goldfish
A pocket voice recorder that gives everyone in the room control over the retention of their words.
The device records continuously. Any person within earshot can lower the level of detail it keeps with a plain-English instruction. The device has no speaker; a ring of five lights on its top surface shows the current level of detail. Stored material loses detail on a fixed schedule: attributed notes for three days, an unattributed summary for 30 days, and decisions and tasks for one year.
Product overview
Goldfish is a pebble-shaped recorder for long conversations with many participants, such as conferences, site visits and dinners. The device records continuously, applies the level of detail that the people present have agreed to, and reduces that detail automatically as the material ages.
Voice control
Participants control the device with ordinary speech, without an app. First-person phrases apply to the speaker’s own words, for example “Keep my words to just the decisions,” “You can quote me” and “Forget what I just said.” Room-wide phrases such as “This is off the record” lower the level for everyone. Nobody can raise the level for another person’s words.
One dot per participant
The device has no speaker. The eye is a ring of twelve dots: each voice the device hears receives its own dot, and the brightness of that dot shows the level of detail for that person’s words. Each participant sets the level for their own words by voice. A separate orange point in the centre draws power directly from the microphone supply and is lit whenever the microphones have power.
Scheduled forgetting
The device stores each hour of material at every permitted level of detail and encrypts each copy under its own key. Keys expire on fixed dates: attribution after three days, the summary after 30 days and the outcomes after one year.
Levels of detail
Problem
AI voice recorders reached the mainstream within two years, while consent practices did not keep pace. The NPC Memo of 24 December 2025, which introduced Goldfish, identifies uncertainty about the later use of recorded words as the core problem, rather than recording itself.
When people don't know how our words will be captured, summarized, reused, or interpreted later, they behave rationally. We speak less. We hedge. Or we avoid the meeting on official channels and start a Signal chat.NPC Inc memo, 24 December 2025 (verbatim)
All of us should have agency over the resolution at which our words are remembered.NPC Inc memo, shared belief 2 (verbatim)
Regulatory context
- About 11 US states require the consent of all parties to record a private conversation, including California, Illinois, Florida and Washington (RCFP).
- EU regulators classify voice as “inherently biometric personal data” (EDPB Guidelines 02/2021, ¶31).
- The EU AI Act has prohibited emotion recognition in workplaces and schools since 2 February 2025 (Art. 5(1)(f)). Goldfish performs no emotion recognition.
- In August 2026, a US court allowed the core claims in the consolidated Otter.ai privacy case to proceed, including the wiretap and Illinois voiceprint claims (UC Today).
Product response
- Continuous consent. Any participant can lower the level of detail at any point in the conversation.
- Visibility. The eye displays the current level of detail to everyone at the table, and the microphone indicator reflects the actual state of the microphone supply.
- Enforced retention. The hardware deletes keys on a fixed schedule, independent of any user policy.
- No radio. Data leaves the device only through a short NFC transfer to a phone in direct contact with it, while a person holds the read button.
Business rationale
Resolution Co’s stated mission is to make privacy “an interoperable protocol across aware hardware and software.” The device demonstrates the protocol in a pocket-sized product, and the protocol is the scalable business asset. The options below are analysis rather than forecasts.
| Device | Price | Subscription | Control over retained content | Scheduled deletion | Radio |
|---|---|---|---|---|---|
| Goldfish v01 | kit ≈ $190 | None | All participants, by voice | Yes, through key destruction | None (passive NFC only) |
| Plaud Note Pro | $179 | Optional plans | Owner | No | Bluetooth |
| Bee (Amazon) | $49.99 | $19 per month | Owner | No | Bluetooth |
| Limitless Pendant (Meta) | $99 | Plans; sales ended December 2025 | Owner | No | Bluetooth |
| Friend pendant | $129 | — | Owner | No | Bluetooth |
Sources for competitor prices: TechCrunch (22 July 2025, 27 August 2025 and 5 December 2025) and Fortune (1 October 2025). Radio information comes from product descriptions.
