How to use it
One request, end to end
Someone typed that into the bar at the bottom of the app. Take the steps in order, or jump between them. The handset is the prototype, actually running, and each step opens it at the point that step describes.
What you can ask for
Grouped the way a household actually asks for them. Under each one is a sentence somebody really would type. There is no other syntax to learn, and no menu underneath any of this.
Adds, moves and cancels events, and answers what is coming up. He reads the calendars already on your phone, so Google, iCloud and Outlook work without connecting an account.
Put Omar’s dentist on the calendar for the 14th at three.
Groceries, errands and reminders the whole house can see and change. A reminder can find one person or everybody.
Add oat milk to the list and remind Nadia about the bins.
Photograph one and he reads it, files it, and can tell you what a shop has cost you over a month. Nothing is typed in.
What has Greenhill Market cost us since May?
Every photo and video off your phone, kept whole rather than shrunk. He learns who is in them, so you can ask for a person instead of scrolling a year.
Find the ones of Theo and the dog from the summer.
Who lives here, how they are related, and what you have told him about them. Say a first name and he knows which one you mean.
When is Ray’s birthday?
Your address, how far away something is, and what sits on the way home. Several stops come back as a route, not a list.
Butcher, hardware shop and the post office. What order?
Recipes read straight off a web page, and an answer to what you can make with what is already in the house.
What can we make tonight without going out?
Safe mode belongs to the person, not a group they are in, so no group you add them to later can switch it off. Spending and outward messages become unavailable rather than hidden.
Who may see a safe person's records is a second permission, granted one person at a time. The service enforces it and no screen reaches it yet, so today it is the limits above that are real.
Can Bobby find me a science fair thing?
Features · Bobby threads
Not one long conversation with everybody in it. Separate threads, each with its own people, and a switch on every one of them for whether Bobby is in the room at all.
Below is the design board for it, published as it stands rather than redrawn into a picture for this page. Every screen on it is live. Change who may ask in step four and steps one, two and five recompute, because it is the same rules underneath.
Features · Bobby backups
Photographs and video off everyone's phone, kept at full size rather than shrunk to save somebody else money. Bobby learns who is in them, so you can ask for a person instead of scrolling back through a year to find them.
They go straight from the phone into a storage bucket your household owns and never pass through Ridgeback's servers. The key to that bucket is encrypted the moment it arrives and cannot be read back by anyone, including us.
None of this runs yet. The roadmap lists household photographs as designed rather than built, and that is what the board below is: the design as it stands today, published rather than described.
Features · Storage and AI
Two settings built as one pattern. Where a household's photographs live, and which model reads its questions. Both can be yours, and both can be ours.
Point Ridgeback at storage you own and the photographs land in your account rather than ours. Cloudflare R2, Amazon S3, Backblaze, or a box in your basement. The same goes for the assistant: run your own model, or rent one from whoever you like. Bobby speaks to both the same way, so the choice changes nothing else about how he behaves.
Either credential is sealed on the way in and never shown again, not even to us, and a real request is run against the thing before anything is switched over. Connecting a bucket works today, and so does choosing the model: it is a setting each household makes, on a screen in all three apps, rather than one setting for the whole service.
Not every household wants to open a storage account or run a model. So there will be versions Ridgeback holds and runs for you, sold at a price with a margin on it rather than at cost, in more than one level of service with a written agreement saying what each one promises.
What it does not change is the way out. The same export has to work whether the bucket is ours or yours, or the convenience is a trap. A household on the managed tier has no console of its own to fall back on, which makes that harder to get right rather than easier.
None of this is built. No price exists, no level of service is written down, and whose hardware sits underneath it is undecided. It is three lines on the roadmap, and the board below is a drawing of them.
Features · Safe mode
Safe mode is a flag on a person. It withholds the two outward actions, spending and messages that leave the house, and it quiets the records that relate to whoever carries it. It is set on the person rather than on a group, so no group they are added to later can switch it off.
The permission that opens those records back up is held on a name. Inviting somebody into your household does not let them see a safe person's records, and no group can hand that over either. Joining a house and seeing into it stay two separate doors.
The flag works today. The grant is designed and not built, which is what the board below draws.
Features · Security and permissions
Every request goes through the same four checks in the same order, whoever is asking. Is Bobby even in this thread. Is the tool switched on in this house. Does this person reach it. Does it apply to the particular thing in front of you. Nothing is special-cased, so there is no path that skips one.
One account can stand in more than one house and hold a different set of groups in each. Below is the design board for all of it: where a household edits its groups, what a person holds everywhere at once, how a guest is let in with an end date already attached, what a single thread can narrow on its own, and where the guardrail agent sits once the door check has already said yes.
Features · The Bobby tab
The tab opens on a hub rather than on a conversation. Every tool Bobby can use is there before you ask for anything, so the answer to what he can do is a screen you look at instead of a list you go hunting for.
Above all of it sits a scope header saying which homes are in view and whose seat you are in. Change the scope and everything underneath recomputes, because a person in two households is one account with two sets of permissions rather than two accounts.
