WanderTag — Family Architecture Spec
Product family: WanderTag, three tiers of anti-stalker, anti-platform-lock, anti-subscription tracker tag.
Tagline: A tracker that doesn't betray you.
Status: v1.0-candidate (architecture-complete, pre-EVT), 2026-04-24
---
1. Why this exists
The tracker tag market is dominated by Apple AirTag (~70 % share) with Tile, Chipolo, Samsung SmartTag, Pebblebee, Eufy, and Nut filling the rest. Every commercial tracker has the same core architecture:
- Platform-locked: requires Apple, Google, or Samsung account; tag is bricked if account is banned or platform changes.
- Default-broadcast: tag's location is shared to a global crowdsourced network with no per-relationship control.
- Closed protocol: bricked when the company exits or EOLs the product line.
- Surveillance-reciprocity: participating in the network means YOUR phone is constantly scanning for OTHER trackers.
- Stalking-tool weaponization: the AirTag stalking-disclosure pattern was retrofitted, not designed-in. The DULT industry-standard spec is a 4-year-late patch.
WanderTag inverts the model:
1. Pre-shared trust contacts only as the default pairing model, tag pairs to a person, not a network. 2. No platform broadcasting baseline: Apple Find My / Google Find My are opt-in Mode 2 toggles. 3. Anti-stalker DULT compliance from day 1, cross-platform, all 3 scanners (iOS, Google FMD, AirGuard). 4. Identity-aware covert mode for survivor scenarios with strict legal gates. 5. WanderSafeMesh LoRa community mesh + Meshtastic compatibility, open protocol, off-grid coverage. 6. eSIM cellular as opt-in pay-as-you-go (Standard + Ultra), never required. 7. No subscription baseline: Mini and most Standard use cases work free forever. 8. Repairability + 7-year parts + open STL accessories.
---
2. Three tiers
Tag Mini (price TBD): keychain coin
- Form factor: 35 × 35 × 6 mm cream-anodized aluminum disc, ~10 g
- Battery: CR2032 user-swap, ~12 months @ once-daily BLE+LoRa beacon
- Display: single saffron LED (status indicator)
- Buttons: none (pair via NFC tap)
- Radios: BLE 5.3 + LoRa 915 MHz US / 868 MHz EU + NFC tag (NTAG216)
- GPS: none, relies on BLE proximity + LoRa mesh hops + last-known-near-X
- Cellular: none
- Sensors: ICM-42688-P IMU (motion-aware sleep + tamper detection)
- NFC: tap-to-pair + tap-to-disable + tap-to-notify-owner
- Audible alert: none in v1.0 (BLE-coded audio chirp via DULT scanner; piezo deferred, see open decisions)
- IP rating: IP54 (dust + splash, not submersion)
- Use case: keys, bookbag, wallet, pet collar, remote control, luggage strap
- Killer feature: anti-platform-lock keychain tag at AirTag price point
Tag Standard (price TBD): full-featured tracker
- Form factor: 50 × 35 × 8 mm slate-anodized aluminum, ~22 g
- Battery: 250 mAh LiPo USB-C rechargeable, user-replaceable via T6 Torx + JST. ~30 days @ active GNSS-aware tracking, 90+ days @ stationary BLE-only.
- Display: 1.0″ E Ink Carta 1.2 panel (200×200 px), saffron-ringed status circle around panel; persistent without battery drain
- Buttons: panic button (saffron ring, 3-second hold, recessed under TPE cover) + multi-function button
- Radios: BLE 5.3 + LoRa 915/868 MHz + GNSS L1 + NFC NTAG216 + optional cellular eSIM (Quectel BG95-M3, hardware fitted, eSIM disabled by default, opt-in via app)
- GPS: u-blox MAX-M10S L1 multi-constellation, <2.5 m CEP
- Cellular eSIM: GSMA SGP.22 Consumer RSP, default profile Truphone IoT / 1NCE / Soracom IoT (opt-in pay-as-you-go)
- Sensors: ICM-42688-P IMU + Bosch BMP390 baro/temp + 70 dB piezo buzzer (DULT audible alert)
- NFC: tap-to-pair + tap-to-disable + tap-to-notify-owner + tap-to-pull-up-status-page
- IP rating: IP67 (dust-tight, 1 m / 30 min submersion)
- Use case: luggage, vehicle, professional gear, kid's bookbag (with consent), service-dog harness, expensive bicycle
- Killer feature: GPS + e-ink status + panic button + opt-in cellular fallback + anti-stalker
Tag Ultra (price TBD): flagship rugged
- Form factor: 60 × 40 × 12 mm Grade 5 titanium chassis with PVD diamond-like-carbon (DLC) charcoal-black coating + cream silicone-rubber bumper overmold + removable carabiner clip, ~38 g
- Battery: 500 mAh LiPo USB-C rechargeable + integrated 0.5 W Maxeon monocrystalline solar cell (sapphire crystal cover); user-replaceable. ~60 days @ active tracking, "indefinite ≥2 h direct sun / day" with solar.