Option A: Open reference device and protocol licence
Resolution Co publishes the spoken-control grammar, the retention schedule and the light-ring semantics as an open specification, and licenses a certified implementation and a compliance mark to wearable manufacturers.
Advantages: platform companies are acquiring the category, and a bystander-control protocol from an independent party carries more credibility than one from a platform. Risks: slow revenue from standards and a dependence on a regulatory driver or an anchor licensee.
Option B: Fleets for events and regulated workplaces
Resolution Co sells or leases device fleets to conferences, law firms, newsrooms, unions and works councils. For these customers, scheduled forgetting and the outcomes-only mode function as a hardware-enforced records-retention policy.
Advantages: documented consent problems, budgets for compliance and a simple security review due to the absence of radios. Risks: long sales cycles and a continued need for explicit consent workflows in all-party-consent states.
Option C: Consumer device without a subscription
A single purchase price, on-device processing and the absence of a cloud service differentiate the product from subscription recorders and from devices that stopped working after an acquisition.
Risks: thin hardware margins, no recurring revenue for model updates and a weak track record for consumer AI hardware.
Option D: Open-source kit and community
Resolution Co publishes the hardware, firmware and protocol under open licences and earns revenue from kits and assembled units. Public source code for the retention mechanism is the strongest available evidence for the privacy claims.
Risk: limited defensibility, because third parties can build compatible copies.
Recommended direction
The recommended direction combines Options D and A, with the kit as the open reference implementation of a licensable protocol. Option B is the first source of revenue, because these buyers already face documented consent problems. Option C remains a limited reference edition rather than the core business.
Market notes and sources
Component tour
The tour covers each component in sequence. Each stop opens the enclosure to the relevant part, describes its function and lists the exact board in the kit. On the eye stop, the level buttons change the number of lit segments.
Form factor and internal layout
The enclosure is a loft of superellipse cross-sections: an egg-shaped plan that is widest toward the head, a full dome on top and a nearly flat base. A packing solver places every component against the mathematical definition of the cavity and confirms that no component crosses the wall or overlaps another component. The drawings below come directly from that solution.
Plan view (head on the right)
Section along the centre line
The battery sits on the base, the compute board hangs from four posts in the top shell, and the eye, microphones and NFC tag sit under the dome. The dashed line marks the parting line between the two shells.
Eye placement
The eye sits at a distance of L/φ² from the head, which divides the body in the ratio 0.382 : 0.618 and places the eye near the widest and thickest point. The twelve-LED ring has an outer diameter of 36.8 mm, which sets the eye diameter at 40 mm.
Cross-section geometry
A plan exponent of 3.2 and a dome exponent of 3.0 keep enough volume at the shoulders for rectangular boards, and a base exponent of 5 gives a nearly flat underside. The measured wall thickness is 1.8 mm at the median and 1.15 mm at the thinnest point near the tips.
Tail functions
The USB-C charging port is at the tip of the tail, and the NFC tag sits directly under the dome of the tail. Charging and phone transfer therefore both take place at the tail.
Hardware architecture
The design combines a Linux board without radio hardware, a microphone indicator wired to the microphone supply, a secure element for the retention keys and a passive NFC tag. The tag responds only to a phone in contact with the device while a person holds the read button.
