The Contextual Notification Sieve
Intercepting the noise, distilling what can wait into calm digests, and escalating only what genuinely matters — decided by your real-world context, not each app’s engagement metric
Notifications rarely overwhelm us all at once. They accumulate quietly — a promo here, an app ping there, a cryptic airline alert or a one-line fraud notice buried between two marketing blasts. By the time the genuinely urgent thing arrives, attention is already spent and the important note gets missed. Sieve intercepts the stream, rewrites the cryptic alert into one plain-language decision, and lets context decide what reaches you and when — a delayed connection or a card tested 8,800 miles away breaks through; ninety-one percent of the day’s noise never interrupts you at all. And every decision is inspectable: you can always see exactly why something surfaced, and the final say stays yours.
Fully interactive — run the whole flow: Now → an escalation (travel, a frozen card, or a health rhythm flag) → the “why this surfaced” panel → the reachability dial → the nightly digest, plus Intentions, Review, the honest onboarding, Day 1, and the lock-screen edge. The screen-jumper bar at the top spans the full width and the phone itself stays centered. Live notification interception is simulated here; see the feasibility note below for what an MVP can legitimately ingest.
The firehose, and the sieve
The problem was never a single ping. It’s the volume forming behind it — and the fact that each app decides on its own when to interrupt you, optimising for its engagement, not your attention.
One promo is easy to ignore. Eighty notifications across a working afternoon is not. Sieve sits in front of the stream and runs one loop on everything: intercept → distill → escalate. It reads your mode, calendar, and location, silences the engagement bait, holds what can wait for a calm digest, and surfaces only what crosses the bar. The first design decision was to make context the arbiter — not each app’s notion of “important” — so on a focused day roughly 91% of the noise never interrupts you at all, and the decision behind every one is inspectable.
The firehose · what most phones do
Every app decides for itself. Promos, social pings and the one alert that actually mattered all arrive the same way, at full volume, all day. By the time it matters, your attention is already spent.
The sieve · what Sieve does
Two things crossed the bar; both mattered. Everything else waited for a moment you chose — with the “why” one tap away.
The same day, two ways. Sieve doesn’t hide notifications — it changes who decides when they reach you.
Screen 1 · A home screen that says “one thing needs you”
The calm state is the default, not the reward. Now leads with the single thing that actually crossed the bar — and reframes everything it held as time you got back.
Most notification UIs open on a backlog. Sieve opens on a sentence: one thing needs you. Below it sits exactly one live escalation and a reassurance strip that states what was held — “71 held · ~2h of focus protected” — as something gained, never as a guilt-inducing unread count. Why this is the best choice: the home screen sets the emotional default of the whole product, and a calm default is the entire promise made visible. The benefit: you glance, you see the one decision, and you put the phone down.
Good evening, David
One thing needs you.
You’ll miss your connection.
Your 16:05 flight is delayed 45 min. After landing you’d reach the LAX gate about 15 minutes too late to board.
A specimen of the Now home — in the live prototype the card opens the full escalation, and the strip peeks into the day’s held items.
Screen 2 · Rewrite the alert — and show exactly why it surfaced
The signature move: take a cryptic, machine-voiced ping and turn it into one plain-language decision, the few facts you need, three prepared actions, and the reasoning behind the interruption — all on one screen.
The raw alert just said “Flight Update: UA2419.” Sieve read it, cross-referenced your calendar and booked connection, and worked out what it means: a 45-minute delay puts you at the gate after boarding closes. It states the decision, lays out land / connect / short-by as a fact grid, and prepares three one-tap actions — each previewing its full effect before anything happens. Then it opens its reasoning: an 88% confidence, the four signals it used, and a note on what it held in the same window. Why this is the best choice: an escalation people can’t verify is just a louder notification; legibility is what earns the right to interrupt. The benefit: you act in seconds, and nothing was booked on your behalf — the final call stays yours.
You’ll miss your connection by ~15 min.
The original ping just said “Flight Update: UA2419.” Sieve read it, checked your calendar and booked connection, and worked out what it actually means: a 45-minute delay puts you at the LAX gate after boarding closes.
A specimen of the escalation detail — the “Why” panel is a tap-to-expand disclosure in the live prototype, shown open here so you can read it in full.
