This was Nest’s first connected lock with Yale hardware. I worked as the product designer on the data integration engineering team, responsible for the primary control, the state and error model, the one-line history, Privacy Mode, and the instrumentation that would tell us whether the choices held up. The aim was simple: a door should leave little room for doubt, so operation needed to be obvious and recovery close at hand.

Early builds used a quick tap to lock and unlock. It felt efficient and, in practice, was easy to trigger by accident. I moved the control to a press and hold with visible progress. We used a circular progress ring because it echoes the Nest thermostat dial users already know, so the motion reads as native without teaching. I prototyped timing, easing, and haptics until the ring and the motor told the same story. I wrote the first pass of the microcopy—“Hold to lock”, “LOCKING”—and our copywriter later tightened the language.

The experience had to speak one language across the device ring, the app, and notifications. I standardized it to three levels—OK, Warning, Critical—with plain labels and a next step mapped to firmware codes and support content. You see “Very low battery — what to do”, “Can’t lock — hold to retry”, “Offline — check Connect” in the same words wherever the state appears, so the path back is shorter and more predictable.

In shared homes, accountability is part of basic function. I designed the at-a-glance history to read like a sentence: “Last locked by Lori at 9:28 AM.” Names come from family and guest accounts, and time is human (“Just now”, minutes, days). Some moments call for turning the keypad off entirely. Privacy Mode does that until you turn it back on, with a short explainer before activation so the consequence is clear, and a visible state that is hard to miss.

We measured enough to know whether the work behaved as intended. With data scientists I set the events and the success signals: first-attempt success for lock and unlock, a quick toggle-back proxy for accidental taps, funnels from error to help to resolved with time-to-healthy, and coverage for named events and guest-code use. Guardrails watched support contacts per thousand devices, false tamper alerts, and any latency or battery cost. The product shipped and kept its shape across releases. The pieces that needed to last did, so the lock reads cleanly, asks for intent, and recovers without fuss.