A presence ring that remembers nothing

Every profile photo in Nemi sits inside a thin coloured ring. It used to be coloured by the plan that account paid for, which is the one fact about a person that never changes between one look and the next. We replaced it with something you can actually use: what that person is doing right now.

Presence is useful and it is also exactly the kind of feature that turns into surveillance without anybody deciding it should. A green dot becomes a “last seen” line, the line becomes a history, and the history becomes a report on who was at their desk. So the ring was built the other way round. We started from what it must never be able to say, and made those things impossible to store rather than merely hidden.

What does the ring around a profile photo show?

One of five things about what you are doing: that you have Nemi open, that you are working on a document, that you are moving files, that you are in a call, or that you were here a moment ago and your tab has gone to the background. On your own photo, and only there, it also shows how full your storage is. Each of those is an arc of the ring, and when two are true at once they share the circle with a soft crossfade between them.

This is the real thing. The ring below is drawn by the same component markup, the same painter and the same animation code as the one in the app. The only difference is that you are deciding what Anna is doing, instead of her browser.

The ring turns, and how fast tells you something without a label. A call turns it once every 9 seconds; simply having Nemi open, once every 26. The liveliest signal sets the pace. If you have asked for less motion, on your device or in Nemi's own accessibility settings, it holds still and shows the same colours. And colour is never the only carrier: hover a ring and it says the same thing in words, and a screen reader reads that sentence out.

Who can see whether I am online?

Only the people you already work with in Nemi: somebody you are connected with, or a member of a workspace you are in. A connection is mutual, so it takes both of you to agree to it. Nobody else can ask for your ring, and an account id copied off a page gets nothing back. Presence is not a directory. The statistics on a link you send are built with the same instinct: record as little about people as the feature needs.

That check is done on our servers, for every ring, every time. A screen that shows avatars asks for up to 60 of them in one request, and this is what happens to that list before an answer goes back.

The switch is in Settings, under Style. Turning it off is silent: to everybody else you look like somebody who is not in Nemi at the moment, not like somebody who has hidden. A badge saying “presence hidden” would be a status of its own, and people would read it as one. Your own ring keeps working on your own screen either way. The help page on the ring walks through it.

Why is storage only on my own ring?

Because how close you are to your limit is nobody else's business, and the safe way to keep something private is to never send it. The tempting design is to compute one ring per person and dim the private parts when a colleague is looking. That puts the private part in every colleague's browser, one forgotten condition away from being drawn.

Nemi does the opposite. Every signal declares who it is for, and the ring a colleague receives is built from a list that never contained your storage in the first place. A bug in a component cannot leak a number the component was never given. That is what the playground shows when you switch the viewer: the storage arc does not fade, it is simply not there.

Does Nemi keep a history of when I was working?

No, and it could not hand one over if asked, because none is written. What is stored is one row per account holding one word and one timestamp: what your browser last said you were doing, and when. Every report overwrites that row. Nothing is appended, so there is nowhere a history could accumulate.

The row holds no object either. It can say “in a meeting” and it cannot say which meeting, because the column has nowhere to put one. The same goes for which document, which file, which workspace and which page. A contact list is entitled to “working on a document”; it is not entitled to the name of the document, and the cheapest way to keep that promise is to have no field for it.

The honest way not to build a log of who worked when is to have nowhere to put it.

A policy that says “we do not look at the log” can change in an afternoon. A table with one row per person cannot become a history without somebody building a different table, and the privacy policy states the shape in section 3.20 so that change would be visible. The one word is stored as it is, not encrypted the way what you write is, because it is a status rather than something you wrote.

When does the ring go quiet?

Your browser reports what you are doing only while a Nemi tab is open and in front of you. It reports when that changes, and otherwise once a minute. A tab in the background does not send the regular report, which is what makes “away” mean something without a timer of ours having to decide whether you are at your desk. The server then reads the age of that one row.

The gap between those numbers is deliberate. A ring that blinks off whenever one report is late teaches people to distrust it, so a report keeps you present for two and a half minutes, long enough to survive one that went missing. After that the ring says away. After twenty minutes it stops saying anything, because a person who closed their laptop at six has not told anybody that they are “away”; they have simply gone home.

What are the downsides of presence without a history?

Being unable to remember has real downsides, and we chose them. There is no “last seen three hours ago”. You cannot look back and see when a colleague was around yesterday, and neither can an administrator. A ring can be up to a couple of minutes behind the truth, because it is fed by a report a minute rather than a live connection per person. And a guest who opens a share link has no account, so they have no ring and nothing about them is recorded here at all.

So the ring answers one question, now, for the right people, and then forgets. If you are in a Meet call it says so to your team, and when the call ends there is no record that it ever did. How the call itself travels is a story of its own.