Roadmap
A site that draws planned features the same way it draws shipped ones is how you end up with the wrong idea of what exists. Three states, and nothing here claims a date.
In the apps means a household can do it from a screen. Not built means nobody can. On the server, no screen yet is the one that needs saying: the service will do it and nothing in any app asks, so for a household it is not yet a thing they can do. Work that is genuinely finished sits in that middle state for a while, and calling it either of the other two would be a lie in one direction or the other.
In the apps
You say the thing and the tools run. It works in the iPhone, Android and desktop apps today. The Discord bot answers as well, and it is not the same build: what it can do and what the apps can do are two measurements rather than one, and this page speaks for the apps.
In the apps
Starting a house, inviting people, sorting them into groups, and the walls that keep one household out of another.
In the apps
How most of a household will actually ask. The macOS, Linux and Android builds are on the home page and install today. The iPhone build goes by TestFlight invitation instead, because Apple allows no other way, so it is not on that list.
In the apps
Point a household at its own bucket and the service takes it, encrypts the key on arrival, and hands out links that work for one file and expire in minutes. Connecting, reading back the settings and disconnecting all run today.
In the apps
Set on the person rather than a group, so it cannot be switched off by moving them somewhere else.
In the apps
The reading happens on your own phone rather than somewhere else. Photographing one and reading it on the device are in the iPhone and Android apps; the list of them, and one receipt in detail, are in all three.
In the apps
Three separate things: leaving one house, erasing what Bobby knows about you, and closing your login. All three are in all three apps. Each works without the other two: leave a household and you can still sign in, be forgotten and you keep your place, close your login and you are still in the member list.
In the apps
A household thread that stays in step across devices is a synchronisation problem rather than a chat window, and it is specified down to how a phone catches up after being switched off. The two phones and the desktop app hold one thread together over the household socket. Discord is not in that: the bot's conversation is still its own, and joining the two is not built.
In the apps
Which model answers is a setting the household makes rather than one setting for the whole service, and the screen for it is in all three apps. Nothing falls back silently: a household that turns fallback on is told, in words on that screen, where its questions go when it fires.
In the apps
A device copies its own pictures into the household's storage, and what has gone and what is still waiting are both on the screen. In all three apps. The library that would hold every device's pictures together is the next row.
In the apps
The fields on your own person, every one of them optional, can be edited in all three apps. What Bobby has remembered about you from a conversation is a different store, and nothing anywhere edits that.
On the server, no screen yet
Marking somebody safe limits what they can do, and that is in the apps. The other half is who may see records about them, and it is a permission held by one named person at a time rather than by a group. The service now enforces exactly that: a safe person's records reach the subject, or somebody named individually, and no capability and no group reaches them at all. Invite a guest into the house and they still cannot see those records. Nothing in any app names anybody or shows who has been named, so no household can use it yet.
On the server, no screen yet
You can read your own thread and your own profile in the app now. One file with all of it, across every household you are in or ever were, is what the law calls a subject access request, and the service assembles and returns it. No screen in any app asks for it, so for a household it still takes a request to us.
On the server, no screen yet
A short read of what happened overnight, rather than scrolling back through it yourself. The service writes one for a thread. No app has anywhere to ask for it.
On the server, no screen yet
Describe something you want handled, answer a short questionnaire, and what gets saved is an arrangement of tools Bobby already has. Nothing a household writes ever runs as code, and a skill can never do anything the person invoking it could not do themselves. Nine routes carry that on the service. No app draws one, so no household has written a skill.
On the server, no screen yet
Bobby's registry includes some tools that are declared but not connected yet. A household could switch one of those on, grant it to a group, and still find that asking for it does nothing. The service now reports which tools are which, so the difference can be shown rather than discovered. The screen that would show a household its tools is not built, so there is nowhere for that answer to appear.
On the server, no screen yet
“Every Tuesday at seven” is a wall-clock statement, and a wall clock with no place attached does not name a moment. Until now the only clock in the building was the operator's. A household now has one of its own on the service, stored as the name of a place rather than an offset so it survives the clocks changing, and a person has a personal one beside it. Nothing in any app sets either.
On the server, no screen yet
A list used to be one of five fixed kinds whose items carried the same seven columns whatever the list was for, so a household that wanted a category against its groceries had nowhere to put one. The service now carries kinds a household defines, the fields each kind's items hold, and a privacy setting per field that withholds a value from a reader rather than fetching it and hiding it. The apps can create a home list from a thread and link existing lists, with their current permissions. Screens for defining custom list kinds and fields are still missing; Bobby has no tool for adding a field.
On the server, no screen yet
Every device's pictures in one place rather than each phone's own. The service holds it, and the apps say so out loud: the library screen lists what this phone sent and tells you the rest is elsewhere. On-device Gemma reading can prepare a draft from a picture for review before sending. That does not provide a combined photo-library screen.
