Calm by default

The Contextual Notification Sieve

Intercepting the noise, distilling what can wait into calm digests, and escalating only what genuinely matters — decided by your real-world context, not each app’s engagement metric

Notifications rarely overwhelm us all at once. They accumulate quietly — a promo here, an app ping there, a cryptic airline alert or a one-line fraud notice buried between two marketing blasts. By the time the genuinely urgent thing arrives, attention is already spent and the important note gets missed. Sieve intercepts the stream, rewrites the cryptic alert into one plain-language decision, and lets context decide what reaches you and when — a delayed connection or a card tested 8,800 miles away breaks through; ninety-one percent of the day’s noise never interrupts you at all. And every decision is inspectable: you can always see exactly why something surfaced, and the final say stays yours.

Fully interactive — run the whole flow: Now → an escalation (travel, a frozen card, or a health rhythm flag) → the “why this surfaced” panel → the reachability dial → the nightly digest, plus Intentions, Review, the honest onboarding, Day 1, and the lock-screen edge. The screen-jumper bar at the top spans the full width and the phone itself stays centered. Live notification interception is simulated here; see the feasibility note below for what an MVP can legitimately ingest.

The firehose, and the sieve

The problem was never a single ping. It’s the volume forming behind it — and the fact that each app decides on its own when to interrupt you, optimising for its engagement, not your attention.

One promo is easy to ignore. Eighty notifications across a working afternoon is not. Sieve sits in front of the stream and runs one loop on everything: intercept → distill → escalate. It reads your mode, calendar, and location, silences the engagement bait, holds what can wait for a calm digest, and surfaces only what crosses the bar. The first design decision was to make context the arbiter — not each app’s notion of “important” — so on a focused day roughly 91% of the noise never interrupts you at all, and the decision behind every one is inspectable.

The firehose · what most phones do

Interruptions today 80

Every app decides for itself. Promos, social pings and the one alert that actually mattered all arrive the same way, at full volume, all day. By the time it matters, your attention is already spent.

The sieve · what Sieve does

Reached you in real time 2
71 held ~2h protected 91% held

Two things crossed the bar; both mattered. Everything else waited for a moment you chose — with the “why” one tap away.

The same day, two ways. Sieve doesn’t hide notifications — it changes who decides when they reach you.

Screen 1 · A home screen that says “one thing needs you”

The calm state is the default, not the reward. Now leads with the single thing that actually crossed the bar — and reframes everything it held as time you got back.

Most notification UIs open on a backlog. Sieve opens on a sentence: one thing needs you. Below it sits exactly one live escalation and a reassurance strip that states what was held — “71 held · ~2h of focus protected” — as something gained, never as a guilt-inducing unread count. Why this is the best choice: the home screen sets the emotional default of the whole product, and a calm default is the entire promise made visible. The benefit: you glance, you see the one decision, and you put the phone down.

Good evening, David

One thing needs you.

Time-critical Rewritten by Sieve

You’ll miss your connection.

Your 16:05 flight is delayed 45 min. After landing you’d reach the LAX gate about 15 minutes too late to board.

UA2419 → LAX Affects tonight Rebookable, $0
Everything else is handled. Sieve quietly held 71 notifications so they didn’t break your focus — about 2 hours of focus protected today.

A specimen of the Now home — in the live prototype the card opens the full escalation, and the strip peeks into the day’s held items.

Screen 2 · Rewrite the alert — and show exactly why it surfaced

The signature move: take a cryptic, machine-voiced ping and turn it into one plain-language decision, the few facts you need, three prepared actions, and the reasoning behind the interruption — all on one screen.

The raw alert just said “Flight Update: UA2419.” Sieve read it, cross-referenced your calendar and booked connection, and worked out what it means: a 45-minute delay puts you at the gate after boarding closes. It states the decision, lays out land / connect / short-by as a fact grid, and prepares three one-tap actions — each previewing its full effect before anything happens. Then it opens its reasoning: an 88% confidence, the four signals it used, and a note on what it held in the same window. Why this is the best choice: an escalation people can’t verify is just a louder notification; legibility is what earns the right to interrupt. The benefit: you act in seconds, and nothing was booked on your behalf — the final call stays yours.

