How Firmas was built.

Chapter 01 · 26 March 2026

The idea

It started with a question nobody had a good answer for.

Most people sign more contracts in a year than they read in a decade. A streaming subscription, a phone bill, a mortgage, a holiday rental, an insurance renewal, a power-of-attorney form for an ageing parent — each one a binding agreement, each one stored somewhere between an inbox and a drawer, each one mostly forgotten until it becomes a problem.

A wallet for the contractual life of a person — somewhere to keep the documents that govern your money, your relationships, your obligations.

The infrastructure for managing all of that, for ordinary people, did not exist. Lawyers had it. Companies had it. Households did not. We thought that was strange.

Underneath the practical problem sat a deeper conviction. Contracts and the rituals around them — a signature witnessed in person, a handshake that closes a negotiation, the small ceremonies in front of a notary — are some of the most accurate ways a person is identified as human, as a resident of somewhere, as an adult. A passport is the state’s claim about you. A contract you sign in front of another person is your own claim, attested to by someone who was actually there. With the right cryptographic primitives, the proofs derived from those moments could become a privacy-respecting way to show simple binary credentials in a world increasingly run by AI agents. Not "here is my full ID." Just yes, I am a real person; yes, I am over eighteen; yes, I live where I say I do. Minimal, anchored in things people already do.

The pitch we wrote down on day one was deliberately small. Not "fix the legal industry." Not "reinvent contracts." Just: a wallet for the contractual life of a person. Somewhere to keep the documents that govern your money, your relationships, your obligations — and to read them back to you in language you can understand.

We knew the bar would be high. The product would have to feel less like a filing cabinet and more like a friend who actually read the small print. It would have to work for the eighty-year-old who still keeps her phone bill in a folder by the kitchen, not just the lawyer who reads contracts professionally. And it would have to do all of that without becoming yet another company that quietly hoards the very documents people need protection from.

Chapter 02 · 26–27 March 2026

The deep plan, then the pivot

A day spent sketching the architecture, an evening spent throwing half of it out.

Before any code, we wrote a long memo. The TODO.LAW family of products had built a lot of legal infrastructure already — a deal-room for negotiation, a court-record indexer, a bookkeeping tool — and most of what Firmas needed could be borrowed from those packages instead of rewritten. The signing primitives, the encryption, the contract templates. We listed every piece, drew every line, and decided the right way to ship was as a mobile-first React Native app built on Expo.

A day later, we changed our minds. The mobile-first instinct was correct, but Expo would mean fighting two-decades-worth of mobile chrome for every pixel of layout — and the audience we cared about most, the ones drowning in subscription emails and utility renewals, was already on the web. We pivoted to Next.js for the surface, with the same shared core packages underneath. The mobile clients would come, but they would come once the web product had earned the right to a native build.

It is the kind of decision that looks obvious in retrospect and felt costly at the time. The pivot cost us about four hours of code and zero hours of architecture. The shared packages — core data models, crypto primitives, database adapters — survived intact. That, more than anything, was the day we knew the foundation was right.

Chapter 03 · 26–27 March 2026

From empty directory to working monorepo

Two and a half thousand lines of TypeScript, four packages, zero compile errors. By the end of day one we had a workspace we could actually build features in. The architecture was deliberately boring: a `core` package for the domain models — Contract, Deal, Vault, Signature — a `crypto` package for the primitives we trusted ourselves to write (and only those), a `db` package wrapping SQLite so the same code could run in a browser or on a phone, and a `web` package consuming all of the above.

The choices that mattered were the small ones. SQLite in the browser via WebAssembly meant the wallet could store contracts locally — on the user's own device — without a server in the loop for anything except sync. The crypto package handled exactly four primitives: AES-GCM for symmetric encryption, ECDSA on the P-256 curve for signatures, SHA-256 for hashes, and Shamir's Secret Sharing for the digital-will release flow. Everything else, we used the platform.

By the next morning we could create a contract row, see it persisted, sign it with a fake key, verify the signature. Nothing rendered. Nothing was pretty. But the bones were there.

Chapter 04 · 27 March 2026

The app comes alive

Bones first, then a face. Then the start of a personality.

The Crear flow — the part of the wallet where you actually create a contract — was the first surface to feel like a product. Pick a vault (rentals, utilities, family, services), answer a short wizard, get a contract row in your vault. We ported a negotiation engine from one of our sister projects: two parties, each making selections from a clause menu, the system surfacing where they agreed and where they would have to compromise.

And we wired in the AI. Not as a chatbot, not as a copilot, but as a reader. Upload a utility bill, a tenancy agreement, a streaming subscription invoice, and the wallet would extract what we called the four dimensions of any contract: who you are dealing with, what you owe them, what they owe you, and when you need to act. The first version was crude. It missed renewal dates on poorly-formatted PDFs, it confused a "total due" line for a recurring price, and it hallucinated the occasional clause that simply was not there. But it was right often enough, on real documents, that we could see the shape of what the wallet was supposed to be.