- Display: 1.5″ E Ink Carta 1.2 panel (296×152 px), saffron backlight LED + saffron status ring; persistent
- Buttons: panic button + multi-function button + carabiner-clip release tab
- Radios: same as Standard plus external antenna option for LoRa (better long-range performance)
- GPS: u-blox MAX-M10S + active patch antenna (better cold-start)
- Cellular eSIM: included + active in roam mode by default (no auto-data; user opts in to per-use cellular)
- Sensors: same as Standard
- IP rating: IP68 (dust-tight, 1.5 m / 30 min submersion)
- MIL-STD-810G: drop test (Method 516.6 Procedure IV) + shock + vibration
- Use case: outdoor + travel + adventure + survivor + rugged professional + critical assets
- Killer feature: flagship anti-stalker tracker; titanium chassis; solar-perpetual; 5-radio architecture; carabiner-mountable
---
3. Hardware architecture
Block diagram (Standard / Ultra)
+-------------------------------------+
| Nordic nRF52840 |
| Raytac MDBT50Q-1MV2 | <- BLE 5.3, primary MCU
| ARM Cortex-M4F @ 64 MHz |
+--+--------+-----------+----------+--+
| | | |
| SPI0 | UART0 | UART1 | I2C
| | | |
+--v--+ +---v----+ +---v-----+ +--v--+
|SX12 | |MAX-M10S| | BG95-M3 | |IMU+ |
|62 | | GNSS | | LTE-M/ | | baro|
|LoRa | +--------+ | NB-IoT | +-----+
+-----+ +---------+
^
optional
(Std/Ultra)
+-------------------------------------+
| IT8951 e-ink driver | <- Std / Ultra only
| -> 1.0″ Carta 1.2 (Standard) |
| -> 1.5″ Carta 1.2 (Ultra) |
+-------------------------------------+
+-------------------------------------+
| NFC NTAG216 (passive) | <- all tiers
+-------------------------------------+
+-------------------------------------+
| ICM-42688-P IMU | <- all tiers
+-------------------------------------+
+-------------------------------------+
| Saffron LED + Piezo (Std/Ultra) |
+-------------------------------------+
Power:
Mini: CR2032 -> bypass -> rails
Std: USB-C -> BQ25180 -> 250 mAh LiPo -> rails
Ultra: USB-C -> BQ25180 (MPPT-aware) -> 500 mAh LiPo -> rails
^ Solar (0.5 W Maxeon) ----|
Chassis architecture per tier
Mini (cream aluminum disc):
- CNC milled 6061 aluminum, Type II anodized cream
- Single-piece body + screw-threaded back (twist-off for CR2032 swap)
- Keychain hole drilled through edge
- Saffron LED light-pipe through chassis face
Standard (slate aluminum):
- CNC milled 6061 aluminum, Type III hard-anodized slate
- Two-piece body (front + back) joined by 4× T6 Torx (captive)
- Paracord hole drilled through one end
- E-ink panel + saffron status ring on face
- Panic button under TPE-overmolded cover (saffron ring inset)
- USB-C captive cover (TPE plug-in)
Ultra (titanium + PVD-DLC + bumpers):
- CNC milled Grade 5 titanium, PVD diamond-like-carbon (DLC) charcoal-black coating
- Two-piece body + cream silicone-rubber bumper overmold (corner shock dampers)
- Removable carabiner clip (M3 flat-head + brass insert)
- Sapphire crystal over solar cell + e-ink display
- E-ink panel + saffron status ring on face + saffron backlight LED
- Panic button + multi-function button under TPE covers
- USB-C captive flap (TPE flap, IP68-rated when seated)
- Integrated solar cell on top surface
---
4. Firmware architecture
RTOS: Zephyr 3.7+ on Nordic nRF52840 Image partitioning:
- Bootloader (MCUboot, ~32 KB)
- DULT-disclosure firmware (locked partition, ~64 KB), third-party audited, signed key, no OTA without survivor-advocacy review
- Primary application (~512 KB)
- Secondary application (A/B OTA slot, ~512 KB)
- Meshtastic interop (~128 KB)
- Apple Find My Accessory protocol (Mode 2 opt-in, ~64 KB)
- Google Find My Device protocol (Mode 2 opt-in, ~64 KB)
- Storage (~256 KB)
Stack:
- BLE 5.3 + Apple Find My Accessory profile (Mode 2) + Google FMD profile (Mode 2)
- LoRa SX1262 + Meshtastic 2.4+ fork
- GNSS u-blox UBX protocol (Standard / Ultra)
- Cellular AT/QMI (Standard / Ultra optional, BG95)
- DULT key rotation + audible-alert state machine