Time-critical United · rewritten by Sieve

You’ll miss your connection by ~15 min.

The original ping just said “Flight Update: UA2419.” Sieve read it, checked your calendar and booked connection, and worked out what it actually means: a 45-minute delay puts you at the LAX gate after boarding closes.

Land
18:20
Connection
18:35
Short by
15 min
Rebook the later connection19:50 → LAX · same fare, $0 · seat 14C held for 10 min
Tell the hotel you’re latePre-written: arriving ~21:30, hold the room
Snooze & re-check the gateSieve watches live gate data, pings you only if it changes
Why Sieve surfaced this
88% sure
It changes a plan already on your calendar within the next 6 hours.
You’re in transit — there’s a real, time-boxed decision to make.
It’s irreversible if ignored — miss the gate and the option is gone.
This class breaks through even in Deep Work. Almost nothing else does.
In the same window Sieve held back 41 promos, 9 social pings, and 4 delivery updates. None met the bar — they’re waiting in tonight’s digest. Nothing was booked on your behalf; the decision stays yours.

A specimen of the escalation detail — the “Why” panel is a tap-to-expand disclosure in the live prototype, shown open here so you can read it in full.

Screen 3 · The same pattern, proven on money & security

A model that only worked for flights wouldn’t be a model. The second archetype runs the identical loop on a fraud alert — and money & account security are the one class that always breaks through, even Deep Work.

The bank’s alert just said “AUTH declined ref 5XK9.” Sieve read it, checked where your phone had been all evening, and saw the shape of it: a $0.79 test charge cleared, then a $2,310 attempt declined, minutes apart, 8,800 miles away — the classic card-testing pattern. Same plain-language rewrite, same fact grid, same three prepared actions (freeze, “it was me,” show both charges), same inspectable reasoning at 94% sure. Why this is the best choice: generality is the proof the concept isn’t a single clever demo. The benefit: the highest-stakes alerts get the most legible treatment — and still nothing is frozen or paid on your behalf.

Security · time-critical Chase · rewritten by Sieve

Someone tried your card 8,800 miles away.

The bank’s alert just said “AUTH declined ref 5XK9.” Sieve saw a $0.79 test charge clear, then a $2,310 attempt declined — minutes apart, in Jakarta. That’s how a stolen number gets tested. The next attempt might not be declined.

Test charge
$0.79 ok
Then tried
$2,310
Distance
8.8k mi
Freeze the card nowInstant · subscriptions keep working · unfreeze in a tap
It was me — approve itUnlikely from here, but you have the final say — and Sieve learns
Show me both chargesThe $0.79 test and the $2,310 attempt — merchant, time, place
Why Sieve surfaced this
94% sure
The card was used 8,800 miles from your phone, minutes apart — physically impossible.
A tiny test charge, then a large one — the classic card-testing pattern.
About 30× your usual spend, at a merchant you’ve never touched.
Money & account security always break through — even Deep Work.
This is the one bank alert Sieve raised all week. It quietly held three routine ones — they matched your normal pattern, so they waited in the digest. Nothing was frozen or paid on your behalf; the decision stays yours.

A specimen of the money archetype — in the prototype, resolving the flight triggers this as a live second intercept, proving the pipeline generalises across domains.

Screen 13 · The third archetype — health, handled with restraint

A third-party app can read Apple Health / HealthKit with permission, so this is a channel Sieve can legitimately ingest. The discipline is in how: amber not red, a pattern not a single reading, and a flag to look at — never a diagnosis.

The watch’s own alert just said “Irregular rhythm detected.” On its own Sieve would have held that — one reading is noisy. But this is the second flag in 8 days, both at rest, with resting heart rate drifting up from your own baseline — a pattern over time, and that’s what crosses the bar. Two telling design choices: confidence is shown lower (76%) on purpose, because honest uncertainty matters most here; and Sieve is deliberately quicker to surface, because missing a real cardiac pattern is the kind of mistake that’s hard to take back. Why this is the best choice: health is where overclaiming does real harm, so the product leans into calm and routes to actual care. The benefit: it brings forward the one pattern worth a look, holds 80+ everyday nudges, and never pretends to be a doctor.

