rowntree.dev

Every gym tag, grocery card, library number, transit pass and parkrun ID lives in a wallet you left at home or a phone you have to dig out. Keychain puts them on the watch you are already wearing: open a card and it fills the screen at boosted brightness, ready for the scanner. The code is generated on the device: no phone, no signal, no account, nothing uploaded. The free app holds three cards; Keychain Pro holds twenty, with on-watch reordering.

The hard part. One source tree, 138 devices: round, semi-round and rectangular; AMOLED, MIP and LCD; a 96 KB memory floor at the bottom of the range. Connect IQ has no code-generation library, so all ten symbologies are hand-written in Monkey C: QR (with a capacity ladder that falls back through error-correction levels before it refuses), Aztec, PDF417, DataMatrix and five 1D formats. Each is pinned to byte-exact golden matrices verified against zbar, ZXing and dmtxwrite. Layout derives from screen geometry rather than device lists, a generator emits four manifests and seven build configs from one device table behind a CI drift gate, and a compile matrix builds every device × tier before anything ships.

What it taught me. Constraint is a product decision, not an engineering one. The 96 KB devices could not hold every encoder, so the two densest formats compile out on exactly those five models and say so plainly instead of failing at the till; the paid tier is a build-time constant rather than a runtime flag, which removed a whole class of entitlement bug before it could exist.

The slowest step in setting up Keychain was copying a thirteen-digit number off the back of a card by eye. The scanner removes it: point the camera, or drop in a photo, and it hands you the value to paste, along with a preview of how the watch will draw it and a verdict on whether it will scan at that size. It is the link the Connect IQ listing sends people to in English and all 26 translated listings, replacing the third-party scanners that listing used to point at.

The hard part. “Nothing is uploaded” is a claim most sites make and none prove, so here it is enforced rather than promised: the WebAssembly decoder is inlined into the bundle so it never fetches, fonts are self-hosted, icons are inline SVG, and the CSP sets connect-src 'none'. The page has no way to make a network request, even if a dependency were compromised tomorrow. Real-world photos are the other half: a barcode usually sits in a band of a larger frame and fails to binarize when a dark background bleeds in, so the decoder sweeps the whole frame, a centre square, then inset bands, across two binarizer passes, and takes the first hit.

What I was testing. Whether a companion app can be a feature of the parent rather than a separate product. The watch's own encoders are ported 1:1 to TypeScript and golden-tested against the Monkey C matrices, so the preview is the exact symbol the watch will draw, not a generic library's approximation, and the same 33 languages ship on both sides.

Leave a note at a physical location. It can be read only by someone who comes to the same spot (within roughly 150 metres) and it stays there permanently, accumulating over time like real graffiti. There is no feed, no account and no way in from your sofa. A toy, not a product: an argument that being somewhere is a scarce input worth designing around.

The hard part. Keeping it honest at zero marginal cost. No framework and no build step: plain HTML, CSS and JavaScript on Cloudflare Pages, with Pages Functions over D1 for storage and KV for rate limiting. A location resolves to a geohash tile before it is ever written down, so the database holds “this square” and never “this person, here”. A scheduled Action snapshots the database to R2 weekly, because permanent is a promise you have to actually keep.