- Pre-shared trust contacts encrypted message channel
- Identity-aware covert mode state machine
- A/B OTA via BLE companion or USB-C DFU
Companion apps:
- iOS: SwiftUI, HealthKit + HomeKit + Shortcuts integration
- Android: Kotlin Compose, Health Connect + Home + Matter integration
- Web: PWA, full-feature parity for non-mobile users
- All three apps speak the same WanderVerse cloud API (which is itself fully optional)
Standalone mode (Mode 1):
- Tag operates without any phone or app; pair via NFC tap to a one-time-passcode flow
- Trust contacts can be added via NFC tap from the contact's phone (the contact's phone provides their identity to the tag)
- Position discoverability via WanderSafeMesh (no phone required after setup)
WanderVerse mode (Mode 3):
- Tag joins WanderSafeMesh community LoRa mesh
- Position updates flow tag → mesh → WanderNode Hub → internet → trust contacts
- WanderNode Hub fleet view (multiple tags managed in a household)
- HAVEN safehouse integration for survivor scenarios
- WanderShield identity-aware data sharing
- WanderBand Ultra + WanderTag paired (watch can trigger tag panic)
---
5. The dual-mode architecture (Standard 0 compliance)
Per ../_STANDALONE-AND-PLATFORM-INTEGRATION.md, every WanderVerse product must work standalone, work deeper with WanderVerse, AND work at-or-above industry-standard with platform integrations.
Mode 1: Standalone (no phone, no platform)
Every WanderTag tier supports first-time setup, pair, panic, and operation via:
- NFC tap-to-pair on the tag itself
- LED / e-ink status (Mini: LED; Std/Ultra: e-ink + LED)
- Panic button (Std / Ultra)
- WanderSafeMesh discovery (no phone required)
- BLE proximity to trust contacts' phones (if they're nearby)
A normal consumer can buy a WanderTag, pair it to a friend's phone via NFC tap (no app install required on their friend's phone: NFC tap pulls up a web page that handles pairing), and use it without any app on their own device.
Mode 2: Phone companion + platform opt-in
iOS + Android + web apps add:
- Map view of tag positions
- Trust-contact management
- DULT scan results (your tags + tags near you)
- Apple Find My opt-in toggle (per tag)
- Google Find My Device opt-in toggle (per tag)
- Meshtastic interop view (your tags' positions on the community mesh map)
- Trip-share public link (for non-WanderVerse-account contacts)
- Trip-share trust-contact-only (safe-passage)
- eSIM management (Standard / Ultra optional)
- Identity-aware covert mode activation
Mode 3: WanderVerse ecosystem
WanderSafeMesh community mesh extends:
- LoRa mesh hop coverage (3-8 km LoS per hop, kilometers across mesh)
- WanderSafeMesh node hubs route mesh traffic to internet
- WanderNode Hub fleet view (multi-tag management for household / fleet)
- HAVEN safehouse silent-panic integration
- WanderShield identity-aware data sharing
- WanderBand Ultra + WanderTag paired (watch triggers tag panic)
Industry integrations required by Standard 0
- Apple Find My Accessory (Mode 2 opt-in), same protocol as Chipolo One Spot
- Apple HealthKit: trip metadata + fall alerts (if tag attached to person)
- Apple HomeKit / Shortcuts: automation triggers
- Google Health Connect: cross-platform parity
- Google Find My Device (Mode 2 opt-in)
- Google Home: automation triggers
- Matter commissioning: device discovery only
- Home Assistant: MQTT bridge in companion app
- Meshtastic open protocol: baseline default
- DULT industry-standard: anti-tracker scan compliance
---
6. Pricing summary
| Tier | Retail | Platform BOM (FOB) | Target margin (planning estimate) | Service plan |
|---|
| Tag Mini | TBD | ~$22.50 | ~42 % | none |
| Tag Standard (no eSIM) | TBD | ~$48.20 | ~46 % | none baseline |
| Tag Standard (eSIM enabled) | TBD | ~$48.20 | ~46 % product + 12 % cellular margin | optional cellular |
| Tag Ultra (eSIM enabled) | TBD | ~$96.40 | ~46 % | optional cellular |
See BOM-platform.csv for full breakdown.
