WanderTag — Family Architecture Spec
Product family: WanderTag — three tiers of anti-stalker, anti-platform-lock, anti-subscription tracker tag.
Tagline: A tracker that doesn't betray you.
Status: v1.0-candidate (architecture-complete, pre-EVT), 2026-04-24
---
1. Why this exists
The tracker tag market is dominated by Apple AirTag (~70 % share) with Tile, Chipolo, Samsung SmartTag, Pebblebee, Eufy, and Nut filling the rest. Every commercial tracker has the same core architecture:
- Platform-locked: requires Apple, Google, or Samsung account; tag is bricked if account is banned or platform changes.
- Default-broadcast: tag's location is shared to a global crowdsourced network with no per-relationship control.
- Closed protocol: bricked when the company exits or EOLs the product line.
- Surveillance-reciprocity: participating in the network means YOUR phone is constantly scanning for OTHER trackers.
- Stalking-tool weaponization: the AirTag stalking-disclosure pattern was retrofitted, not designed-in. The DULT industry-standard spec is a 4-year-late patch.
WanderTag inverts the model:
1. Pre-shared trust contacts only as the default pairing model — tag pairs to a person, not a network. 2. No platform broadcasting baseline — Apple Find My / Google Find My are opt-in Mode 2 toggles. 3. Anti-stalker DULT compliance from day 1 — cross-platform, all 3 scanners (iOS, Google FMD, AirGuard). 4. Identity-aware covert mode for survivor scenarios with strict legal gates. 5. WanderStation LoRa community mesh + Meshtastic compatibility — open protocol, off-grid coverage. 6. eSIM cellular as opt-in pay-as-you-go (Standard + Ultra) — never required. 7. No subscription baseline — Mini and most Standard use cases work free forever. 8. Repairability + 7-year parts + open STL accessories.
---
2. Three tiers
Tag Mini — $39 — keychain coin
- Form factor: 35 × 35 × 6 mm cream-anodized aluminum disc, ~10 g
- Battery: CR2032 user-swap, ~12 months @ once-daily BLE+LoRa beacon
- Display: single saffron LED (status indicator)
- Buttons: none (pair via NFC tap)
- Radios: BLE 5.3 + LoRa 915 MHz US / 868 MHz EU + NFC tag (NTAG216)
- GPS: none — relies on BLE proximity + LoRa mesh hops + last-known-near-X
- Cellular: none
- Sensors: ICM-42688-P IMU (motion-aware sleep + tamper detection)
- NFC: tap-to-pair + tap-to-disable + tap-to-notify-owner
- Audible alert: none in v1.0 (BLE-coded audio chirp via DULT scanner; piezo deferred — see open decisions)
- IP rating: IP54 (dust + splash, not submersion)
- Use case: keys, bookbag, wallet, pet collar, remote control, luggage strap
- Killer feature: anti-platform-lock keychain tag at AirTag price point
Tag Standard — $89 — full-featured tracker
- Form factor: 50 × 35 × 8 mm slate-anodized aluminum, ~22 g
- Battery: 250 mAh LiPo USB-C rechargeable, user-replaceable via T6 Torx + JST. ~30 days @ active GNSS-aware tracking, 90+ days @ stationary BLE-only.
- Display: 1.0″ E Ink Carta 1.2 panel (200×200 px), saffron-ringed status circle around panel; persistent without battery drain
- Buttons: panic button (saffron ring, 3-second hold, recessed under TPE cover) + multi-function button
- Radios: BLE 5.3 + LoRa 915/868 MHz + GNSS L1 + NFC NTAG216 + optional cellular eSIM (Quectel BG95-M3, hardware fitted, eSIM disabled by default — opt-in via app)
- GPS: u-blox MAX-M10S L1 multi-constellation, <2.5 m CEP
- Cellular eSIM: GSMA SGP.22 Consumer RSP, default profile Truphone IoT / 1NCE / Soracom IoT (opt-in pay-as-you-go)
- Sensors: ICM-42688-P IMU + Bosch BMP390 baro/temp + 70 dB piezo buzzer (DULT audible alert)
- NFC: tap-to-pair + tap-to-disable + tap-to-notify-owner + tap-to-pull-up-status-page
- IP rating: IP67 (dust-tight, 1 m / 30 min submersion)
- Use case: luggage, vehicle, professional gear, kid's bookbag (with consent), service-dog harness, expensive bicycle
- Killer feature: GPS + e-ink status + panic button + opt-in cellular fallback + anti-stalker
Tag Ultra — $179 — flagship rugged
- Form factor: 60 × 40 × 12 mm Grade 5 titanium chassis with PVD diamond-like-carbon (DLC) charcoal-black coating + cream silicone-rubber bumper overmold + removable carabiner clip, ~38 g
- Battery: 500 mAh LiPo USB-C rechargeable + integrated 0.5 W Maxeon monocrystalline solar cell (sapphire crystal cover); user-replaceable. ~60 days @ active tracking, "indefinite ≥2 h direct sun / day" with solar.
