goldfish

A recorder for in-person sessions. Everyone at the table controls how much of their own words is kept, and the record forgets on a schedule.

1Product overview

Goldfish is a pebble-shaped recorder that sits in the middle of the table during an in-person session: a workshop, a roadmap session, a retrospective, a facilitated circle. It hears up to 10 people. Each person sets the level of detail for their own words by voice, anyone can take the room off the record, and stored material loses detail on a fixed schedule. It is not for online sessions.

The product is the better session, not the notes: people listen fully and speak freely because they can see what is kept. The landing page (npc.here.now/demo-goldfish) says it as “Have better conversations. Make better decisions.” The hardware is the proof.

Behaviour

• Voice control. First-person phrases apply to the speaker’s own words: “Keep my words to just the decisions,” “You can quote me,” “Forget what I just said.” Room-wide phrases such as “This is off the record” lower the level for everyone. Nobody can raise the level for another person’s words.
• A light ring, one segment per participant. One continuous strip of 50 LEDs runs round the seam, behind a translucent TPU band, visible from every seat at a round table. Software splits the ring into one segment per voice, in order of first speech. A segment fills like a level meter and takes the level’s colour: red and full for off the record, orange and a quarter for outcomes, yellow and half for gist, green and three quarters for attributed, blue and full for verbatim. A segment brightens while its owner speaks, so several people talking at once, or two side conversations, show as several bright segments. The device has no speaker.
• One light in the eye. A single light behind the lens, powered by the microphone supply: lit exactly while the microphones can hear. Nothing else in the eye.
• The eye is a button, and every press is safe. A press takes the whole room off the record at once and the ring breathes red; pressing again never turns it back on. A double press, when the room is already off, brings it back on, and an amber arc counts down the 30 seconds in which anyone can undo that by saying “no.” Holding it for two seconds shows the battery. Each press answers with a buzz.
• Battery on demand. At power-on, and while the eye is held, the whole ring becomes a battery gauge for three seconds.
• Physical controls. A power slide switch and a microphone slide switch on the belly flank, below the bumper band; the eye on top.
• Tap here. A contactless icon on the tail, debossed into a 0.4 mm skin, lights from behind when a session’s note is waiting. Touch a phone to it and the note opens as a link; no button, no app.
• Scheduled forgetting. Attribution after three days, the summary after 30 days, outcomes after one year, enforced by key destruction in a secure element.
• No radio. Data leaves only through a passive NFC tag that a phone powers by touching the tail. The tag holds only the last session’s note, at the levels each voice allowed.

Levels of detail

2Problem

AI note-takers reached the mainstream within two years, while consent practices did not keep pace. The problem is less the recording than not knowing how recorded words will be used later. Facilitators describe the result: people hedge, and the honest part of the conversation moves out of the room.

After that, the genuine conversation switches to the hallway.Diana Mastel Gurwicz, INIFAC, on recording every word (verbatim)

Sources: Kolmogorov Law and Pollfish survey, 500 US workers, July 2026; Gallup, May 2026; the comparison in §9. Checked 16 October 2026.

• About 11 US states require the consent of all parties to record a private conversation (RCFP).
• EU regulators classify voice as “inherently biometric personal data” (EDPB 02/2021, ¶31).
• The EU AI Act has prohibited emotion recognition in workplaces since 2 February 2025 (Art. 5(1)(f)).
• In August 2026, a US court allowed the core claims in the consolidated Otter.ai privacy case to proceed (UC Today).

3Business rationale

Resolution Co’s stated mission is to make privacy “an interoperable protocol across aware hardware and software.” The device demonstrates the protocol; the protocol is the scalable asset. The options below are analysis rather than forecasts.

Vendor pages, checked 16 October 2026. The full comparison of 14 options is in §9.

• Option A — open reference device and protocol licence. Publish the spoken-control grammar, the retention schedule and the ring semantics; license a certified implementation to makers of recorders and meeting-room systems.
• Option B — fleets for facilitators, events and regulated workplaces. Scheduled forgetting and outcomes-only modes as a hardware-enforced records-retention policy.
• Option C — consumer device without a subscription. A single price and no cloud service; thin margins.
• Option D — open-source kit and community. Public code for the retention mechanism as evidence for the privacy claims.

Recommended direction: Options D and A, with the kit as the open reference implementation of a licensable protocol; Option B as the first source of revenue.

First audience: facilitators and teams who run in-person sessions. The landing page sells the session (presence, trust, speaking freely), never note-taking, and collects launch sign-ups. Its price answer is an estimate of $199–$499 per device, depending on the final parts and the first batch size; the range is the owner’s, not derived from the BOM, and the ship date follows testing.

