← Who Booked This?
Product Requirements Document

Who Booked This?

A mobile app for coordinating group travel — designed for the extended family trip.

Version 1.6
Date May 2026
Platform Mobile (iOS-first)
Status Complete
01 — The Problem

Why group trips fail

Group trips fail not because people don't care, but because information lives in a dozen different text threads. Someone always misses the updated plan. No one knows what's actually decided versus still being debated.

This is a pattern observed repeatedly across group travel: the real failure mode isn't lack of enthusiasm or ideas — it's the gap between shared intent and durable, shared coordination.

Specific failure patterns: plans communicated informally and forgotten; one person becoming the de facto coordinator absorbing all the labor; decisions made in side conversations never reaching the full group; no reliable way to notify everyone when details change; no agreement on what's decided versus still proposed.

Design principle

The core failure is not communication. It is the absence of a shared, stable record of group intent.

02 — Target Users

Who this is built for

The primary context is the extended family trip — a reunion, a vacation rental, a destination celebration. These trips concentrate every coordination failure the app is designed to address: multiple family units with different budgets and priorities, implicit generational hierarchies, and participants ranging from grandparents to toddlers.

This context also introduces the app's most important design constraint: the presence of teenagers. Teenagers on family trips occupy an awkward middle position — old enough to be socially pressured into responsibility, but young enough to be excluded from actual planning decisions. Who Booked This? treats this as a trust risk, not an edge case.

The organizing adult

The person who booked the Vrbo, built the group chat, and is currently holding the entire itinerary in their head. Takes initiative on logistics, absorbs all coordination overhead, and has no structural support for any of it. The app's primary value proposition is giving this person a shared surface so they stop being the single point of failure.

The participating adult

Other adults in the group — other parents, partners, grandparents, aunts and uncles. Varying levels of engagement: some are highly opinionated, some are just showing up. May have strong preferences about specific things while being entirely disengaged from everything else. Needs low-friction access to the plan and the ability to register preferences without being expected to manage anything.

The teenager

Not a child, not an adult. Has real preferences and deserves to know the plan. Should not be assigned tasks by the app under any circumstances — the coercion happens informally in real life; the app will not formalize or accelerate it. Sees the full itinerary and can propose or comment, but can only take on tasks through explicit personal commitment, never through assignment.

Design constraint

Participant-tier members cannot be assigned tasks by anyone through the app. Their commitment is always self-declared. Full-access members may assign tasks to each other — that is coordination. Assigning tasks to teenagers is coercion, and the app will not enable it.

The younger child

Needs to know what's happening each day. Has no planning responsibility and no interest in logistics debates. Child mode provides a read-only, day-by-day view of finalized plans — nothing else.

03 — Core Model

How the system works

The itinerary as a wiki

The group itinerary is a shared, editable document — not owned by any single user. Anyone in the group can propose, edit, or remove items. There is no designated coordinator with special authority. This maps to how trips actually evolve: chaotic early on, converging as the date approaches.

The audit trail

Every edit to the itinerary is logged with the author, timestamp, and previous value. The audit trail serves two purposes: accountability (edits are attributed, creating natural social friction against bad-faith changes) and memory ("when did we decide that?" is a question that kills group trips — the trail is the receipts). Items are never deleted — they are archived. The record is always recoverable.

Item states

Every item on the itinerary exists in one of five states, visible to the full group.

State Meaning Who sets it
Proposed A user has floated an idea. Visible to all, no action required. Any user
Active The group is operating on this plan. Edits notify all participants. Any user
Committed A user has booked or confirmed this. Flags change attempts; informational only. Self-declared
Forked A sub-group is doing something different. Visible alongside main itinerary. Any user
Archived Removed from the active itinerary. Preserved in audit trail, not deleted. Any user

The fork model

Forks are first-class objects. When a participant or sub-group wants to do something different from the main itinerary, they create a fork — a parallel plan visible alongside the group plan. Forks prevent the main itinerary from becoming a battleground and make divergence visible and legible rather than a confusing side-thread. Forks can rejoin the main itinerary or be promoted to it if the group converges.

Proposal promotion

There is no minimum threshold for a proposal to become Active. Any member can promote any proposal at any time. The check on unilateral action is not a gate — it is the fork. If someone promotes a plan the group dislikes, the group routes around it by forking.

Design rationale

Requiring consensus to advance a proposal creates the same bottleneck the app is designed to dissolve. Low friction to promote; low friction to diverge.

Tasks

A task is a named coordination gap — something that needs to happen for the trip to succeed but hasn't been claimed. Tasks are distinct from itinerary items: they represent logistical requirements, not planned activities.

Tasks have three key properties: creator (the person who noticed the gap — creating a task confers no obligation to complete it); owner (whoever is responsible — full-access members can self-claim or assign to another full-access member; participant-tier members can only self-claim); and deadline tied to a real-world constraint.