flowchart LR
subgraph POWER["Power"]
USB["Tail USB-C"] --> CHG["bq25185 charger
power path"]
BAT["LiPo 2000 mAh"] <--> CHG
CHG -->|"3.6–4.2 V"| BST["5 V boost"]
end
subgraph EARS["Microphones and eye"]
SW["Microphone slide switch"] --> MR["Microphone rail 3V3"]
MR --> MIC["2 × I2S MEMS microphones"]
MR --> DOT["Orange indicator
lit when microphones have power"]
RING["12-LED ring: one dot per participant"]
end
BST -->|"via Schottky diode"| RAD["Radxa ZERO 3E
RK3566 · 4 GB · no radio"]
MIC -->|"I2S"| RAD
RAD -->|"SPI"| RING
RAD ---|"I2C"| SE["ATECC608
key chains"]
RAD ---|"I2C"| RTC["RV3028 clock
backup cell"]
RAD ---|"I2C"| NFC["ST25DV tag
radio interface off by default"]
BTN["Read button"] --> RAD
RAD --> ERM["Vibration motor"]
RAD --- SD["microSD
encrypted storage"]
NFC -.->|"passive"| PHONE["Phone"]
Pin assignments
| Signal | Pin | Connection |
|---|---|---|
| 5 V input | 2 | Boost converter through a 1N5817 diode |
| 3V3 to microphone rail | 1 | Slide switch, then microphones and indicator |
| I2C SDA / SCL | 3 / 5 | ATECC608 (0x60), RV3028 (0x52), ST25DV (0x53) |
| I2S BCLK / LRCK / DIN | 12 / 35 / 38 | Both microphones, with left and right set by the SEL pin |
| SPI MOSI | 19 | LED chain |
| Read button / haptic driver | 16 / 18 | Button to ground; 2N7000 transistor to the vibration motor |
The pin functions require confirmation against the Radxa ZERO 3E pinout before soldering.
Hardware-enforced properties
- Physical microphone cut-off. The slide switch interrupts the microphone supply rail.
- Truthful indicator. The microphone supply rail powers the orange dot directly.
- No transmitter. The NFC tag is passive. Its radio interface opens for at most ten seconds while the button is held, and the device erases the tag afterwards.
- Retention without main power. The clock runs from its own backup cell, and a loss of time reduces all material to outcomes.
- Key isolation. Chain keys reside in the secure element and never on the microSD card.
Software architecture
All processing runs on the device. The models produce only lower-detail text; a short, testable rule engine determines the level of detail for each moment of the recording.
flowchart LR MIC["Microphones"] --> BUF["RAM buffer, about 75 min
never written to disk"] BUF --> VAD["Silero VAD"] VAD --> KWS["Keyword spotter
fast path"] VAD --> ASR["Streaming speech recognition"] ASR --> INT["Intent parser
rules and 0.5B language model"] KWS --> ENG{{"Agreement engine"}} INT --> ENG ENG --> RING["Light ring and haptics"] ENG --> STAMP["Level stamp per 5-minute block"] BUF --> SEAL["Hourly sealing"] STAMP --> SEAL SEAL --> DIS["Distillation into R3, R2 and R1"] DIS --> STORE[("AES-GCM containers
per day and level")] KEYS["Key chains in ATECC608"] --> STORE CLK["Midnight rotation"] --> KEYS BTN["Read button"] --> PACK["Note packing, 8 KB maximum"] STORE --> PACK --> TAG["NFC tag"] --> PHONE["Phone reader page"]
On-device models
| Function | Model | Schedule | Purpose |
|---|---|---|---|
| Speech detection | Silero VAD (about 2 MB) | Continuous | Restriction of the heavier models to periods of speech |
| Lowering phrases | sherpa-onnx keyword spotter (about 3 M parameters) | Continuous | Detection of “off the record” and “just the decisions” within about two seconds |
| Transcription | sherpa-onnx streaming Zipformer (20–70 MB) | During speech | Speech-to-text conversion, held in memory only |
| Other commands | Qwen2.5-0.5B (llama.cpp) and a rule parser | On detected phrases | Conversion of phrases such as “only keep this for a week” into structured, JSON-constrained commands |
| Speaker turns | sherpa-onnx diarisation | Hourly | Speaker turns for attributed notes, with names taken from speech rather than voiceprints |
| Distillation | Qwen2.5-0.5B (1.5B on the 4 GB board) | Hourly or during charging | Generation of attributed, summary and outcome copies, never above the level in force for the block |
Performance on the RK3566 is not yet measured. Published figures exist only for Raspberry Pi 4, Raspberry Pi 5 and RK3588 boards. Benchmarking is the first step of the assembly guide.
stateDiagram-v2
direction LR
[*] --> Recording: slider on
Recording --> Lowered: lowering phrase
Lowered --> Recording: resume phrase or end of conversation
Recording --> RaisePending: raise request with device name
RaisePending --> Recording: objection
RaisePending --> Raised: 30 s without objection
Recording --> Reading: button held and phone at tail
Reading --> Recording: button release and tag erasure
Recording --> Muted: slider off
Phone simulator
The phone simulator at npc.here.now/demo-goldfish runs the same rule engine and phrase parser in a mobile browser. It uses the phone’s microphone for speech recognition, its screen for the twelve-dot eye, its vibration motor for haptics on Android, and Web NFC on Android for the transfer. A participant picker stands in for the device’s speaker separation. On a phone, the browser’s speech recognition may send audio to Apple or Google; the device itself recognises speech on board.
