The Right-Moment Doctrine

1. The shape of the forgotten financial layer

Gift cards are the most-studied corner of a much larger pattern. When industry reports talk about unredeemed gift cards they reach for one of two numbers. The first is the annual breakage figure, roughly $3 billion, which is the new value added each year that consumers are statistically unlikely to ever redeem. The second is the cumulative outstanding figure, roughly $27 billion, which is the total value of cards still sitting in American drawers, wallets, email inboxes, and glove compartments at any given moment. Both are underestimates, because neither captures partial balances, trailing dollars, or cards written off on the merchant side before they show up as a liability.

But gift cards are only one of five categories of pre-paid value that constitute what we call the forgotten financial layer , the slice of household wealth that sits between the checking account and the credit card, fully owned but functionally invisible:

• Gift cards , $150–$300 per household in stuck balances; ~10–19% never fully redeemed.
• Punch passes & class packs , 30–50% under-redemption across fitness, salons, and prepaid services; a $300 ten-pack with four sessions left is $120 of dusty dollars on the table.
• Loyalty rewards , ~$170 per household in unredeemed value; people belong to ~15 programs but actively use 7.
• Memberships , Sam's Club Plus's $50 annual cashback, REI's annual dividend, AAA, BJ's One+ 2% back, gym perks; mostly unredeemed because nobody surfaces them at the moment of decision.
• Prepaid debit , tens of billions of dollars in aggregate float across Visa Gift, Mastercard Gift, and retailer-specific prepaid; a single forgotten card averages $30–$60 in unspent balance.

Added up for an engaged household, the realistic recoverable number from this forgotten financial layer lands in the $200–$500 per year range. We call them dusty dollars in the team because that's what the user-research interviews kept returning: the money is fine, it just hasn't been touched in a while. The remainder of this paper uses gift cards as the worked example because the data is the most-public, but the doctrine applies identically to all five.

The reflexive framing is that people are simply forgetful, or that gift cards are inferior gifts, or that merchants benefit from breakage and therefore don't care. All three framings are partially true and collectively unhelpful. They push the problem toward the consumer and away from the product. If someone has to remember something on a Tuesday afternoon that they received in a birthday card in October, that is not a memory failure, that is a cueing failure, and cueing is an interface problem.

2. The five-step chain and why it breaks

For any given unused gift card, there is a five-step chain that has to complete in order for the value to move from latent to redeemed. The chain looks small on paper and is almost impossible in practice because every step is a memory step.

Every step is a probability, and the probabilities compound. If each of five independent steps has an 80% success rate, the overall redemption rate is 33%. This matches what the industry sees. Step one is the hardest because it happens in the absence of any external cue. Step five is the one most product designers underestimate, because they have never stood at a Chipotle register behind the user whose phone is not cooperating.

Step two is the one leverage point. If a person remembers the card when they walk into the merchant, and only then, steps three through five become almost automatic. Step one and step two are the same memory event, separated in time. Most wallet apps solve step one: they let you save the card. Almost none of them solve step two, because step two is not in the app, it is in a geofence on a sidewalk.

3. The Right-Moment Doctrine

Most writing on wallet-app UX fixates on the register, as if that were the only hard moment. It isn't. A gift card has three moments where the user has to do something: intake (getting the card into the wallet), cue (being reminded it's worth using, at the time and place it's worth using), and redemption (opening to the right screen and paying). Wallet apps have generally optimized one. The Right-Moment Doctrine treats all three as the same problem: the wallet has to show up with the right card at the right time, in the right place, and ask for almost none of the user's attention to do it.

The doctrine's leverage isn't a stopwatch number; it's what the app rules out in between the three moments. No login walls. No modal onboarding. No synchronous network on the hot path. No loading spinner over the wallet list. No notification that routes anywhere other than the card itself. Between intake and the register, the user should not think about the app at all , it's watching location, expirations, and balances in the background so they don't have to.

