Scope: matches the MVP backlog in Stories. Each journey walks one persona through an end-to-end flow, screen by screen, including the decision points and the failure paths. Journeys 1–4 trace the thin end-to-end slice (Epics 1→2→3→4); journeys 5 and 6 cover privacy and the brand side.

The personas (Anonymous Shopper, Sara, Marco) are defined in Stories.

Journey 1 — First scan, no account (Anonymous Shopper)¶

Context: standing at a supermarket shelf, holding a product, phone in hand. No app installed, no account. This is the moment the platform earns or loses the user.

Goal: know what this product is, what's in it, and whether to trust it — in seconds.

Shelf → Scan QR → Product Passport
                    ├── Digital label (ingredients, allergens, nutrition)
                    ├── Journey (origin → processing → distribution)
                    ├── Eco score (0–100, expandable)
                    └── "Create a profile to see if this fits you" (dismissible)

1. The shopper points the phone camera at the GS1 Digital Link QR on the package. The phone's native camera recognizes it — no app download.
2. The GS1 code (GTIN, lot, expiry) is decoded on the phone before any network call.
3. The Product Passport opens in the browser: product name, brand and image render in under 3 seconds. (Stories 1.1, 1.2)
4. The shopper checks the digital label: ingredients, highlighted allergens, nutrition table.
5. Optionally they expand the journey (1.3) and the eco score (1.4).
6. A single dismissible line notes that a personal verdict exists for account holders (3.4). It never blocks the product info.

Exit points:

• Satisfied — closes the browser. The journey worked with zero friction; they may scan again next time.
• Curious — taps "Create a profile", entering Journey 2.

Failure paths:

• Unknown product (1.5): a clear "We don't know this product yet" screen with a one-tap report option — never a raw error.
• Partial data (1.6): a failed data source (e.g. eco score) shows a "temporarily unavailable" note on that section only; the rest of the passport renders normally.

Journey 2 — From anonymous to Sara (sign-up and health profile)¶

Context: the shopper has scanned a few products and wants the personal verdict. Sign-up is invited, never forced.

Goal: unlock personalization in under a minute, consenting knowingly along the way.

"Create a profile" → Sign-up (email + password)
                       → Privacy summary (30 seconds, plain language)
                       → Health personalization? ──no──→ Done (app fully usable)
                              │ yes
                       Explicit consent (opt-in recorded)
                       → Allergies & conditions → Diet & goal → Done

1. From a scan result (or a landing page), the shopper taps "Create a profile".
2. Sign-up asks only email + password (2.1).
3. A one-screen privacy summary explains in plain language that brands only ever see anonymous aggregates (5.1).
4. The app asks whether to enable health personalization. This step is explicitly optional:
   • Decline → onboarding ends. Nothing is saved; the account works fine without personalization (2.2).
   • Accept → explicit opt-in is recorded (checkbox + timestamp + policy version).
5. Sara selects her allergies and conditions from the standard EU list — for her: dairy, lactose intolerance (2.3).
6. She sets her diet (high-protein) and one primary goal (build muscle) (2.4).
7. Onboarding ends back where she started — ready to scan.

Exit point: a complete (or deliberately minimal) profile, editable at any time.

Journey 3 — "Does this fit me?" (Sara's personalized scan)¶

Context: Sara, logged in with her health profile, picks up a yogurt at the shelf. This is the core moment of the product.

Goal: a personal answer — is this right for me? — in the first 3 seconds.

Scan QR → Verdict banner (Good for you / Be careful / Avoid)
            ├── tap → reasons (allergen, condition, diet, goal)
            └── below: full Product Passport (as in Journey 1)

1. Sara scans the QR exactly as in Journey 1.
2. The scan result opens with the verdict at the top, before any other detail (3.1):
   • Avoid — the yogurt contains milk: a red, impossible-to-miss allergen alert (color + icon + text) (3.2).
   • Be careful — e.g. a condition or diet conflict, shown as a medium-severity warning with a one-line reason.
   • Good for you — plus one or two plain-language lines tying the product to her goal: "high in protein — fits your muscle-building goal" (3.3).
3. Tapping the verdict reveals the reasons; scrolling past it shows the same full passport any anonymous shopper sees.
4. Sara decides at the shelf: put it back, or buy it.