Screen 3 · The same pattern, proven on money & security
A model that only worked for flights wouldn’t be a model. The second archetype runs the identical loop on a fraud alert — and money & account security are the one class that always breaks through, even Deep Work.
The bank’s alert just said “AUTH declined ref 5XK9.” Sieve read it, checked where your phone had been all evening, and saw the shape of it: a $0.79 test charge cleared, then a $2,310 attempt declined, minutes apart, 8,800 miles away — the classic card-testing pattern. Same plain-language rewrite, same fact grid, same three prepared actions (freeze, “it was me,” show both charges), same inspectable reasoning at 94% sure. Why this is the best choice: generality is the proof the concept isn’t a single clever demo. The benefit: the highest-stakes alerts get the most legible treatment — and still nothing is frozen or paid on your behalf.
Someone tried your card 8,800 miles away.
The bank’s alert just said “AUTH declined ref 5XK9.” Sieve saw a $0.79 test charge clear, then a $2,310 attempt declined — minutes apart, in Jakarta. That’s how a stolen number gets tested. The next attempt might not be declined.
A specimen of the money archetype — in the prototype, resolving the flight triggers this as a live second intercept, proving the pipeline generalises across domains.
Screen 13 · The third archetype — health, handled with restraint
A third-party app can read Apple Health / HealthKit with permission, so this is a channel Sieve can legitimately ingest. The discipline is in how: amber not red, a pattern not a single reading, and a flag to look at — never a diagnosis.
The watch’s own alert just said “Irregular rhythm detected.” On its own Sieve would have held that — one reading is noisy. But this is the second flag in 8 days, both at rest, with resting heart rate drifting up from your own baseline — a pattern over time, and that’s what crosses the bar. Two telling design choices: confidence is shown lower (76%) on purpose, because honest uncertainty matters most here; and Sieve is deliberately quicker to surface, because missing a real cardiac pattern is the kind of mistake that’s hard to take back. Why this is the best choice: health is where overclaiming does real harm, so the product leans into calm and routes to actual care. The benefit: it brings forward the one pattern worth a look, holds 80+ everyday nudges, and never pretends to be a doctor.
Your watch flagged an irregular rhythm — twice.
On its own Sieve would have held a single reading. But this is the second flag in 8 days, both while resting, and your resting heart rate has been drifting up from your baseline. A repeat pattern is worth a look — so Sieve brought it forward.
Sieve surfaces patterns in data your devices already collect. It doesn’t diagnose, and it isn’t a substitute for medical care.
A specimen of the health archetype — amber throughout, never red. The whole point is a serious signal delivered without alarm.
Screen 4 · A dial for how reachable you are — not an on/off switch
Do-not-disturb is binary and blunt. Real life has gradients: fully open, loosely in the loop, present at dinner, deep in focus. The dial makes the precision/recall trade-off tangible and lets you set it by feel.
Slide from Open → Casual → Family Dinner → Deep Work and the bar rises with you; Sieve re-sorts everything live. Deep Work holds ~96% and lets only account security and time-critical travel through; Family Dinner protects the table and saves the rest for one digest at 21:00. Why this is the best choice: a single mute teaches people to turn protection off entirely, because it’s all-or-nothing — a dial lets them keep some reachability without opening the floodgates. The benefit: the model bends to the moment, and the dial only ever moves the bar — never who has the final say. That stays you.
A specimen of the reachability dial — the slider is live in the prototype and re-sorts the whole surface as you move it; two of four modes shown here.
Screen 5 · Closing the loop with one calm read
A held notification must never feel lost. It returns as an editorialized story you can triage in place — never as 68 separate badges demanding 68 separate taps.
“While you were at dinner” collapses 68 held pings into one card: three stores dropped prices on things in your cart, the 09:00 standup moved to 09:30, four people reacted to your post, a parcel arrived, two Slack threads resolved without you. Most clear automatically; a couple are flagged needs you. Why this is the best choice: the value of a filter isn’t in hiding things — it’s in returning them well, on your schedule. The benefit: one scannable timeline replaces a chaotic stream, and each line expands to act on inline without opening three apps.
While you were at dinner
68 notifications, distilled into one calm read · Family Dinner 19:00–21:00 · 66 cleared on their own, 2 still want you.