Health · worth a look Apple Health · rewritten by Sieve

Your watch flagged an irregular rhythm — twice.

On its own Sieve would have held a single reading. But this is the second flag in 8 days, both while resting, and your resting heart rate has been drifting up from your baseline. A repeat pattern is worth a look — so Sieve brought it forward.

Flags
2 in 8d
Both
at rest
Resting HR
+9 vs you
Record an ECG nowWhile you can still feel it — ~30s, saved to Health. Best captured during a flag.
Prepare a summary for your doctor8 days — both flags, resting HR, sleep — on one page. You decide whether to send it.
Log how you’re feelingFluttering, lightheaded, or fine? 30s of context helps Sieve read the next one.
This is a flag, not an emergency. But if you also feel chest pain, fainting, or real shortness of breath, don’t wait on an app — treat it as urgent and get medical help now.
Why Sieve surfaced this
76% worth attention
It’s the second flag in 8 days. A single one Sieve would hold — a repeat is a pattern, and that crosses the bar.
Both happened at rest, not mid-workout — when an irregular reading carries more weight.
Your resting heart rate has drifted up from your own 60-day baseline.
A repeating health pattern breaks through even in Deep Work — everyday rings and reminders never do.
Sieve is deliberately quicker to surface here — missing a real cardiac pattern is hard to take back, so it accepts the odd false alarm over the miss. In the same 8 days it quietly held 80+ health nudges — ring closures, stand reminders, step goals. This is a flag to look at, not a diagnosis.

Sieve surfaces patterns in data your devices already collect. It doesn’t diagnose, and it isn’t a substitute for medical care.

A specimen of the health archetype — amber throughout, never red. The whole point is a serious signal delivered without alarm.

Screen 4 · A dial for how reachable you are — not an on/off switch

Do-not-disturb is binary and blunt. Real life has gradients: fully open, loosely in the loop, present at dinner, deep in focus. The dial makes the precision/recall trade-off tangible and lets you set it by feel.

Slide from Open → Casual → Family Dinner → Deep Work and the bar rises with you; Sieve re-sorts everything live. Deep Work holds ~96% and lets only account security and time-critical travel through; Family Dinner protects the table and saves the rest for one digest at 21:00. Why this is the best choice: a single mute teaches people to turn protection off entirely, because it’s all-or-nothing — a dial lets them keep some reachability without opening the floodgates. The benefit: the model bends to the moment, and the dial only ever moves the bar — never who has the final say. That stays you.

Deep Work
Highest bar · holds ~96% · only security & time-critical travel break through
OpenCasualDinnerDeep
🎧
Deep Work Now
When you need uninterrupted focus and can review the rest later. Lets through: account security · time-critical travel · your 5 closest people.
🍽️
Family Dinner
You’re present with people; only true emergencies should reach you. Lets through: security alerts · your inner circle. One digest lands at 21:00.

A specimen of the reachability dial — the slider is live in the prototype and re-sorts the whole surface as you move it; two of four modes shown here.

Screen 5 · Closing the loop with one calm read

A held notification must never feel lost. It returns as an editorialized story you can triage in place — never as 68 separate badges demanding 68 separate taps.

“While you were at dinner” collapses 68 held pings into one card: three stores dropped prices on things in your cart, the 09:00 standup moved to 09:30, four people reacted to your post, a parcel arrived, two Slack threads resolved without you. Most clear automatically; a couple are flagged needs you. Why this is the best choice: the value of a filter isn’t in hiding things — it’s in returning them well, on your schedule. The benefit: one scannable timeline replaces a chaotic stream, and each line expands to act on inline without opening three apps.

While you were at dinner

68 notifications, distilled into one calm read · Family Dinner 19:00–21:00 · 66 cleared on their own, 2 still want you.

Shopping
3 stores dropped prices on things in your cart
Needs you
Calendar
Tomorrow’s 09:00 standup moved to 09:30
Needs you
Social
4 people reacted to your post — no direct messages
Delivery
Your parcel arrived at the front door, 19:42
Work
2 Slack threads — both resolved without you

A specimen of the digest — each line is an expandable drawer in the prototype (the price-drops row opens an inline price table you can act on without leaving).