On the server, no screen yet
Two households keeping one shopping list, or one calendar between grandparents and parents. Offered and accepted rather than pushed, one thing at a time rather than a whole surface, read-only in the house that receives it, and revocable from either end. What is shared carries the name of the house it came from wherever it appears, because two houses sharing a list are still two houses. The service does all of it. The apps already draw an accepted share read-only, but no screen offers one, accepts one or takes one back, so no household can start.
In the apps
On supported iPhones and Android 13 or later, the microphone opens My Personal Space and turns speech into a draft using on-device recognition. Review and edit the words before sending. Microphone permission is requested when you use it. Desktop dictation is not included.
Not built
Asking that what is done with your own data be frozen while the data itself is kept. Nobody can ask for that, and nothing on the service does it.
Something else exists, and it is named here separately so the two are not mistaken for each other. A Creator or a Manager can hold a member back. Somebody held back can still read, still be exported and still sign out, and every write they attempt is refused. Nobody may hold themselves back. That is a household control rather than a right you hold over your own data, it is on the service, and no screen reaches it either.
In the apps
Scheduled reminders can repeat daily, weekly or monthly, including every other week, and deliver alerts to selected people. iPhone and Android support native push notifications; desktop notifications work while the app is running. Automatic daily summaries and broader autonomous work are not included.
Not built
Not every household wants to go and open a storage account. So there will be one Ridgeback holds on your behalf, at a price, for households that would rather not choose. What it does not change is the way out: the same export has to work whether the bucket is ours or yours, or the offer is a trap rather than a convenience.
Not built
The same shape for the assistant itself. A household that does not want to run a model, or rent one from somebody else, can have Ridgeback run it. Bobby speaks to every model through one interface, so this is a hosting decision rather than a different product.
Not built
Holding storage and running models costs money, so the managed versions are sold with a margin on top rather than at cost. That means real prices, more than one level of service, and a written agreement saying what is actually promised at each. None of those numbers exists yet, and a household running its own bucket and its own model stays outside all of it.
Not built
Home Assistant first, because it already bridges Google, Alexa and HomeKit and needs nobody's approval to do it. The permission that gates this, Control devices, is real and enforced today, with nothing wired to it yet. One awkward thing is already settled: a shared speaker cannot prove who is talking, so a request made by voice gets a restricted seat rather than yours.
Not built
Ordering the groceries, booking a table, reordering what the house always runs out of. Shopify and DoorDash already publish connectors of the kind he would use. What is settled is the safety rule: a skill or a shop a household adds reaches him as a remote service or as plain data, and never as code running on his own machine. Which shops, and whether anybody has agreed to any of it, is not.
Open questions
The roadmap says what is built. This says what is unanswered, which is a different kind of honesty and a shorter list. Nine of these sit in front of a privacy policy. Twelve of the thirteen are undecided; the thirteenth has its answer and is waiting on the code that would make the answer true, which is the same distinction the roadmap's middle state draws.
The transparency page describes how the software behaves today. That is not the same document as a privacy policy, and these nine stand between the two — eight of them undecided, and one decided with nothing enforcing it, which blocks a policy just the same. The transparency page carries each one in full, beside the thing it is a question about.
Settled: Not Hotdog LLC holds the data and answers for it. Which country's rules govern that is still open, and it decides what the rest of this list has to say.
A named person for questions about your data, and an address that reaches them.
The lawful reason for keeping each of the nine kinds the transparency page lists. One reason each, written down.
Who stores your photographs depends on the bucket your household picks, so the answer differs house to house. A rented AI would be a second. Which of those are ours to name and contract for has to be settled before the list can exist.
The rest is settled. Nothing expires on a timer, and a deletion finishes everywhere within 30 days. What the service writes down when something breaks is the one row still without a number.
The apps count how they are used — an app opened, a registration finished — under a random number made on the device and nothing that names anybody. How long those are held now has an answer: the raw usage goes after 30 days, and the counts left behind, which have nobody in them, are kept. Nothing enforces that yet. No sweep removes anything on that schedule, so the honest reading today is that the raw usage is still there and the number above is a decision rather than a description.
You ask to see or delete what is held about you. How long before you hear back is not set.
A term in somebody else's contract, so it is not ours to promise on their behalf. A household running its own AI closes this one completely.
Bobby is built for houses with young children in them, and the law treats their data differently. Who consents, and from what age, is unanswered.
Four questions about how the thing should behave. Nothing on this site draws an answer to any of them, because drawing one would read as a promise.
“Add oat milk to the list” changes something. Whether he does it and tells you, or asks before he does it, is undecided. No screen here shows a confirmation step.
There is no undo designed, so none is drawn. The tools that change things are marked as changes rather than reads, which is the most that can honestly be said today.
That there will be a bucket Ridgeback holds for you, and a model it runs for you, is decided. Whose hardware sits underneath either one, what it costs, and what is promised at each level of service are not.
Its own, or a rented one, and which company runs the rented one. It speaks to both the same way, so the choice changes nothing else about how Bobby behaves.
No lawyer has reviewed any of this. It describes how the software behaves and what has not been settled, and it is not a legal undertaking.