- Display: 1.5″ E Ink Carta 1.2 panel (296×152 px), saffron backlight LED + saffron status ring; persistent
- Buttons: panic button + multi-function button + carabiner-clip release tab
- Radios: same as Standard plus external antenna option for LoRa (better long-range performance)
- GPS: u-blox MAX-M10S + active patch antenna (better cold-start)
- Cellular eSIM: included + active in roam mode by default (no auto-data; user opts in to per-use cellular)
- Sensors: same as Standard
- IP rating: IP68 (dust-tight, 1.5 m / 30 min submersion)
- MIL-STD-810G: drop test (Method 516.6 Procedure IV) + shock + vibration
- Use case: outdoor + travel + adventure + survivor + rugged professional + critical assets
- Killer feature: flagship anti-stalker tracker; titanium chassis; solar-perpetual; 5-radio architecture; carabiner-mountable
---
3. Hardware architecture
Block diagram (Standard / Ultra)
+-------------------------------------+
| Nordic nRF52840 |
| Raytac MDBT50Q-1MV2 | <- BLE 5.3, primary MCU
| ARM Cortex-M4F @ 64 MHz |
+--+--------+-----------+----------+--+
| | | |
| SPI0 | UART0 | UART1 | I2C
| | | |
+--v--+ +---v----+ +---v-----+ +--v--+
|SX12 | |MAX-M10S| | BG95-M3 | |IMU+ |
|62 | | GNSS | | LTE-M/ | | baro|
|LoRa | +--------+ | NB-IoT | +-----+
+-----+ +---------+
^
optional
(Std/Ultra)
+-------------------------------------+
| IT8951 e-ink driver | <- Std / Ultra only
| -> 1.0″ Carta 1.2 (Standard) |
| -> 1.5″ Carta 1.2 (Ultra) |
+-------------------------------------+
+-------------------------------------+
| NFC NTAG216 (passive) | <- all tiers
+-------------------------------------+
+-------------------------------------+
| ICM-42688-P IMU | <- all tiers
+-------------------------------------+
+-------------------------------------+
| Saffron LED + Piezo (Std/Ultra) |
+-------------------------------------+
Power:
Mini: CR2032 -> bypass -> rails
Std: USB-C -> BQ25180 -> 250 mAh LiPo -> rails
Ultra: USB-C -> BQ25180 (MPPT-aware) -> 500 mAh LiPo -> rails
^ Solar (0.5 W Maxeon) ----|
Chassis architecture per tier
Mini (cream aluminum disc):
- CNC milled 6061 aluminum, Type II anodized cream
- Single-piece body + screw-threaded back (twist-off for CR2032 swap)
- Keychain hole drilled through edge
- Saffron LED light-pipe through chassis face
Standard (slate aluminum):
- CNC milled 6061 aluminum, Type III hard-anodized slate
- Two-piece body (front + back) joined by 4× T6 Torx (captive)
- Paracord hole drilled through one end
- E-ink panel + saffron status ring on face
- Panic button under TPE-overmolded cover (saffron ring inset)
- USB-C captive cover (TPE plug-in)
Ultra (titanium + PVD-DLC + bumpers):
- CNC milled Grade 5 titanium, PVD diamond-like-carbon (DLC) charcoal-black coating
- Two-piece body + cream silicone-rubber bumper overmold (corner shock dampers)
- Removable carabiner clip (M3 flat-head + brass insert)
- Sapphire crystal over solar cell + e-ink display
- E-ink panel + saffron status ring on face + saffron backlight LED
- Panic button + multi-function button under TPE covers
- USB-C captive flap (TPE flap, IP68-rated when seated)
- Integrated solar cell on top surface
---
4. Firmware architecture
RTOS: Zephyr 3.7+ on Nordic nRF52840 Image partitioning:
- Bootloader (MCUboot, ~32 KB)
- DULT-disclosure firmware (locked partition, ~64 KB) — third-party audited, signed key, no OTA without survivor-advocacy review
- Primary application (~512 KB)
- Secondary application (A/B OTA slot, ~512 KB)
- Meshtastic interop (~128 KB)
- Apple Find My Accessory protocol (Mode 2 opt-in, ~64 KB)
- Google Find My Device protocol (Mode 2 opt-in, ~64 KB)
- Storage (~256 KB)
Stack:
- BLE 5.3 + Apple Find My Accessory profile (Mode 2) + Google FMD profile (Mode 2)
- LoRa SX1262 + Meshtastic 2.4+ fork
- GNSS u-blox UBX protocol (Standard / Ultra)
- Cellular AT/QMI (Standard / Ultra optional, BG95)
- DULT key rotation + audible-alert state machine