A specimen of the digest — each line is an expandable drawer in the prototype (the price-drops row opens an inline price table you can act on without leaving).
Screen 6 · A quiet record — accountability, not a scoreboard
You should never have to check this. Activity exists for the day you wonder what Sieve has been doing in the background — and it’s built to be honest about its misses, not to gamify your attention.
It shows where the day’s 80 notifications went — 68 held, 6 surfaced, 2 escalated — and reframes it as “~2 hours of focus protected; two things reached you all day, and both mattered.” Crucially there are no streaks, no rings, no “you missed 12 things.” Why this is the best choice: any attention tool that rewards engagement quietly becomes the thing it was meant to cure. The benefit: a calm ledger you can trust precisely because it isn’t trying to pull you back in — and when Sieve gets a call wrong, that shows here too, so you can correct it.
of focus protected today — 91% of the noise never reached you
Where today’s 80 notifications went
A specimen of Activity — deliberately the dullest screen in the app. No streaks. No badges. Just a record.
Screen 7 · The trust model is a first-class screen, not a setting
Sieve will get calls wrong. The product’s credibility rests on what happens next: every correction becomes a small, legible lesson you can see, locate, and undo in one tap.
“Learned” is the record of every time you corrected Sieve — what it now does differently, where that applies, and a way to take any of it back. Tell it a held charge should’ve asked you, and it shows the new rule (“ask me before charges over $10 from a merchant I’ve never used”), exactly which modes and apps it touches, and an Undo. Why this is the best choice: an AI that learns silently is impossible to trust, because you can’t tell what it believes about you. The benefit: Sieve becomes a judge you advise, not a black box — and the moment a lesson stops feeling right, it’s gone.
3 small lessons. That’s all Sieve is holding onto.
A specimen of one lesson — the prototype holds three, each with its own Undo, and the count stays honest as you remove them.
Screen 12 · The other half of trust — a few things, up front
Learned is what Sieve picks up by being corrected. Intentions is the proactive complement: standing wishes you can state before it has to guess — each a bias on judgment, never a rule that switches Sieve off.
Every wish has a three-stop strength dial — Nudge → Strong → hard line — and a live preview that shows the same message getting a different verdict at each setting, so you can see judgment still operating below the hard line. Pull the hard line and Sieve states the honest cost in the same breath (amber + a lock): you’ll get the “👍” too. A quiet guardrail caps the list at three or four, because more than that is just the per-app settings sprawl Sieve exists to replace. Why this is the best choice: people want to express priorities without micromanaging — a dial of intent beats a wall of toggles. The benefit: Sieve becomes a judge you advise, and even a hard line stays visible to soften or undo in a tap.
A specimen of two wishes — the dial is live in the prototype; moving it rewrites the rule, the cost, and the preview verdict together. The hard line always shows its cost.
Screen 10 · The ambiguous middle, shown from both directions
The obvious calls Sieve makes silently. Review surfaces only the genuinely close ones — and crucially, it shows both kinds of mistake: something it held that maybe shouldn’t have, and something it interrupted you for that maybe could have waited.
A text from Sam with a “need to know tonight” deadline got held because Sam isn’t in your inner circle — Sieve is only 58% sure it read that right. A wishlist item came back in stock and Sieve pinged you, but nothing about it was time-critical — only 52% sure it was worth the interrupt. Each gets a one-line confirm or correct, and the lesson is shown already in effect. Why this is the best choice: most systems only ever expose false holds (things you missed); surfacing false surfaces too is what makes the bar honestly yours. The benefit: owning the close calls — in both directions — is how Sieve earns the right to keep deciding.
“Hey — still good for Saturday? need to know tonight.” Sam isn’t in your inner circle, so I held it until the digest. But it had a deadline in it.
You’d checked the Aer travel pack three times, so I guessed you’d want to know the moment it returned — and pinged you at 4:12pm. But it wasn’t urgent, and it pulled you out of focus.
A specimen of Review — in the prototype each card resolves in place and shows the lesson taking effect immediately.
Screen 8 · Onboarding that tells the truth about access
To catch a flight delay or a fraud attempt, Sieve reads a few things. The permission step says exactly what each source does, what it never does, and whether it’s processed on-device or privately in the cloud — and every source is optional.
