- plan or recommendation decisions awaiting review;
- Premium account and billing notices where system policy allows.

Rules:

- notification permission is requested only after the person enables a notification-dependent feature;
- every reminder category can be disabled;
- reminders use neutral language and do not shame missed logging;
- the app does not send weight-change, calorie-overage, streak-loss, or moralised food alerts by default.

Open decisions: reminder schedules, quiet hours, time-zone behaviour, and whether meal reminders learn personal meal windows.

### 6. Experience controls

Provide independent controls for:

- calorie-target visibility;
- macro visibility;
- “This week so far” visibility;
- suggested actions;
- insights or patterns;
- recommendation prompts;
- time-aware meal suggestions;
- “Usual around this time” personalization;
- food-personalization reset once its scope is approved.

Disabling assistance never removes core logging, history, export, measurements, or manual targets.

Reset food personalization must explain exactly which learned ranking or timing data it clears. It must not reset the recommendation algorithm, delete food logs, or remove Meal Templates.

Open decisions: final control catalogue, defaults, reset scope, and whether calorie visibility changes summaries, widgets, notifications, and exports.

### 7. Premium

Show:

- current entitlement and renewal or expiry state when available;
- Individual Premium: $4.99 monthly or $29.99 annually;
- Duo: $49 annually for two people;
- confirmed Premium features: editable AI photo-recognition drafts and private progress photos;
- restore-purchases and manage-subscription actions;
- Duo privacy boundary.

The Duo account relationship never merges goals, portions, diaries, measurements, recommendations, exports, or privacy controls. Core meal sharing remains free.

Do not invent a trial, regional price, launch offer, or additional Premium feature. “Buy me a coffee” remains pricing strategy only and is not a Settings control.

### 8. Privacy and data

Show:

- concise privacy explanation;
- data categories held by the product;
- Apple Health attribution and permission destination;
- CSV import;
- complete data export;
- record-deletion controls;
- account deletion;
- relevant voice transcript and model-derived data controls once retention policy is approved.

Import, export, and deletion remain available to Free users.

### 9. Import CSV

Use a focused, reversible sequence:

1. Choose a `.csv` file through the native Files picker.
2. Detect a known source when possible and let the person confirm or change it.
3. Map CSV columns to supported record fields.
4. Confirm date, time, decimal, and unit interpretation.
5. Preview the records, duplicates, omissions, and validation issues.
6. Import only after explicit confirmation.
7. Show a receipt with imported, skipped, and failed row counts.

The first version should support portable history without pretending every previous app exports the same schema. Candidate record categories are:

- item-level food diary records;
- daily nutrition totals;
- body weight and compatible body-composition measurements;
- steps;
- workouts, including type, duration, and source fields when available.

Detailed food records become attributed Food Log Events only when the CSV supplies enough item, quantity, nutrition, date, and meal information. Daily totals remain attributed daily summaries; the product must not invent food items to explain them. CSV import does not automatically create Meal Templates, recipes, completed Weekly Check-ins, or recommendation decisions.

Rules:

- never alter the record before the final confirmation;
- preserve the original source, filename, import time, supplied values, and mapping version in the import receipt;
- normalize display units without discarding the original supplied value or unit;
- require explicit interpretation when date order, decimal separator, unit, time zone, or encoding is ambiguous;
- keep missing fields missing rather than converting them to zero;
- skip exact duplicates by default and never overwrite an existing record silently;
- isolate invalid rows instead of failing the complete file where safe;
- let the person download or share an issue report before leaving the flow;
- make cancellation safe at every pre-confirmation step;
- treat imported diary days as **Unreviewed** and exclude them from quantitative recommendation evidence until the person reconciles intake completeness;
- retain row-level source attribution after edits and preserve correction history;
- do not infer diagnoses, goals, targets, medication status, or safety eligibility from imported data;
- process large files without requiring the import screen to remain open, then report completion or failure;
- do not retain the original uploaded file beyond processing unless the person explicitly chooses a future approved backup option.

The product must provide a generic manual mapper. Source-specific presets may improve mapping but must never be presented as an endorsement of another app or as a guarantee that every export version is supported.

Open decisions: launch data categories, recognized source presets, maximum file size and row count, supported encodings, duplicate matching, rollback window, issue-report format, background-processing architecture, and whether an import receipt can re-run the same mapping for a later file.

### 10. Map and interpret CSV

Show:

- filename, detected source, row count, and detected date range;
- every required destination field and its mapped CSV column;
- unmapped, ignored, ambiguous, and unsupported columns;
- a sample source value beside its interpreted value;
- date order, time zone, decimal separator, and units;
- inline validation and a clear route back to change the file.

The mapper must support long and non-English column names, UTF-8 content, locale-aware numbers, and source files with many columns. Mapping changes update the preview but never modify existing records.

### 11. Review and confirm import

Show:

- records ready to import by category;
- attributed date range;
- exact duplicates that will be skipped;
- rows that need attention or will not be imported;
- daily summaries that cannot become food-level records;
- the Unreviewed status and recommendation-evidence consequence;
- the final import action.