Screen 6 · A quiet record — accountability, not a scoreboard

You should never have to check this. Activity exists for the day you wonder what Sieve has been doing in the background — and it’s built to be honest about its misses, not to gamify your attention.

It shows where the day’s 80 notifications went — 68 held, 6 surfaced, 2 escalated — and reframes it as “~2 hours of focus protected; two things reached you all day, and both mattered.” Crucially there are no streaks, no rings, no “you missed 12 things.” Why this is the best choice: any attention tool that rewards engagement quietly becomes the thing it was meant to cure. The benefit: a calm ledger you can trust precisely because it isn’t trying to pull you back in — and when Sieve gets a call wrong, that shows here too, so you can correct it.

~2 hrs

of focus protected today — 91% of the noise never reached you

Where today’s 80 notifications went

Held calmly
68
Surfaced
6
Escalated
2
Two things reached you all day. Both mattered. Everything else waited for a moment you chose. When Sieve holds something it shouldn’t, you tell it once — and it adjusts.

A specimen of Activity — deliberately the dullest screen in the app. No streaks. No badges. Just a record.

Screen 7 · The trust model is a first-class screen, not a setting

Sieve will get calls wrong. The product’s credibility rests on what happens next: every correction becomes a small, legible lesson you can see, locate, and undo in one tap.

“Learned” is the record of every time you corrected Sieve — what it now does differently, where that applies, and a way to take any of it back. Tell it a held charge should’ve asked you, and it shows the new rule (“ask me before charges over $10 from a merchant I’ve never used”), exactly which modes and apps it touches, and an Undo. Why this is the best choice: an AI that learns silently is impossible to trust, because you can’t tell what it believes about you. The benefit: Sieve becomes a judge you advise, not a black box — and the moment a lesson stops feeling right, it’s gone.

3 small lessons. That’s all Sieve is holding onto.

Ask me before charges over $10 from a merchant I’ve never used.
You taught this from a held charge · just now
Even in Deep Work Even at Dinner This card New merchants only
Active across all 4 modes Undo

A specimen of one lesson — the prototype holds three, each with its own Undo, and the count stays honest as you remove them.

Screen 12 · The other half of trust — a few things, up front

Learned is what Sieve picks up by being corrected. Intentions is the proactive complement: standing wishes you can state before it has to guess — each a bias on judgment, never a rule that switches Sieve off.

Every wish has a three-stop strength dial — Nudge → Strong → hard line — and a live preview that shows the same message getting a different verdict at each setting, so you can see judgment still operating below the hard line. Pull the hard line and Sieve states the honest cost in the same breath (amber + a lock): you’ll get the “👍” too. A quiet guardrail caps the list at three or four, because more than that is just the per-app settings sprawl Sieve exists to replace. Why this is the best choice: people want to express priorities without micromanaging — a dial of intent beats a wall of toggles. The benefit: Sieve becomes a judge you advise, and even a hard line stays visible to soften or undo in a tap.

Three or four is usually plenty. Pin more and you’re rebuilding settings sprawl. These bias what Sieve does — they don’t turn it into a rulebook you maintain.
Almost always let Maya through.
Sieve learned a softer version from a call you missed · Tuesday
How strongly?
Sieve breaks in for Maya unless it reads as pure noise.
What that means, live
Maya: “lunch later this week?” Through
Never hold a money or security alert.
Builds on the new-merchant lesson Sieve learned on its own
How strongly?
A hard line — you’ll occasionally get a false alarm on a legitimate charge. For money, you’ve decided certainty is worth it.

A specimen of two wishes — the dial is live in the prototype; moving it rewrites the rule, the cost, and the preview verdict together. The hard line always shows its cost.

Screen 10 · The ambiguous middle, shown from both directions

The obvious calls Sieve makes silently. Review surfaces only the genuinely close ones — and crucially, it shows both kinds of mistake: something it held that maybe shouldn’t have, and something it interrupted you for that maybe could have waited.