As a task's deadline approaches, its visibility increases and triggers a group notification — surfaced to everyone, directed at no one. The social pressure to act exists in the room; the app does not manufacture or direct it.

Design principle

Decoupling observation from obligation is essential. If noticing a gap creates ownership, people stop noticing gaps. The app rewards surfacing problems, not punishes it.

The committed flag

When a user has acted on a plan item in the real world — booked a hotel, purchased a ticket — they mark it as Committed. Committed is self-declared and purely informational. The flag warns the group before they change something, explains divergence after a change, and creates a visible record if anyone feels blindsided later.

Design principle

Committed status does not lock an item or prevent changes. It makes the stakes of a change visible so the group can make informed decisions.

04 — Features

Requirements

Trip management

  • Users can create, join, and manage multiple trips simultaneously
  • Each trip has an independent group, itinerary, audit trail, and chat
  • Trips are joined via invite link plus a verification code — the link gets you to the door, the code confirms you're expected. Forwarded links alone are not sufficient to join.
  • Trip admin (creator) can remove members and change access tiers; all other permissions are equal

Itinerary

  • Shared, real-time itinerary organized by day
  • Anyone can add, edit, or archive items
  • Items display state, author of last edit, and committed count
  • Edits push notifications to all group members
  • Group calendar view showing each day at a glance

Proposals

  • Any user can submit a proposal without it becoming a plan
  • Proposals are visible to the group and can be upvoted or commented on
  • Voting is a signal, not a gate — proposals do not require majority approval to advance
  • A proposal advances to Active when any user promotes it; the group can revert it

Forks

  • Any user can create a fork from any point in the main itinerary
  • Forks are named and attributed to the initiating user or sub-group
  • Fork members can be a subset of the trip group
  • Open forks are visible to all trip members, even those not participating
  • Private forks show their existence to the group but not their contents or membership — for separation without conflict (e.g. a couple's date night)
  • Forks can be promoted to the main itinerary via proposal, or closed

Tasks

  • Any full or participant member can create a task
  • Creating a task does not make the creator responsible for it
  • Tasks show: description, deadline, creator, and current owner (if claimed or assigned)
  • Full-access members can self-claim or assign a task to another full-access member — reflecting agreements made outside the app
  • Participant-tier members can only self-claim. They cannot be assigned tasks by anyone through the app.
  • Unclaimed tasks rise in visibility as their deadline approaches
  • Group notification fires for unclaimed tasks nearing deadline — surfaced to everyone, directed at no one
  • Claimed or assigned tasks can be released by the owner; completed tasks are logged in the audit trail

Chat

  • Item-level comments — each itinerary item and task has its own comment thread
  • Trip-level thread — shared space for general group conversation, visible to full and participant members
  • Comments are attributed and timestamped; not editable after posting
  • Chat is not a decision surface — decisions live in the itinerary and task objects

Audit trail

  • Every state change, edit, addition, and archival is logged
  • Log entries show: who, what changed, from what, at what time
  • Any item can be restored to a prior state from the trail
  • Audit trail is read-only; it cannot be edited or deleted

Notifications

  • Push notifications for: edits to Active items, new proposals, fork creation, committed flag warnings, unclaimed tasks nearing deadline
  • Digest mode available for users who prefer batched updates
  • Notification preferences are per-trip, not global

Child mode and content visibility

Two distinct features
  • Child mode (access tier) — children see a read-only, day-by-day view of Active items only. No proposals, no forks, no tasks, no audit trail, no chat. Enabled per-user by the trip admin.
  • Adult-only flag (content visibility) — any itinerary item, task, or chat thread can be marked adult-only by a full-access member. Items with this flag are invisible to child-tier users — they do not appear as redacted, they simply do not exist in the child view.
  • The flag is set per item, not per day or per trip. Use cases include surprise plans, budget discussions, or any coordination adults want to handle privately.

Access tiers

  • Full access — adults. Can propose, edit, fork, vote, create and claim tasks, assign tasks to other full-access members, mark committed, use chat, set adult-only flags, and view the audit trail.
  • Participant access — teenagers. Can view the full itinerary, propose ideas, comment, mark personal commitments, and self-claim tasks. Cannot be assigned tasks by other users under any circumstances. Cannot set adult-only flags.
  • Child access — younger children. Read-only, day-by-day view of Active items only. Adult-only items not visible. No planning functionality.
  • Access tier is set by the trip admin at the time of invite and can be changed at any time.

Authentication and access

  • Trip joining requires an invite link plus a verification code — both are required. The link alone is not sufficient.
  • Users authenticate via standard account (email or social login)
  • Trip admin can revoke access for any member at any time
  • Removed members lose access immediately and cannot rejoin without a new invite and code
05 — Design Principles

What guides every decision

Reads are free. Writes are visible. Deletes are slow.