---
7. Feature inventory (parity sweep)
| Feature | Mini | Standard | Ultra | AirTag | Tile Pro | Chipolo Spot | Samsung Tag2 | Pebblebee |
|---|
| BLE proximity range | 150 ft | 200 ft | 300 ft | 100 ft | 400 ft | 150 ft | 120 ft | 200 ft |
| LoRa community mesh | ✅ | ✅ | ✅ | — | — | — | — | — |
| GPS | — | ✅ | ✅ | — | — | — | — | — |
| Cellular eSIM (opt-in) | — | optional | optional | — | — | — | — | — |
| Persistent e-ink display | — | ✅ | ✅ | — | — | — | — | — |
| Panic button | — | ✅ | ✅ | — | ✅ (find-phone) | ✅ (find-phone) | ✅ | ✅ |
| Apple Find My (opt-in) | ✅ | ✅ | ✅ | ✅ default | — | ✅ | — | ✅ |
| Google FMD (opt-in) | ✅ | ✅ | ✅ | — | — | — (One Point only) | — | ✅ |
| Meshtastic open protocol | ✅ | ✅ | ✅ | — | — | — | — | — |
| Pre-shared trust contacts (max 8) | ✅ | ✅ | ✅ | — | — | — | — | — |
| No-platform-broadcast default | ✅ | ✅ | ✅ | — | — | — | — | — |
| DULT compliance (cross-platform) | ✅ | ✅ | ✅ | partial | partial | partial | partial | partial |
| Identity-aware covert mode | ✅ | ✅ | ✅ | — | — | — | — | — |
| User-replaceable battery | ✅ CR2032 | ✅ LiPo | ✅ LiPo | ✅ CR2032 | ✅ CR2032 (2024+) | ✅ CR2032 | ✅ CR2032 | — (glued) |
| USB-C charging | — | ✅ | ✅ | — | — | — | — | ✅ |
| Solar charging | — | — | ✅ | — | — | — | — | — |
| IP rating | IP54 | IP67 | IP68 | IP67 | IP68 | IP67 | IP67 | IP67 |
| MIL-STD-810G | — | shock | shock+vibe | — | — | — | — | — |
| Open STL accessories | ✅ | ✅ | ✅ | — | — | — | — | — |
| Ambassador-assembled + Signature | ✅ | ✅ | ✅ | — | — | — | — | — |
| 7-year parts | ✅ | ✅ | ✅ | — | — | — | — | — |
| No-subscription baseline | ✅ | ✅ | partial | ✅ | ✅ (Premium yearly price TBD extra) | ✅ | ✅ | ✅ |
| Companion app polish | functional | functional | functional | mature | mature | mature | mature | mature |
| Network density | mesh | mesh | mesh | ~1B iPhones | ~40M | ~1B (Apple) | Galaxy | both nets |
| UWB precision | — | — | — | ✅ U1 | — | — | ✅ Galaxy | — |
| Retail price (USD) | TBD | TBD | TBD | $29 | $35 | $35 | $30 | $40 |
Coverage: 22 / 25 features green vs competitor field. The 3 we don't ship in v1.0: UWB precision (v2.0), Apple-network-density default (by design), absolute-cheapest price ($15 Nut tier, different segment).
---
8. Standalone-mode commitment
A WanderTag Mini is a complete product with zero other WanderVerse purchases:
- Pair via NFC tap to friend's phone (one-time setup web page, no app required)
- Add up to 8 trust contacts via SMS / email / NFC tap
- BLE proximity finding works (~150 ft)
- LoRa proximity to other Meshtastic nodes works (no WanderSafeMesh node required, open community Meshtastic mesh)
- DULT discovery works on iOS / Android / AirGuard
A normal consumer can buy a WanderTag and love it without buying another WanderVerse product.
WanderNode Hub, WanderRouter Ultra, WanderBand, etc., plus WanderSafeMesh, the nonprofit community mesh (wanderingwithpride.org), add depth (longer mesh range, fleet view, ecosystem integration) but are never required.