- Pre-shared trust contacts encrypted message channel
- Identity-aware covert mode state machine
- A/B OTA via BLE companion or USB-C DFU
Companion apps:
- iOS: SwiftUI, HealthKit + HomeKit + Shortcuts integration
- Android: Kotlin Compose, Health Connect + Home + Matter integration
- Web: PWA, full-feature parity for non-mobile users
- All three apps speak the same WanderVerse cloud API (which is itself fully optional)
Standalone mode (Mode 1):
- Tag operates without any phone or app; pair via NFC tap to a one-time-passcode flow
- Trust contacts can be added via NFC tap from the contact's phone (the contact's phone provides their identity to the tag)
- Position discoverability via WanderStation mesh (no phone required after setup)
WanderVerse mode (Mode 3):
- Tag joins WanderStation community LoRa mesh
- Position updates flow tag → mesh → WanderStation → internet → trust contacts
- WanderNode Hub fleet view (multiple tags managed in a household)
- HAVEN safehouse integration for survivor scenarios
- WanderShield identity-aware data sharing
- WanderBand Ultra + WanderTag paired (watch can trigger tag panic)
---
5. The dual-mode architecture (Standard 0 compliance)
Per ../_STANDALONE-AND-PLATFORM-INTEGRATION.md, every WanderVerse product must work standalone, work deeper with WanderVerse, AND work at-or-above industry-standard with platform integrations.
Mode 1 — Standalone (no phone, no platform)
Every WanderTag tier supports first-time setup, pair, panic, and operation via:
- NFC tap-to-pair on the tag itself
- LED / e-ink status (Mini: LED; Std/Ultra: e-ink + LED)
- Panic button (Std / Ultra)
- WanderStation mesh discovery (no phone required)
- BLE proximity to trust contacts' phones (if they're nearby)
A normal consumer can buy a WanderTag, pair it to a friend's phone via NFC tap (no app install required on their friend's phone — NFC tap pulls up a web page that handles pairing), and use it without any app on their own device.
Mode 2 — Phone companion + platform opt-in
iOS + Android + web apps add:
- Map view of tag positions
- Trust-contact management
- DULT scan results (your tags + tags near you)
- Apple Find My opt-in toggle (per tag)
- Google Find My Device opt-in toggle (per tag)
- Meshtastic interop view (your tags' positions on the community mesh map)
- Trip-share public link (for non-WanderVerse-account contacts)
- Trip-share trust-contact-only (safe-passage)
- eSIM management (Standard / Ultra optional)
- Identity-aware covert mode activation
Mode 3 — WanderVerse ecosystem
WanderStation community mesh extends:
- LoRa mesh hop coverage (3-8 km LoS per hop, kilometers across mesh)
- WanderStation hubs route mesh traffic to internet
- WanderNode Hub fleet view (multi-tag management for household / fleet)
- HAVEN safehouse silent-panic integration
- WanderShield identity-aware data sharing
- WanderBand Ultra + WanderTag paired (watch triggers tag panic)
Industry integrations required by Standard 0
- Apple Find My Accessory (Mode 2 opt-in) — same protocol as Chipolo One Spot
- Apple HealthKit — trip metadata + fall alerts (if tag attached to person)
- Apple HomeKit / Shortcuts — automation triggers
- Google Health Connect — cross-platform parity
- Google Find My Device (Mode 2 opt-in)
- Google Home — automation triggers
- Matter commissioning — device discovery only
- Home Assistant — MQTT bridge in companion app
- Meshtastic open protocol — baseline default
- DULT industry-standard — anti-tracker scan compliance
---
6. Pricing summary
| Tier | Retail | Platform BOM (FOB) | Gross margin | Service plan |
|---|
| Tag Mini | $39 | ~$22.50 | ~42 % | none |
| Tag Standard (no eSIM) | $89 | ~$48.20 | ~46 % | none baseline |
| Tag Standard (eSIM enabled) | $89 + $4.99/mo | ~$48.20 | ~46 % product + 12 % cellular margin | optional cellular |
| Tag Ultra (eSIM enabled) | $179 | ~$96.40 | ~46 % | optional cellular |
See BOM-platform.csv for full breakdown.