No row is imported from this screen until the person confirms. The interface must not use a generic “Continue” label for the final write; use a specific action such as “Import 2,392 records.”

### 12. Import result

Show:

- imported, skipped, and failed row counts;
- source, filename, and completion time;
- whether any issue report is available;
- a route to review the imported date range in Food or Journal;
- a route back to Privacy and data.

A partial import must state exactly what succeeded and what did not. A retry must not create duplicates.

### 13. Export

Show:

- included categories;
- date range;
- export format;
- estimated preparation state;
- destination through the native share or file interface;
- completed, failed, and retry states.

The export includes provenance and correction history where practical. It does not silently omit Premium-originated records after entitlement ends.

Open decisions: exact formats, media bundling, export delivery, and large-export handling.

### 14. Delete account

Use a dedicated destructive flow.

Before confirmation:

- distinguish deleting selected records from deleting the account;
- state which data, subscriptions, shared Meal Templates, Duo relationship, and Apple Health connections are affected;
- explain whether any recovery window exists; do not imply one until approved;
- require recent authentication;
- keep the destructive action visually and spatially separate from safe actions;
- provide an unambiguous cancel path.

The confirmation screen must not use guilt, urgency, or retention pressure.

Open decisions: legal retention, recovery period, subscription cancellation behaviour, shared-object ownership, and deletion completion timing.

## Navigation rules

- The Settings tab always returns to the Settings overview.
- Child screens use a back action labelled Settings.
- Destructive flows do not use bottom-tab navigation while final confirmation is active.
- The CSV import sequence uses a focused native sheet or navigation flow with a visible Cancel or Back action; leaving before final confirmation changes nothing.
- Links to Apple system settings, subscription management, or native share surfaces are clearly labelled as system destinations.
- Journal links can deep-link to plan controls, but Settings does not recreate them.

## Functional requirements

1. Every overview row displays its current state.
2. Unit changes preserve stored values, provenance, and historical meaning.
3. Apple Health categories display granted, limited, denied, or unavailable states.
4. Disconnecting an integration does not silently delete attributed records.
5. Every non-essential assistance and notification category can be disabled independently.
6. Disabling assistance preserves core tracking and history.
7. Premium status reflects the platform entitlement source.
8. Free users can import, export, and delete their data.
9. CSV import shows a complete mapping and preview before writing records.
10. CSV import preserves provenance, original units, missingness, and row-level validation outcomes.
11. CSV import skips exact duplicates by default and never silently overwrites existing records.
12. Imported diary days remain Unreviewed and excluded from quantitative recommendations until reconciled.
13. Retrying a partial or failed import does not duplicate records already imported.
14. Account deletion requires recent authentication and explicit confirmation.
15. Settings never exposes plan creation or recommendation-algorithm reset as a local control.
16. Settings supports VoiceOver, Dynamic Type, reduced motion, and minimum native touch targets.
17. Settings supports locale-aware numbers, dates, time, and unit labels.

## States

Support:

- signed in and signed out;
- Apple private-relay and standard email;
- Free, Premium, Duo, expired, and entitlement-check-failed;
- Apple Health connected, limited, denied, unavailable, syncing, and failed;
- notification permission granted, provisional, denied, and not requested;
- import file selected, detecting, mapping required, ready, importing, partially complete, complete, cancelled, unsupported, malformed, too large, permission denied, and failed;
- export preparing, ready, failed, expired, and cancelled;
- deletion authentication required, processing, failed, and complete.

## Success measures

Track:

- completion of unit and integration changes;
- notification opt-in and category disable rates;
- assistance-control changes and reversals;
- import starts, mapping corrections, confirmation, completion, partial failure, duplicate rate, time to readiness, and imported-date reconciliation;
- export starts, completion, failure, and time to readiness;
- deletion starts, cancellations, authentication failures, and completion;
- entitlement restore success;
- support contacts caused by unclear ownership or missing controls.

Do not optimise Settings for Premium conversion at the cost of control discoverability.

## Open product decisions

- Final Settings label and icon.
- System-only versus manual locale and first-day-of-week controls.
- Apple Health write permissions and imported-record deletion.
- Notification defaults, schedules, quiet hours, and learned meal timing.
- Exact visibility and assistance-control catalogue.
- Food-personalization reset scope.
- Regional Premium pricing, trials, billing copy, and entitlement-failure handling.
- CSV launch categories, source presets, formats, limits, duplicate matching, rollback, and original-file retention.
- Export formats, media packaging, and delivery.
- Voice transcript retention and deletion.
- Account-deletion recovery, legal retention, subscription handling, and shared-object ownership.

## Dependencies

- [Living PRD v0.2](calorie-app-prd-v0.2.md)
- [Weekly Check-in PRD v0.1](weekly-check-in-prd-v0.1.md)
- [Initial Nutrition Recommendation Algorithm v0.1](recommendation-algorithm-v0.1.md)
- [Today, Food, Journal, and Settings wireframes](../design/wireframes/home.html#settings)