---
9. Privacy commitment summary
1. No telemetry by default. Mini and Standard (without eSIM) emit only DULT-disclosure beacons + encrypted Meshtastic mesh updates to the user's pre-shared trust contacts. No telemetry to WanderVerse. 2. No platform broadcasting by default. Apple Find My / Google Find My are opt-in. 3. End-to-end encryption of trust-contact channel with per-tag PSK. 4. Open audit: DULT firmware partition is locked + signed + third-party audited. 5. Audit log of covert-mode activations is on-device + E2E to user (not server-readable). 6. No mass-pair / wide-network surveillance. Max 8 trust contacts. 7. No identity-leak in mesh broadcast, all WanderVerse-protocol payloads are opaque to non-trust-contacts.
---
10. Stage-10 BLOCKERS (cannot ship without)
1. Anti-stalker advisory review (NNEDV / NCADV / Project Safe Hands consultation): RED 2. Identity-aware covert mode legal review: RED 3. DULT cross-platform interop verification (iOS Tracker Detect + Google FMD + AirGuard): RED
These are not soft gates. WanderTag is the product where shipping early is worse than not shipping. We will defer launch indefinitely if any of the 3 are unresolved.
---
See _MANIFEST.md for revision history, ship targets, and revenue integration. See DECISIONS.md for the full decision log. See _VALIDATION-AND-SENSOR-EXPANSION.md for the safety architecture deep-dive. See _COMPETITIVE-AUDIT-2026-04-24.md for the full competitive analysis.
---
Radio architecture v2: LR2021 migration (2026-04-25)
Primary radio: Semtech LR2021 (LoRa Gen 4 / LoRa Plus). Replaces previous multi-chip radio architecture (SX1262 + nRF52840 + CC2652R7 collapsed to one).
What this unlocks
- 40× throughput: 62.5 kbps → 2.6 Mbps via FLRC modulation. Enables: image snapshots over LoRa, voice / walkie-talkie, AI-edge inference output streaming, audio classification.
- Multi-PHY in one chip: LoRaWAN + Sidewalk + Meshtastic + Z-Wave + Wi-SUN + BLE + Thread/Zigbee. Single global SKU; no regional variants required.
- Direct-to-satellite (S-band 1.9–2.5 GHz NTN), phone home from anywhere on Earth, no cell tower. Game-significant for at-risk-user use cases (DV-survivor escape from anywhere, wilderness emergency).
- -142 dBm sensitivity: best-in-class link budget (vs SX1262 -137 dBm).
Migration strategy: hybrid
This product is Tier-1 critical (life-safety / DV-survivor flagship / global-supply-chain anchor). Hybrid alt-source path retained:
- Founding-tier SKU: SX1262 + nRF52840 (proven dual-source). No FLRC voice, no satellite. Lower cost, regional-variant-required.
- Pro / Global SKU: LR2021 single-chip multi-PHY + S-band NTN. FLRC voice, satellite emergency, AI-edge inference, single global SKU.
Customer chooses at purchase. Spec tables list both with cross-references.
Cert path additions
- FCC Part 25 NTN earth-station registration, required for S-band satellite operation. Engagement budget ~$30–60k via TÜV SÜD or Element. Pro tier only.
- FCC Part 15 Subpart C: sub-GHz + 2.4 GHz emissions (existing cert covers; verify LR2021 module FCC ID propagates).
- CE / UKCA / IC / AS-NZS: international filings updated to reference LR2021 module.
Capability bullets for marketing copy
- Phone home from anywhere: direct-to-satellite, no cell tower (Pro tier)
- Multi-protocol mesh: LoRaWAN, Amazon Sidewalk, Meshtastic, Z-Wave, BLE, Thread, Wi-SUN
- Single global SKU: no US/EU regional variants
- 40× faster radio than the previous generation, in the same power envelope
---
**Note (Perplexity-validated 2026-04-25):** When this doc says LR2021 supports multi-PHY in one chip, the *hardware* is multi-PHY-capable, but full protocol stacks (LoRaWAN, Amazon Sidewalk, Meshtastic, Z-Wave, Wi-SUN, BLE, Thread/Zigbee) integrate via firmware layers, not all bundled native. We ship pre-built stacks for the active set per product. See `PERPLEXITY-VALIDATION-2026-04-25.md` in `_WANDERVERSE-LIBRARY/`.