Exit points:

• Bought it — one tap adds it to her Fridge, entering Journey 4 (4.1).
• Put it back — scans the next candidate; the loop repeats.

Journey 4 — My Fridge (from purchase to "nothing wasted")¶

Context: Sara is home with her shopping. Days pass between the steps of this journey — it is the only flow that spans weeks.

Goal: use what she owns before it expires, and see her waste shrink.

Scan result → "Add to Fridge" (expiry from QR stored)
   ⋮ days pass ⋮
Notification: "expires in 5 days" → open Fridge (sorted by freshness)
   → use it → mark "used"        → item removed
   → too late → mark "thrown away" → counted honestly
   ⋮ end of month ⋮
Summary: "you used 14 items, 2 expired"

1. After scanning (or right after Journey 3), Sara taps "Add to Fridge". The expiry date decoded from the QR's lot/expiry data is stored with the physical item; the same item cannot be added twice, while multiple items may share a GTIN (4.1).
2. Whenever she opens the Fridge, items are sorted by what expires first, with fresh / expiring (≤5 days) / expired states visually distinct (4.2).
3. When an item crosses the expiring threshold, she gets one notification — no spam (4.3).
4. As she cooks and shops, she removes items with a swipe, optionally marking "used" vs "thrown away" so the waste count stays honest (4.4).
5. At the end of the month she sees plain numbers — no points, no badges: "you used 14 items, 2 expired" (4.5).

Exit point: a Fridge that reflects reality, and a monthly number she wants to see go down.

Journey 5 — Walking away (consent revocation and erasure)¶

Context: Sara decides she no longer wants her health data on the platform — or wants to leave entirely. This journey must be as short as sign-up.

Goal: exercise her right to erasure with one clear action.

Settings → Delete health profile → confirm → profile gone, account remains
        └→ Delete account        → confirm → everything gone

1. From settings, Sara chooses between deleting the health profile only or the whole account (2.5).
2. One clear action, one confirmation. No retention tricks, no multi-step dissuasion.
3. Deletion is complete and immediate, and the app confirms it.
4. If she deleted only the health profile, the app keeps working — she is simply back to the anonymous-style experience of Journey 1, with an account.

Exit point: trust preserved. This journey existing — and being painless — is what makes Journey 2 feel safe in the first place (5.2).

Journey 6 — Proof of engagement (Marco at the brand dashboard)¶

Context: Marco needs to justify the QR investment internally. He logs in from his desk, not from a shelf.

Goal: walk into a meeting with evidence that consumers actually scan.

Login → My products (what's live)
          → per-product scan counts (table + trend line)
          → engagement aggregates (% saved to Fridge, % with accounts)
Onboard a new product → form / file upload → appears in consumer scans

1. Marco logs into the B2B interface and sees the list of his brand's products on the platform (6.1).
2. For each product he reads total scans and a trend over time — a simple table and one trend line, no beautification (6.2).
3. For depth of interest, he checks aggregate engagement signals: % of scans saved to a Fridge, % of scanners with accounts (6.3). Every number is an aggregate with a minimum group size; nothing is traceable to a person (5.2).
4. When a new product launches, he submits its data (label, origin, sustainability info) through a simple form or file upload (6.4) — manual is fine for the MVP.

Exit point: a screenshot-able dashboard for the next internal meeting, and zero access to any individual consumer.

How the journeys connect¶

The thin slice to build first is the vertical path 1 → 2 → 3 → 4: a shopper can scan anonymously, choose to become Sara, get a verdict, and track her Fridge. Journeys 5 and 6 hang off that slice — one guards trust, the other monetizes it.