A text from Sam with a “need to know tonight” deadline got held because Sam isn’t in your inner circle — Sieve is only 58% sure it read that right. A wishlist item came back in stock and Sieve pinged you, but nothing about it was time-critical — only 52% sure it was worth the interrupt. Each gets a one-line confirm or correct, and the lesson is shown already in effect. Why this is the best choice: most systems only ever expose false holds (things you missed); surfacing false surfaces too is what makes the bar honestly yours. The benefit: owning the close calls — in both directions — is how Sieve earns the right to keep deciding.

I held this
A text from Sam, during dinner.

“Hey — still good for Saturday? need to know tonight.” Sam isn’t in your inner circle, so I held it until the digest. But it had a deadline in it.

58% sure I was right
Held because: not inner circle · Family Dinner mode. Hesitated because: a direct question with a tonight deadline.
You read it right Should’ve asked me
I interrupted you
A wishlist item came back in stock.

You’d checked the Aer travel pack three times, so I guessed you’d want to know the moment it returned — and pinged you at 4:12pm. But it wasn’t urgent, and it pulled you out of focus.

52% sure it was worth it
Surfaced because: strong repeated interest. Hesitated because: nothing about it was time-critical — it could have waited for the digest.
Glad you told me That could’ve waited

A specimen of Review — in the prototype each card resolves in place and shows the lesson taking effect immediately.

Screen 8 · Onboarding that tells the truth about access

To catch a flight delay or a fraud attempt, Sieve reads a few things. The permission step says exactly what each source does, what it never does, and whether it’s processed on-device or privately in the cloud — and every source is optional.

Each row is a small contract: what Sieve sees, what it can’t (“never reads full conversations,” “can’t move money,” “never sends mail on your behalf”), and a clear on-device vs. processed-privately label. The count even stays honest about consequences — turn Email off and it tells you the two demos are still covered. Why this is the best choice: a calm attention layer that quietly over-reaches would betray its own premise; consent has to be legible to be real. The benefit: you connect only what you’re comfortable with, Sieve still works with less, and nothing about the ask is buried.

What Sieve gets to see

Most of this runs on your device. Tap any source off — Sieve still works, just with less context.

Messages & calls On device
Reads who’s reaching you and previews, to spot what’s genuinely time-sensitive.
Never reads full conversations. Never replies for you.
Bank & card alerts On device
Reads alert text to catch fraud patterns — like the card-test then big-charge sequence.
Never sees your balance or statements. Can’t move money.
Health (HealthKit) On device
Reads rhythm flags and resting-HR trends, to spot a repeating pattern worth a look.
Never diagnoses. Never shares health data without you sending it.
Email Processed privately
Triages your inbox so only genuinely-needs-you mail surfaces — the rest folds into the digest.
Never reads marketing. Never sends mail on your behalf.

5 of 6 sources connected — the demos are covered.

Every source is optional and revocable in a tap. Sieve only gets more useful with more context — but you stay in control of how much it has, always.

A specimen of the permission step — four of six sources shown; each toggle is live in the prototype and the connected-count updates honestly as you flip them.

Screen 11 · Day one, before Sieve has learned anything

Cold-start is where most “smart” products quietly fail — they pretend to know you on day one. Sieve does the opposite: it says it doesn’t know your patterns yet, leans toward showing a little more, and asks when it’s unsure.

Now opens on “Day one together,” a calibration meter that reads just starting, and an honest banner: “I’ll show a little more and ask when I’m unsure this week — then quiet down.” Underneath sits the day-one prior it leans on before learning anything — your inner circle, security, and time-critical travel always reach you — plus a couple of items it’s openly unsure about, each with a one-tap “worth showing you?” rating. Why this is the best choice: trust is won fastest by being upfront about what you don’t yet know. The benefit: two taps today save a hundred interruptions next month — and it’s the only time Sieve asks for more than it gives.

Good morning, David

Day one together.

Still learning your bar

I don’t know your patterns yet, so I’ll show a little more and ask when I’m unsure this week — then quiet down.

How well I know youjust starting
Until I learn, these still always reach you
Maya & Dad — your inner circle.
Security & time-critical travel — always.
A Slack mention from your manager
“When you get a sec — thoughts on the deck?” Not urgent, but it’s your manager and I don’t know your work rhythm yet, so I showed it.
Worth showing you? Yes, keep these Could’ve waited

A specimen of Day 1 — in the prototype the calibration meter fills as you rate items, and the “asks a lot → mostly quiet” curve is shown in onboarding.