Phone transfer
The note travels inside the fragment of a link (…/#g1.<compressed>). Browsers do not send the fragment to the server, so the reader is a static page that decodes the note on the phone and offers sharing to Notes, a .txt download and copying.
Validation status
A single script, v01/validate.py, runs every check in the table below, and the table shows the output of its most recent run.
Verified in software
- End-to-end simulation of a three-day conference, covering level stamps, sealed storage, midnight key rotation and the readable content on days 1, 5, 9 and 31.
- Complete removal of material marked “only keep this for a week” after seven days.
- Reduction of all material to outcomes after a clock failure.
- Identical phrase interpretation in the simulator, the phone simulator and the device firmware.
- Per-participant rules (ADR-0008): own-word levels, room-wide lowering, no raising for others, and safe handling of commands from an uncertain speaker.
Pending hardware verification
- Speech recognition and summarisation performance on the RK3566.
- Current consumption, battery life and temperature inside the closed enclosure.
- NFC read range through the shell and the register map of the tag driver.
- False-trigger rate of the keyword spotter in real conversation.
- Fit of the snap tongue on a physical print.
Bill of materials (prototype)
Prices and stock levels reflect a check on 12 October 2026. Lines without a published price appear separately in the totals.
Production plan
Version 1 uses breakout boards so that every part is available to order today, which accounts for the 125 cm³ volume. A production design consolidates these boards onto a single circuit board inside a moulded shell. Volume pricing requires supplier quotations, so this section lists cost drivers rather than estimates.
| Subsystem | v01 kit | Production direction | Rationale |
|---|---|---|---|
| Compute | Radxa ZERO 3E with the RJ45 jack removed; microSD storage | System-on-module on a custom carrier, or a chip-down SoC with an NPU; eMMC storage | Supply (the ZERO 3E is out of stock), size and secure boot |
| Eye and sensors | Five NeoPixel boards, two microphone boards, an NFC board, a clock board and a secure-element board | A single eye board with low-profile LEDs, microphones, an NFC IC with antenna, the clock and the secure element | Largest size reduction: about 2–3 mm of height and most of the tail volume |
| Power | Charger, 5 V boost converter and USB-C breakout | Charger IC with power path and a PMIC supplied from VSYS; fuel gauge | Volume, efficiency and a battery-level indication on the ring |
| Battery | Hobby LiPo pouch cell | Custom pouch cell shaped to the base of the pebble | Capacity per cubic centimetre and UN 38.3 compliance |
| Enclosure | PETG prints with a snap tongue | Injection-moulded PC/ABS with a soft-touch finish and a clear PC light guide | Surface finish, tolerance and unit cost after tooling |
| Size | 130 × 50 × 25 mm, 125 cm³ | Target of about 100 × 44 × 18 mm (estimate) | Consolidation of ten boards into one |
Cost drivers
- SoC, RAM and storage
- A battery sized for a full conference day
- Moulding tools (one-time cost)
- Certification and test fixtures (one-time cost)
- NFC IC, secure element and clock (minor cost)
Certification
- No transmitter: classification as an unintentional radiator (FCC Part 15 Subpart B, CE EMC)
- Passive NFC tag: classification to be confirmed with the EMC laboratory
- RoHS, REACH and UN 38.3 compliance
- Privacy: a consent flow for all-party-consent states and no voiceprint processing by default
Factory test per unit
- Microphone channel and sensitivity check
- Indicator check: dot lit only with the microphone rail on
- Light-ring segment check
- NFC read test through the closed shell
- Secure-element provisioning and clock setting