The account that keeps you from losing your memory
The app works from the very first launch, with no signup. That comfort has a flip side: as long as there is no account, memories are attached to the device, and a lost phone takes them with it. This piece of work made the move to an account reliable end to end, and put the invitation where it can be seen, without ever getting in the way.
The hidden price of starting right away
Asking for nothing at launch is a strong product decision. No form, no email to confirm before you have even understood what the app is for. You press, you speak, it works.
The flip side is invisible, and it arrives late. Without an account, everything the app keeps is attached to the device itself. That is fine for weeks, and it becomes a problem the day the phone is broken, stolen, or simply replaced. The risk is not theoretical, and above all it grows with time: the richer the memory, the more the loss costs.
So the move to an account had to be possible at any moment, without effort, and above all it had to actually work. A signup flow that fails in silence on this particular product does not cost you a session, it costs you months of memory.
Three places where the flow broke
The first defect was a misunderstanding. At signup, when email confirmation is required, the service returns no session: the account exists, but it is not usable yet. The app, for its part, treated the absence of an error as a success, and displayed a signed in state that did not exist. People believed their account was live, closed the app, and found out later that it was not. Now the screen says plainly that a message is waiting in the inbox, with a button to send it again if nothing arrives.
The second was a plain absence: there was no way at all to recover a forgotten password. On an app you open several times a day, the password is typed once, then remembered by the phone, and forgotten within a few weeks. The recovery link now goes out by email, and coming back into the app opens the dialog for choosing a new one directly, without having to retype the old one, which by definition you no longer know.
That return trip deserved particular care. The link received by email does not simply bring you back to the app: it carries the proof that the mailbox really belongs to the person. So the app had to know how to open on that link, in both of its possible forms, and move straight on to the password change. A link that opens the home screen and says nothing feels like a procedure that failed, when in fact it succeeded.
The third defect was ordinary friction, the kind you stop noticing because you have put up with it for so long: a masked password field, with no way to check what you are typing, on a phone keyboard that capitalizes the first character by default. Every field concerned got an eye to reveal what is being typed, automatic capitalization and correction were turned off, and the hints that let password managers do their job were set properly, telling the current password apart from the new one.
The recovery link also became visible from both tabs, sign in and sign up. Someone who already has an account often starts by trying to sign up, and that is precisely the moment they discover they remember nothing.
Inviting without forcing
That left the trickiest question: how do you tell someone they should create an account, without turning the app into a machine for nagging about signup.
The answer we settled on is modest. In anonymous mode, the invitation to create an account moves to the top of the settings, just under the title, in a warm tint that sets it apart from the rest without shouting. Once the account exists, it drops back to its discreet place at the bottom of the screen, where it bothers nobody.
Nothing is blocked, no screen gets in the way, no feature is held hostage. The invitation is simply visible at the moment it means something, and it disappears as soon as it stops meaning anything. It is the same logic that governs what the app shows and what it keeps to itself: speak up at the right moment, stay quiet the rest of the time.
What we take away
An authentication flow is not a formality you rush through before getting back to the interesting subjects. On a memory app, it is the mechanism that decides whether what people entrust to it stays with them, or vanishes along with a device.
And one lesson learned here holds elsewhere: the absence of an error is not a success. A service that answers without complaining, but without handing over a session, is saying something precise, and treating that as a success amounts to lying to the user about their own state. Where the data lives and how to take it back is a question that comes up at the very first launch, not on the day you lose it.