The honest part: what ships, and how it’s judged

The concept’s credibility — and its moat — is in refusing to overclaim. Two things stay honest on purpose: what’s technically buildable today, and how success is measured.

On iOS, a third-party app can’t intercept other apps’ notifications, so the universal interceptor in this prototype is the 3-year vision, not the v1. The shippable MVP is narrower and real: a calm command layer over the channels you can legitimately ingest — email, bank, calendar, travel, and HealthKit — orchestrated with the OS’s own Focus modes. Android’s NotificationListenerService gets materially closer to the full vision. And the metrics deliberately refuse vanity engagement: never DAU, never session length, never streaks or rings. Instead Sieve counts its own mistakes.

What an MVP can legitimately ingest

Email, bank, calendar, travel & HealthKit — channels you authorise, source by source.
OS Focus orchestration for the modes Sieve can’t legally read.
Android’s NotificationListenerService gets closer to the universal interceptor.
The universal sieve is the destination. The MVP is the honest first mile — and it says so, in the onboarding, source by source.

Metrics that count mistakes, not minutes

False-surface rate — how often Sieve interrupted you for something that didn’t deserve it.
False-hold rate — how often it held something that should’ve reached you.
Correction-rate decay — are you having to correct it less over time?
A hard catastrophic-miss ceiling — the one number that can’t move.
No DAU. No session length. No streaks. An attention tool that optimised for engagement would quietly become the thing it set out to cure.

Screens 9 & 14 · The edge of the system — what intercept feels like

Most of what Sieve does happens before the app is ever opened — at the OS edge, on the lock screen and in the Dynamic Island — and in the one sense a phone has that a screen doesn’t: touch. Both are governed by one rule: spend the person’s attention only when something crossed the bar.

The lock screen is a small state machine — calm, travel, security, health — and the Island morphs to reflect whatever’s live, or stays idle when nothing is. Two choices define it. First, the Island is the one element that’s always dark, matching the hardware it lives in. Second, swiping a Sieve alert away doesn’t delete it — it holds it for the digest, with the faintest possible haptic, deliberately softer than a delete, because nothing was lost. That sensory restraint is the whole product in miniature: a calm phone’s most important decision is when not to buzz.

Card frozen
Thursday, June 5
9:41
Card tried 8,800 mi away
Sieve · tap to freeze or see both charges
Rhythm flag — worth a look
Sieve · 2nd in 8 days
swipe → holds
Nothing else needs you
Sieve held 71 · ~2h protected

A specimen of the lock-screen state machine — Sieve’s one always-dark surface. Dismiss is hold, never delete.

The moments that earn a touch

The intercept lands · soft rising double-tap
The rare moment Sieve surfaces the one thing that matters — the most present feedback in the whole system. It never escalates past this.
The orb settles · single fading tap
You handled it; Now breathes back to calm. A gentle tap that recedes like an exhale — not a reward for doing it.
Dismiss-as-hold · the faintest tick
You swipe a lock-screen pill away. The quietest signal in the set, softer than a delete would feel — it’s set aside, not gone.
Breaking through Deep Work · firm, patient triple-pulse
Money or time-critical travel crossing a bar you set high. A touch more insistent — but still warm, never shrill or fast.

A specimen of the haptic vocabulary — in the prototype each row plays a drawn ripple (and optional sound) so you can feel where feedback fires.

Explore more work

More explorations from the AI Product Design Lab — each a different facet of making AI products people can direct, verify, supervise, and trust.

steer exploration cover
Steer — intent before generation

Turn an under-specified prompt into a negotiated brief: the model surfaces what it inferred and flags ambiguity before it commits.

View exploration
ground exploration cover
Ground — verify what AI claims

Every claim traceable to a source with confidence and freshness; unsupported claims flagged; source conflicts shown, not smoothed over.

View exploration
recall exploration cover
Recall — legible AI memory

A memory layer you can see, attribute, edit, scope, and revoke — personalization as a negotiated, inspectable thing, not a black box.

View exploration