Disguise mode is first-class

If you build a mental-health app and your audience is people who are comfortable having a mental-health app on their phone, you have already lost the users who need it most.

This is not a thought experiment. Domestic abuse survivors check their partner's phone, and have their phone checked. LGBTQ+ teenagers in hostile family environments have their phones inspected at the dinner table. Trauma patients who have lived through coercive relationships have learned, deeply, that visible mental-health adjacent material on a personal device is a liability. Some of them work in industries — military, law enforcement, certain healthcare verticals — where the wrong app icon is a career risk.

These users are not edge cases. They are a substantial fraction of the population that needs regulation tooling. And every existing consumer wellness app is built as if they do not exist.

What disguise mode is

In Stoa, disguise mode is an alternate app icon and an alternate app name. Turn it on, close the app, return to the home screen, and what you see is something neutral — a fidget icon, a focus app, a small utility. It looks like a habit tracker. It looks like a study timer. It does not look like a mental-health app, because in the world it is being looked at, it cannot.

Inside the app, the experience is unchanged. The regulation tools are there. The state-adaptive engine is there. The therapist connection (if any) is there. Only the surface that the world sees changes.

Why it is first-class

The word first-class is doing real work in that sentence. First-class means:

1. The setting is in the first level of the settings tree, not the third.
2. The alternate icon is built into the app bundle at ship time — not a runtime download.
3. The alternate name is a real iOS / Android alternate app icon, not a workaround.
4. Onboarding asks about it in the second screen, with the framing "Do you want this app to look like a mental-health app, or like something else?"
5. It cannot regress on a future release. The codebase contains tests that fail if the alternate icon binding is removed.

We could have built this as a setting buried under Notifications. We could have shipped it later, as a v2 feature. We could have shipped it as a paid unlock. We did none of those things, because if disguise mode is not first-class, the audience that needs it does not trust it. The trust signal is the first-classness — the fact that the app team built it visibly, on day one, and treats it as a load-bearing feature.

What this is not

Disguise mode is not a privacy theater. It is paired with:

• Anonymous Stoa IDs (format STA-XXXX-XXXX), generated client-side. No email or legal name is required to use the app at all. The public identity is the Stoa ID; the auth user ID is internal. The two are not exposed to each other in the UI.
• Passcode and biometric lock, protecting either app entry or just the reports surface. Built with Expo SecureStore and the platform's Local Authentication APIs.
• Therapist-mediated connection only — when a patient wants to share data with a therapist, they do so by QR scan, deep link, or a one-time code. The two parties never exchange legal identity inside Stoa. The therapist sees a Stoa ID and the data the patient explicitly shared. They do not see an email.
• An immutable audit log, append-only, covering every CRUD on patient-touching data. If something goes wrong, we can prove it. If something is alleged to have gone wrong, we can disprove it.

Each of those is a separable feature. Together, they are the architecture that lets a survivor of intimate-partner violence use a regulation app on a phone they know is going to be inspected.

The thing the standard market gets wrong

The standard wellness-app market thinks of privacy as a constraint — something to be minimally satisfied so that GDPR auditors stop calling. We think of it as a feature, and more importantly, as a moat.

A moat in the sense that — once you have built anonymous identity, disguise mode, passcode lock, audit log, and the consent surface to back them, you have built infrastructure that is expensive in engineering time and expensive in product-decisions-not-taken. A competitor can announce "we care about privacy" in a marketing post. They cannot ship five years of architectural decisions that built around it. The architecture is the moat.

We made these decisions early because we are building Stoa for the people on the hardest end of the audience, not the easiest. The easy users get a better app as a side effect of building for the hard ones. The hard ones get an app they can actually use.

Disguise mode is one entry in a list of features that, taken individually, look like nice-to-haves. Taken together, they describe the kind of company we are.