4Requirements

5Hardware

A Radxa ZERO 3E without radio hardware, two I2S microphones, a Mini Skinny NeoPixel strip (50 LEDs) round the seam behind a translucent TPU light band, one NeoPixel Mini behind the tail icon, a single microphone-rail light in the eye, power and microphone slide switches, an eye that is also a button, an ATECC608 secure element, a PCF8523 clock with its own coin cell, an ST25DV64KC passive NFC tag and a 4,000 mAh battery, inside a 2.2 mm PETG pebble with a TPU bumper band and foot. See the Model, Print and Wiring tabs.

Build one

6Software

All processing runs on the device: voice activity detection, a keyword spotter for lowering phrases, streaming speech recognition and a 0.5B language model for summaries. A short rule engine decides the level for each participant. See the Graph and Device tabs.

7Production

A production design consolidates the breakout boards onto one circuit board, including an “eye board” with the LEDs, microphones, NFC IC, clock and secure element. The target size is about 100 × 44 × 18 mm, inside an injection-moulded PC/ABS shell. Certification as an unintentional radiator (FCC Part 15B, CE EMC).

8Open risks

• Battery: about 3.1 h of a busy session and 3.8 h of listening per charge at typical power, 2.7 h at the worst simulated power (v01/sim/power_report.json). Plugged into any USB-C phone charger it runs indefinitely and charges at the same time, so an all-day workshop runs plugged in; on battery alone it needs v02’s low-power audio MCU.
• Heat, not the battery, limits continuous use: the shell sheds about 5.6 W at 45 °C, so on a charger the firmware holds the Radxa to about 3.4 W on average and runs transcription in bursts. A small heatsink, thermal pads and an aluminium spreader carry the SoC’s heat to the whole top shell; a fan would be heard by the microphones.
• Ring colours must stay legible through the TPU band in daylight across a 2 m table; print a band sample before the full kit.
• Speech and summary performance on the RK3566 is unmeasured.
• Speaker separation accuracy becomes a safety property under ADR-0008.
• Voice clustering requires legal review (biometric data under GDPR and Illinois BIPA).
• The Radxa ZERO 3E is out of stock, and the NFC tag has no EU stock.

9Market comparison

10Recommended roadmap

11Backlog

12Pick this up

For anyone, person or agent, who wants to continue the work. The repo is the source of truth; this page is built from it.

Get the code

• The repository is github.com/rafaeldavid/goldfish. It is private: ask the owner for access. Making it public is the owner’s call.
• Without access, the Build files page has a source zip. It leaves out the generated meshes, so run the CAD pipeline below before you build the site. It also leaves out the vendor board models; the site still builds, but the Model tab then lacks them.

Read first

1. AGENTS.md: where things are, the pipeline, the checks and the rules. Agents read it through CLAUDE.md.
2. BUILD-LOG.md: the “Start here” list at the top, then the last two phases.
3. BACKLOG.md: the open work, also rendered in section 11. P0 blocks the kit, P1 comes before the field test, P2 is v02 and the business. Each item says when it is done.
4. The newest decisions in 03-architecture/decisions/ (Sources tab). The product rules that code must keep come from them.

Set up and run the checks

Python 3.12 and uv. Run the checks before you change anything; every check should pass. The Checks tab shows the most recent run.

uv venv --python 3.12 ~/.venvs/goldfish-cad
uv pip install --python ~/.venvs/goldfish-cad/bin/python \
  build123d trimesh numpy scipy pytest rtree
~/.venvs/goldfish-cad/bin/python v01/validate.py

After a CAD change, in this order

PY=~/.venvs/goldfish-cad/bin/python
$PY v01/cad/pebble_enclosure.py   # shells, eye, band, caps → out_pebble/ (5–10 min)
$PY v01/cad/wire_routes.py        # 27 wires → wires.json and the cut list (≈ 10 min)
$PY v01/cad/make_web.py           # web meshes, print copies, print.json
$PY v01/validate.py               # all checks
python3 site/build.py             # this page, local: site/index.html
python3 site/build.py --web       # the deploy folder: site/web/

Skipping wire_routes.py leaves the wiring checks reading stale routes.

Rules that catch newcomers

• Never tune a check to make it pass. A new failure mode gets a new check.
• The device logic exists twice, in v01/firmware/goldfish/*.py and v01/firmware/js/goldfish.js. Change both; the checks compare them bit for bit.
• A change to behaviour, shape or parts gets an ADR, with the request quoted verbatim. Backlog IDs and ADR numbers are never reused.
• Every BOM row needs a product link someone opened, with stock status and a date, or the word “unverified”.
• Deploying this site is the owner’s call. Ask first.