A wallet that reads on your behalf. That was the framing that survived everything else.

Chapter 05 · 28–29 March 2026

Trust becomes tangible

Signatures, identity, blockchain — the three pieces that take a wallet from useful to credible.

You cannot run a contractual wallet without signatures. We built three tiers, mapping to the European eIDAS regulation that recognises a hierarchy of legal weight: a simple signature, an advanced one, and a fully qualified one. Our advanced signature is an ECDSA key generated on-device, stored in the operating system's secure enclave (the chip that also guards your fingerprint), and used to sign the canonical hash of a contract. The qualified tier requires an external trust service provider — that one we hold for later. The simple tier is the one ordinary people meet first: a typed name and a checkbox, recorded with a timestamp and an IP address. All three carry weight; they carry different weight, and the wallet says so plainly.

Identity was harder. The wallet had to hold who you are without becoming a database of citizens. We built an identity profile that lives entirely on the device — the name on your ID, the type of ID (NIF, NIE, DNI, CPF, passport, depending on jurisdiction), the document number — never leaving your phone except as a derived hash inside a contract's signed payload. A friend could see that you signed a rental with the right credentials, without ever seeing the credentials themselves.

Blockchain came in the same week. Every signed contract gets a hash anchored on Base, a layer-2 Ethereum chain we picked for its near-zero gas fees. The on-chain footprint is tiny — a SHA-256 plus a metadata pointer — so a single transaction costs a fraction of a cent and proves, forever, that this exact contract existed at this exact time. We built a relayer so the user never has to hold cryptocurrency or sign a chain transaction; from their side it is just a green check mark next to the word "anchored." From the chain's side it is permanent, censorship-resistant evidence.

It was the first week the product felt heavy in the right way. Real keys. Real signatures. Real timestamps you could not later argue with.

Chapter 06 · 29 March 2026

The structural rethink

A wallet that lists documents is a folder. We wanted something that thought.

A few days in, with the bones working, we realised we had built a list. A nicer list than a typical inbox, with redaction and AI summaries and signing primitives, but still a list. The wallet was reactive — you opened it, you scrolled, you read what was there. It noticed nothing on its own.

The rethink was the moment the product started having a point of view. We sketched a different shape: the wallet as a quiet auditor. It would read every contract you scanned, extract the dates that mattered, the clauses that hid penalties, the renewal traps and the cooling-off windows. It would compare what you were paying against the cohort of similar contracts. It would notice when an insurance renewal was thirty days out, when a rental notice period was about to lapse, when a flight delay made you eligible for compensation under EU 261.

And it would keep all of that on the device. No server analytics. No "we noticed you signed a new lease — would you like a credit card." Every insight surfaced from data the user already had, processed on the user's phone, without asking anyone's permission.

That was the version of the wallet we decided to build. The list we already had became the underlying mechanism, not the product. The product, from this point on, was the audit.

Chapter 07 · 1–3 April 2026

Going global

A scanner that worked in any language, a redesign that made the wallet feel personal, and the slow walk toward the App Store.

The scanner got rebuilt. The first version of the document upload flow was ours; the second version delegated optical character recognition to the operating system, used a confidence score to decide whether the AI ought to even bother running, and routed the image through three layers of pre-processing before anything left the phone. It worked on an Endesa electricity bill in Madrid, a Movistar phone bill in Mexico City, an Iberia conditions-of-carriage PDF in Italian, a holiday-rental agreement in German. The same code path. Eleven jurisdictions, two hundred and eighteen pre-stored provider analyses, thirty-three legal templates.

The visual language changed too. We called the redesign "Stitch," after the warm-stone-and-iris colour palette that became the wallet's signature: a soft off-white background, a single rich indigo for primary actions, filled icons throughout, no chrome. The redesign was a reset on a question we had been avoiding: what should this thing feel like? The answer was warm authority. Not a bank, not a startup, not a legal product trying to look approachable. Closer to a notebook. Closer to something a person would keep on their bedside table.

And we started localising in earnest. English first, because the App Store reviewers would read it; then Spanish, Italian, German, Japanese, Indonesian, Brazilian Portuguese; then a separate pass for Latin American Spanish where the legal vocabulary diverges. Eleven hundred and fifteen translation keys at the time of writing, all reviewed by humans for the strings that matter, machine-translated with a provisional banner for the ones that did not yet justify a translator's time.

Chapter 08 · 11 April 2026

Launch day

The submission email lands at 2:30 AM. You sleep badly. Then you find out the world had already moved on.

iOS 1.0 went into App Store review at half past two in the morning, a Sunday. By that point we had run a self-audit that turned up seventeen issues — small things, mostly: a hard-coded font size, a strings file with one untranslated key, a navigation transition that flickered on the first launch. We fixed every one before the submission. The version number on the binary was 1.0.0. The build number was six.