That is what the team means by effortless. The chain in §2 has five probabilistic steps; the app can't remove them, but it can absorb them , remembering for the user, cueing at the right moment, opening to the right screen when tapped. The user supplies a few deliberate moments. The app supplies everything else.

"The user's attention across the whole card lifecycle is a tiny, fragile volume of time. A good wallet app is architected around spending none of it on setup and all of it on the moment the card is actually worth something."

4. Four parts, one shape

Eight seconds is not a single feature. It is the output of four systems that only work when they work together. Each is documented at length in its own press kit; what matters here is how they interlock.

The brain decides

Underneath every alert is a ranker that evaluates five gates before saying anything: where (is a card usable here?), when (is this a reasonable hour for this category?), how fast (on foot or in a car?), how often (has this card been mentioned recently?), and in what mood (is the user at home, in Focus, or inside a quiet zone they drew themselves?). Each gate can veto. All five must agree before anything surfaces. Most of the engineering is spent on reasons not to speak.

Smart Profiles re-tune the brain to the neighborhood

The five gates are themselves parameterized. A 50-meter geofence radius is correct on a city street and wrong on a country road; the same dwell timer that keeps an urban store from misfiring would let a rural drive-by escape entirely. Smart Profiles re-tune those parameters based on what kind of place the user actually lives in. Urban gets tight rings (150m, 30s dwell). Suburban opens to walking-from-the-parking-lot (350m, 45s). Rural widens further (800m, 75s) and quietly recommends CarPlay. Smart , the recommended default , classifies your home neighborhood and re-classifies on travel; if you drive from a city to a small town, the rings widen during the drive without any manual change.

The classifier itself is the interesting privacy decision. The naive implementation would send your coordinates to a server and ask for a label; that's a privacy violation dressed up as intelligence. The actual implementation rounds latitude and longitude to a 1km grid square before the network call, so the finer-grained number doesn't even exist on the wire. The server caches by grid cell, not by user, which means two people on the same block share the same answer without either appearing in the other's request log. On a cache miss, the server asks Claude Haiku to classify the cell as urban / suburban / rural / unknown using only the rounded coordinate; Claude has no user ID, no card list, no purchase history. The result returns one word, gets cached for 90 days, and the request is gone. The whole pipeline expresses a thesis we believe more broadly: apps should adjust to the user's environment, not the other way around.

The Conductor delivers

One file, NotificationConductor, is the only thing in the app that writes to the phone's banners, the Watch haptic, the Dynamic Island, a widget, or CarPlay. A typed AlertEvent goes in; a SurfaceSet comes out , the smallest collection of surfaces that should light up for this moment. Watch haptic fired a second ago? Phone banner suppressed. User in CarPlay? Nothing buzzes. A shopping plaza tripped four geofences in 90 seconds? One cluster banner, not four. The Conductor is how the same alert never fires twice on the same person.

The privacy architecture is the shape

The brain's inputs , location, dismissal history, the user's home geofence, calendar context , never leave the device. The wallet is a SwiftData store on disk; secrets are biometric-gated on reveal; the Widget and Watch read a read-only App Group snapshot that contains no card numbers or PINs. Accounts are opt-in and the core app works without one. No third-party tracking SDKs, no IDFA access, no ATT prompt. The one piece of data that leaves is the single image you point at the scanner, sent to one vendor under a Zero-Data-Retention agreement , and a Settings toggle turns even that off.

The voice earns the two seconds

The cue lands in about seven words: "Target · $47 · you're a block away." Warm, specific, quiet. Short enough to read at a glance on a lock screen while walking, legible through VoiceOver, unlikely to feel like marketing. When the data has earned it, the voice has one more gear , "This card has been waiting longer than most streaming subscriptions survive" , because a line a friend might say has a better chance of moving a user than a line a SaaS might.

Each of those four is, on its own, unremarkable. The product is the claim that all four of them, and nothing else, is what a wallet app should be.