Anyone can view anything. Every edit is attributed and notified. Archiving requires confirmation; nothing is permanently removed.

No voluntelling participants.

Participant-tier members — teenagers — cannot be assigned tasks by anyone through the app. Their commitment is always self-declared. Full-access members may assign tasks to each other, reflecting agreements made outside the app — that is coordination, not coercion.

Visibility over enforcement.

The system surfaces coordination information — committed flags, fork visibility, unresolved proposals — rather than forcing resolution. Social accountability does the governance work.

Forks before conflict.

Disagreement about the plan is resolved by forking, not by fighting over a single itinerary. The main itinerary stays clean; divergence is legible rather than suppressed.

No hidden authority.

All participants have equal edit rights. The trip creator has only one additional power: removing members. The system does not privilege any user's edits over another's.

Intent and commitment are distinct.

Proposing something and having acted on it are different states with different implications. The system keeps them separate and makes both visible.

06 — Known Tradeoffs

What this design accepts

Some proposals may never be resolved. The system does not force decisions.
Coordination may still rely on conversation outside the app. The system complements social negotiation, not replaces it.
Responsibility may still concentrate on proactive users. The system makes imbalance visible but does not redistribute it automatically.
Self-declared committed status can be abused. The system relies on social accountability, not verification.
Forks can proliferate. There is no limit on the number of forks, which could create visual complexity in large groups.
Some tasks may never be claimed. The system surfaces gaps; it does not guarantee they are filled.
Chat and itinerary are separate surfaces. Users may relitigate decisions in chat that are already settled in the itinerary. The system cannot prevent this, only make the itinerary the clear source of truth.
Design stance

Who Booked This? does not eliminate the social complexity of group travel. It makes coordination failures visible, traceable, and not silently absorbed by one person.

07 — Out of Scope (v1)

Noted for later

Direct booking integration (flights, hotels, restaurants)
Expense splitting or payment tracking
Map or location-based itinerary views
AI-generated suggestions or recommendations
Public or discoverable trips
08 — Monetization

Per-trip pricing

Who Booked This? uses per-trip pricing. The person who creates the trip pays a one-time fee to open it. All other members join and participate for free.

The trip creator is already the person with the most skin in the game. They initiated the coordination, they're holding the itinerary in their head, and they have the clearest incentive to solve the problem. Asking them to front the cost of the tool is coherent with their existing role.

It avoids the integrity problem of selling the app to individual users. A participant who just wants to see the plan and mark one committed item shouldn't have to buy software to do that. The creator subsidizes access for the group — which is, again, how the trip already works.

It scales naturally with usage. Someone who organizes one trip a year pays once. Someone who organizes five pays five times. There is no subscription to forget about or cancel.

What was ruled out

Advertising and data monetization were rejected outright. Who Booked This? is a trusted shared space for family coordination. Introducing ads or third-party data access would contradict the product's core promise. The pricing model should be as legible and trustworthy as the app itself.

09 — Success Metrics

Measuring coordination, not engagement

The standard metrics — downloads, daily active users, session length — measure reach, not whether the app is doing its actual job. The job is reducing coordination failures and keeping the whole group oriented around a shared plan.

Group engagement

The single most important signal: is the organizer the only person making edits? If the wiki is being treated as one person's document rather than a shared surface, the core premise hasn't landed.

Trips where 3+ members edit the itinerary
Shared ownership signal
Participant-tier members who engage at all
Teenager inclusion signal
Invited members who join within 48 hours
Onboarding health

Coordination health

Items with committed flags from 2+ members
Plan reached reality
Proposals advancing to Active without reversion
Group is converging
Unclaimed tasks claimed before deadline
Gap-surfacing works
Average members editing per trip
Shared vs single-coordinator ownership

Trust signals

Rate of audit trail access per trip
Accountability is real
Ratio of item reversions to archives
System working as designed
Committed flag warnings triggered on edits
Flag providing useful friction
The honest success metric

After the trip, does anyone remember who booked what — and does the answer match what the app says? If the audit trail is accurate and the committed flags are trustworthy, the product worked.

What success does not look like

High session length is not a goal. The app should be fast to check and easy to update. High notification volume is not a goal. Fork proliferation is not a goal — a trip with ten open forks has probably fragmented rather than coordinated.

10 — Open Questions

What needs to be resolved

What is the maximum group size before fork visibility becomes unmanageable?
Can a teenager self-upgrade to full access, or does that require trip admin approval?
How are trip admin rights transferred if the creator leaves the trip?
Should unclaimed tasks that pass their deadline stay visible, or move to an archived state automatically?
Should the adult-only flag be settable by participant-tier users, or full-access only?
How does the app handle multiple family units with genuinely different budgets making decisions about shared expenses?
Is there a maximum number of forks before the UI becomes unreadable? Should forks be collapsible?