---
7. Feature inventory (parity sweep)
| Feature | Mini | Standard | Ultra | AirTag | Tile Pro | Chipolo Spot | Samsung Tag2 | Pebblebee |
|---|
| BLE proximity range | 150 ft | 200 ft | 300 ft | 100 ft | 400 ft | 150 ft | 120 ft | 200 ft |
| LoRa community mesh | ✅ | ✅ | ✅ | — | — | — | — | — |
| GPS | — | ✅ | ✅ | — | — | — | — | — |
| Cellular eSIM (opt-in) | — | optional | optional | — | — | — | — | — |
| Persistent e-ink display | — | ✅ | ✅ | — | — | — | — | — |
| Panic button | — | ✅ | ✅ | — | ✅ (find-phone) | ✅ (find-phone) | ✅ | ✅ |
| Apple Find My (opt-in) | ✅ | ✅ | ✅ | ✅ default | — | ✅ | — | ✅ |
| Google FMD (opt-in) | ✅ | ✅ | ✅ | — | — | — (One Point only) | — | ✅ |
| Meshtastic open protocol | ✅ | ✅ | ✅ | — | — | — | — | — |
| Pre-shared trust contacts (max 8) | ✅ | ✅ | ✅ | — | — | — | — | — |
| No-platform-broadcast default | ✅ | ✅ | ✅ | — | — | — | — | — |
| DULT compliance (cross-platform) | ✅ | ✅ | ✅ | partial | partial | partial | partial | partial |
| Identity-aware covert mode | ✅ | ✅ | ✅ | — | — | — | — | — |
| User-replaceable battery | ✅ CR2032 | ✅ LiPo | ✅ LiPo | ✅ CR2032 | ✅ CR2032 (2024+) | ✅ CR2032 | ✅ CR2032 | — (glued) |
| USB-C charging | — | ✅ | ✅ | — | — | — | — | ✅ |
| Solar charging | — | — | ✅ | — | — | — | — | — |
| IP rating | IP54 | IP67 | IP68 | IP67 | IP68 | IP67 | IP67 | IP67 |
| MIL-STD-810G | — | shock | shock+vibe | — | — | — | — | — |
| Open STL accessories | ✅ | ✅ | ✅ | — | — | — | — | — |
| Ambassador-assembled + Signature | ✅ | ✅ | ✅ | — | — | — | — | — |
| 7-year parts | ✅ | ✅ | ✅ | — | — | — | — | — |
| No-subscription baseline | ✅ | ✅ | partial | ✅ | ✅ (Premium $30/yr extra) | ✅ | ✅ | ✅ |
| Companion app polish | functional | functional | functional | mature | mature | mature | mature | mature |
| Network density | mesh | mesh | mesh | ~1B iPhones | ~40M | ~1B (Apple) | Galaxy | both nets |
| UWB precision | — | — | — | ✅ U1 | — | — | ✅ Galaxy | — |
| Retail price (USD) | $39 | $89 | $179 | $29 | $35 | $35 | $30 | $40 |
Coverage: 22 / 25 features green vs competitor field. The 3 we don't ship in v1.0: UWB precision (v2.0), Apple-network-density default (by design), absolute-cheapest price ($15 Nut tier — different segment).
---
8. Standalone-mode commitment
A WanderTag Mini is a complete product with zero other WanderVerse purchases:
- Pair via NFC tap to friend's phone (one-time setup web page, no app required)
- Add up to 8 trust contacts via SMS / email / NFC tap
- BLE proximity finding works (~150 ft)
- LoRa proximity to other Meshtastic nodes works (no WanderStation required — open community Meshtastic mesh)
- DULT discovery works on iOS / Android / AirGuard
A normal consumer can buy a WanderTag and love it without buying another WanderVerse product.
WanderStation, WanderNode Hub, WanderRouter Ultra, WanderBand, etc., add depth (longer mesh range, fleet view, ecosystem integration) but are never required.