5. Why this shape can't be copied onto a server

The faster way to build Cue is to put the brain in the cloud. Upload the location stream, the wallet, the dismiss log. Score every candidate alert on a server. Push the decision back to the phone. We aren't going to do that, and we couldn't without breaking the product's first promise.

A cloud-ranked wallet has three ways to work, and every one of them is disqualifying:

1. Stream location. The server has to know where the user is, which means a continuous upload of GPS points, which means a dossier of the user's daily movements sitting on a vendor's disk.
2. Upload the wallet. For the ranker to know which card is relevant, the server needs the card list, which in practice means card numbers and PINs in a cloud database somewhere, protected by whatever that vendor's worst day looks like.
3. Attach a tracking identifier. Even the "privacy-preserving" versions of this path need a stable user ID to correlate a location ping to a wallet , the thing we've already committed not to collect.

Every server shortcut ends at one of those three. So the product is engineered the harder way on purpose: the brain runs on the phone, the Conductor runs on the phone, the wallet lives on the phone, and the one network call it does make is a single image to a vendor under a Zero-Data-Retention contract , not a stream, not an identity, not a history. The shape of the product is the shape of what you can actually do inside iOS without overstepping.

That isn't a moral flourish. It's the constraint the rest of the app is built to honor, and the reason it looks the way it does.

"Breakage is not a consumer failure. It is a cueing failure that has been billed to the consumer."

6. The Share-from-Mail primitive

The doctrine assumes the card is already in the wallet. A separate failure mode is that it never got added. Camera scanning is great for physical cards and less great for emailed ones, which arrive as HTML with codes split across rendered elements.

The Share Extension turns any email into a card. Open it in Mail, tap Share, pick CardCue Pro. An on-device regex extractor reads brand, balance, card number, PIN, expiration, balance-check URL, and redemption URL out of the text, writes them to an App Group slot, and hands off to the main app, which drains the slot and shows a pre-filled form.

7. The wallet on your phone

One quiet consequence of getting redemption right is that the physical card stops being load-bearing. After a card is digitised , a barcode and a front photo on file, the secure-barcode requirement met , the card itself becomes a backup, not a requirement. The user can leave the plastic in a drawer at home and walk into the store with only a phone. The cashier scans the screen; the transaction completes; the customer walks out without ever having handled the original card.

This is the small, almost unmarketable everyday convenience that the Right-Moment Doctrine ultimately delivers: a wallet that follows the user instead of the user following the wallet. Most retail-loyalty apps do this for one specific brand. CardCue Pro does it across a wallet of dozens of issuers without asking the user to install thirty branded apps.

The doctrine has limits. Cards whose value is encoded in a magnetic stripe alone, in an EMV chip, or in a card-present-only prepaid network , branded prepaid debit, the open-loop Visa and Mastercard prepaid cards typically sold as gifts, anything carrying a security chip with a PIN , cannot be redeemed digitally on present hardware. CardCue Pro tracks their balances and surfaces their PINs through the same biometric gate as every other card, but the card itself still has to ride along. That gap is a property of the payment rails, not the wallet app, and it persists for now.

For everything else , and that is the majority of consumer gift cards, loyalty cards, and reward certificates by issuer count , the user's experience converges on a single sentence: your cards are always with you, and ready to use.

8. Conclusion

The $27 billion is a mirror. It shows what happens when interface design picks the wrong moments and asks the user to remember, configure, and maintain. The Right-Moment Doctrine says the three moments that matter , intake, cue, redemption , should, together, take eight seconds of the user's time. None of that works without the brain that scores, the Conductor that routes, the voice that reads at a glance, and the privacy architecture that keeps all of it running without touching a cloud.

Cue is the version of that wallet app we've been able to build. It is small, it is opinionated, and it is quiet by default. The hope is that a user who installs it forgets it exists until the day it reminds them of a $50 balance at a Target they're already walking toward, and then quietly goes back to being forgotten.