Apple's review process is famously a black box. We had read enough horror stories to expect anything from a one-day approval to a three-week rejection cycle over a hairline guideline call. What we got was a quiet acceptance the next afternoon and a launch in eleven storefronts simultaneously: Spain, the United States, the United Kingdom, Mexico, Argentina, Brazil, Germany, Italy, Nigeria, Japan, Indonesia.

The product was modest at v1. You could create a rental agreement, a personal-loan deal, a will, a power of attorney. You could scan a contract, get an analysis, anchor a hash on-chain. You could not yet share a contract over a QR handshake, draft a notice letter, or claim flight compensation. Those would come. What we had on day one was the audit, the wallet, the vault, the signatures — the spine of the product, end-to-end, in eleven countries.

The first three users were the founder, the founder's mother, and a friend who had been complaining for years about a holiday rental agreement nobody had ever explained to him. The mother's phone bill came back with a clearer summary than the operator had ever provided. The friend's rental agreement came back with two clauses he had not realised he had agreed to. The launch worked.

Chapter 09 · 17–20 April 2026

The first update

A polish sprint. The first real users surfacing the first real bugs. Per-vault quotas, native analyses, a privacy story that finally fit the eleven jurisdictions we had shipped to.

The week after launch was a polish sprint. The first version of the wallet had a single quota — three contracts a month on the free tier — which was too coarse. A user could create three rental drafts trying to set up a flatshare and lose the rest of the month's capacity. We split the quota by vault: three rentals, three utilities, three insurances, three products, three personal documents, three family documents. The unit of generosity went from one to six. We also stopped counting party-B acceptances against the quota — if a friend invited you to a contract, accepting it should not consume your slot. Obvious in hindsight; not obvious enough when we shipped v1.

The pre-stored analyses got moved native. Until v1.1, the wallet fetched a provider analysis from our CDN every time you tapped on, say, the Movistar entry in the catalogue. From v1.1 the analyses were bundled into the app — two hundred and eighteen of them, one per provider in each of the eleven countries — so the wallet worked offline and felt instant. The bundle cost a few extra megabytes. The latency dropped from three seconds to zero.

Privacy got rebuilt around the eleven jurisdictions. The privacy page used to be a single English-Spanish bilingual sheet with a few footnotes for non-EU users. From v1.1 it became a dropdown: pick your country, see the supervisory authority, the data-protection officer email, the EU representative if applicable, the lawful basis for each processing activity, all in your language. It is the first version of the wallet that read as if a lawyer had reviewed every line of every locale, because by that point one had.

Chapter 10 · 21 April – 2 May 2026

From launch to stability

Twelve days, twelve stories. The arc of a product becoming itself.

The detail of the post-launch fortnight does not matter for this telling. Bugs were found and fixed; sometimes a fix uncovered three more; usually that meant we were tugging on a real architectural thread instead of papering over symptoms. What does matter is the shape of those two weeks, because they explain how the wallet stopped feeling like a v1 and started feeling like a thing.

The dashboard told you what you spent. The action feed tells you what to do.

The dashboard told you what you spent. The action feed tells you what to do.

Chapter 11 · May 2026 onwards

Where we are heading

A small product with a long road. Here is what we are working on next.

Three things, in order of imminence. First, the on-device AI tier. Apple's Foundation Models framework — and its Android equivalent — let the wallet run a small language model directly on your phone, without ever sending text to a cloud. We will use it for the explanations: when a clause is buried in legalese and the user taps "tell me more," the rewrite happens locally. The cloud model stays for the heavier lift of analysing a brand-new document, when the device model is not enough.

Second, the claim wizards. The wallet today tells you that you are eligible for compensation when a flight is delayed, that you can reclaim a deposit when a rental ends, that you can challenge an above-cap rent rise. The next step is doing some of that work for you: drafting the letter, filling the form, walking you through the submission. Not a substitute for a lawyer. A scaffolding, so the friction between knowing your rights and exercising them gets thinner.

Third, businesses. The wallet was built for households, but the architecture — local-first storage, end-to-end encrypted sharing, signature primitives, blockchain anchoring — works just as well for a tradesperson invoicing a client, a freelancer issuing receipts, a small landlord managing tenancies. We have shipped a first version of a business mode and an embeddable widget. The full version, with publishable API keys and a hosted dashboard, will follow when traffic justifies it.

There is a longer list, of course. Calendar exports, document-binding proofs, a Karma-based reputation layer for counterparties, the next App Store submission, the Android Play Store launch the day after that. The most accurate description of where we are heading is: outward, slowly, and only as far as the wallet itself wants to go.

You are reading this because you found us early. Thank you for the curiosity. The wallet is on iOS today, on the web for free, and on Android shortly. The story above is what the first six weeks looked like. The rest, like all good stories, is the part still being written.