---
9. Privacy commitment summary
1. No telemetry by default. Mini and Standard (without eSIM) emit only DULT-disclosure beacons + encrypted Meshtastic mesh updates to the user's pre-shared trust contacts. No telemetry to WanderVerse. 2. No platform broadcasting by default. Apple Find My / Google Find My are opt-in. 3. End-to-end encryption of trust-contact channel with per-tag PSK. 4. Open audit: DULT firmware partition is locked + signed + third-party audited. 5. Audit log of covert-mode activations is on-device + E2E to user (not server-readable). 6. No mass-pair / wide-network surveillance. Max 8 trust contacts. 7. No identity-leak in mesh broadcast — all WanderVerse-protocol payloads are opaque to non-trust-contacts.
---
10. Stage-10 BLOCKERS (cannot ship without)
1. Anti-stalker advisory review (NNEDV / NCADV / Project Safe Hands consultation) — RED 2. Identity-aware covert mode legal review — RED 3. DULT cross-platform interop verification (iOS Tracker Detect + Google FMD + AirGuard) — RED
These are not soft gates. WanderTag is the product where shipping early is worse than not shipping. We will defer launch indefinitely if any of the 3 are unresolved.
---
See _MANIFEST.md for revision history, ship targets, and revenue integration. See DECISIONS.md for the full decision log. See _VALIDATION-AND-SENSOR-EXPANSION.md for the safety architecture deep-dive. See _COMPETITIVE-AUDIT-2026-04-24.md for the full competitive analysis.
---
Radio architecture v2 — LR2021 migration (2026-04-25)
Primary radio: Semtech LR2021 (LoRa Gen 4 / LoRa Plus). Replaces previous multi-chip radio architecture (SX1262 + nRF52840 + CC2652R7 collapsed to one).
What this unlocks
- 40× throughput — 62.5 kbps → 2.6 Mbps via FLRC modulation. Enables: image snapshots over LoRa, voice / walkie-talkie, AI-edge inference output streaming, audio classification.
- Multi-PHY in one chip — LoRaWAN + Sidewalk + Meshtastic + Z-Wave + Wi-SUN + BLE + Thread/Zigbee. Single global SKU; no regional variants required.
- Direct-to-satellite (S-band 1.9–2.5 GHz NTN) — phone home from anywhere on Earth, no cell tower. Game-significant for at-risk-user use cases (DV-survivor escape from anywhere, wilderness emergency).
- -142 dBm sensitivity — best-in-class link budget (vs SX1262 -137 dBm).
Migration strategy: hybrid
This product is Tier-1 critical (life-safety / DV-survivor flagship / global-supply-chain anchor). Hybrid alt-source path retained:
- Founding-tier SKU: SX1262 + nRF52840 (proven dual-source). No FLRC voice, no satellite. Lower cost, regional-variant-required.
- Pro / Global SKU: LR2021 single-chip multi-PHY + S-band NTN. FLRC voice, satellite emergency, AI-edge inference, single global SKU.
Customer chooses at purchase. Spec tables list both with cross-references.
Cert path additions
- FCC Part 25 NTN earth-station registration — required for S-band satellite operation. Engagement budget ~$30–60k via TÜV SÜD or Element. Pro tier only.
- FCC Part 15 Subpart C — sub-GHz + 2.4 GHz emissions (existing cert covers; verify LR2021 module FCC ID propagates).
- CE / UKCA / IC / AS-NZS — international filings updated to reference LR2021 module.
Capability bullets for marketing copy
- Phone home from anywhere — direct-to-satellite, no cell tower (Pro tier)
- Multi-protocol mesh — LoRaWAN, Amazon Sidewalk, Meshtastic, Z-Wave, BLE, Thread, Wi-SUN
- Single global SKU — no US/EU regional variants
- 40× faster radio than the previous generation, in the same power envelope
---
**Note (Perplexity-validated 2026-04-25):** When this doc says LR2021 supports multi-PHY in one chip, the *hardware* is multi-PHY-capable, but full protocol stacks (LoRaWAN, Amazon Sidewalk, Meshtastic, Z-Wave, Wi-SUN, BLE, Thread/Zigbee) integrate via firmware layers, not all bundled native. We ship pre-built stacks for the active set per product. See `PERPLEXITY-VALIDATION-2026-04-25.md` in `_WANDERVERSE-LIBRARY/`.