Each row is a small contract: what Sieve sees, what it can’t (“never reads full conversations,” “can’t move money,” “never sends mail on your behalf”), and a clear on-device vs. processed-privately label. The count even stays honest about consequences — turn Email off and it tells you the two demos are still covered. Why this is the best choice: a calm attention layer that quietly over-reaches would betray its own premise; consent has to be legible to be real. The benefit: you connect only what you’re comfortable with, Sieve still works with less, and nothing about the ask is buried.
What Sieve gets to see
Most of this runs on your device. Tap any source off — Sieve still works, just with less context.
5 of 6 sources connected — the demos are covered.
A specimen of the permission step — four of six sources shown; each toggle is live in the prototype and the connected-count updates honestly as you flip them.
Screen 11 · Day one, before Sieve has learned anything
Cold-start is where most “smart” products quietly fail — they pretend to know you on day one. Sieve does the opposite: it says it doesn’t know your patterns yet, leans toward showing a little more, and asks when it’s unsure.
Now opens on “Day one together,” a calibration meter that reads just starting, and an honest banner: “I’ll show a little more and ask when I’m unsure this week — then quiet down.” Underneath sits the day-one prior it leans on before learning anything — your inner circle, security, and time-critical travel always reach you — plus a couple of items it’s openly unsure about, each with a one-tap “worth showing you?” rating. Why this is the best choice: trust is won fastest by being upfront about what you don’t yet know. The benefit: two taps today save a hundred interruptions next month — and it’s the only time Sieve asks for more than it gives.
Good morning, David
Day one together.
I don’t know your patterns yet, so I’ll show a little more and ask when I’m unsure this week — then quiet down.
A specimen of Day 1 — in the prototype the calibration meter fills as you rate items, and the “asks a lot → mostly quiet” curve is shown in onboarding.
The honest part: what ships, and how it’s judged
The concept’s credibility — and its moat — is in refusing to overclaim. Two things stay honest on purpose: what’s technically buildable today, and how success is measured.
On iOS, a third-party app can’t intercept other apps’ notifications, so the
universal interceptor in this prototype is the 3-year vision, not the v1. The shippable MVP is
narrower and real: a calm command layer over the channels you can legitimately ingest — email,
bank, calendar, travel, and HealthKit — orchestrated with the OS’s own Focus modes.
Android’s
NotificationListenerService gets materially closer to the full vision. And the
metrics deliberately refuse vanity engagement: never DAU, never session length, never streaks
or rings. Instead Sieve counts its own mistakes.
What an MVP can legitimately ingest
NotificationListenerService gets closer to the universal interceptor.
Metrics that count mistakes, not minutes
Screens 9 & 14 · The edge of the system — what intercept feels like
Most of what Sieve does happens before the app is ever opened — at the OS edge, on the lock screen and in the Dynamic Island — and in the one sense a phone has that a screen doesn’t: touch. Both are governed by one rule: spend the person’s attention only when something crossed the bar.
The lock screen is a small state machine — calm, travel, security, health — and the Island morphs to reflect whatever’s live, or stays idle when nothing is. Two choices define it. First, the Island is the one element that’s always dark, matching the hardware it lives in. Second, swiping a Sieve alert away doesn’t delete it — it holds it for the digest, with the faintest possible haptic, deliberately softer than a delete, because nothing was lost. That sensory restraint is the whole product in miniature: a calm phone’s most important decision is when not to buzz.
A specimen of the lock-screen state machine — Sieve’s one always-dark surface. Dismiss is hold, never delete.
The moments that earn a touch
A specimen of the haptic vocabulary — in the prototype each row plays a drawn ripple (and optional sound) so you can feel where feedback fires.
Explore more work
More explorations from the AI Product Design Lab — each a different facet of making AI products people can direct, verify, supervise, and trust.
Steer — intent before generation
Turn an under-specified prompt into a negotiated brief: the model surfaces what it inferred and flags ambiguity before it commits.
View explorationGround — verify what AI claims
Every claim traceable to a source with confidence and freshness; unsupported claims flagged; source conflicts shown, not smoothed over.
View explorationRecall — legible AI memory
A memory layer you can see, attribute, edit, scope, and revoke — personalization as a negotiated, inspectable thing, not a black box.
View exploration