Pricing Against a Free Official App — Where Lynsi's Paywalls Go

Lynsi is a local handoff tool between HarmonyOS phones and the Mac, currently in review on both stores. Designing its monetization meant facing an opponent most indie products never meet: Huawei’s own SuperHub (星河互联), on the Mac App Store since December 2025, free.

A free, first-party competitor. This post is about how the paywalls get drawn in that situation — and about three schemes that were rejected. The design is implemented in the shipping build; everything below describes decisions already in code.

First principle: whatever the official app does for free, we do for free

Start by mapping the competitive boundary (as of this writing): SuperHub has file transfer and photo/video transfer. It has no clipboard sync (officially unimplemented), no mirroring to a Mac (multi-screen collaboration is reserved for Huawei’s own PCs), no way to browse the phone’s gallery from the Mac (you can only push from the phone), and a video must fully transfer before it plays.

From that, the scheme’s first principle: any capability SuperHub provides for free, Lynsi provides for free, without limits. Charging where the official app is free isn’t a conversion backstop — it’s a repellent. It makes Lynsi look stingier than a free first-party app.

The positioning falls out of the same map: SuperHub transfers; Lynsi receives. The phone’s gallery, clipboard and screen simply appear on the Mac — there is no “transfer” step. The paywalls stand only on that differentiated line, four groups in all: watch time, gallery saving, image clipboard, and full automation.

Mirroring and streamed video playback draw from one shared 10-minutes-per-day pool in the free tier. The reasons to merge: to the user they are the same thing — the phone’s picture on the Mac; one timer means the rule fits in one sentence; and mirroring users and video-watching users are different people, so a shared pool sends both crowds into the same wall instead of two walls needing two explanations.

Ten minutes isn’t arbitrary either: enough to answer every question a trial has to answer — how much lag, how sharp, does it stall — and not enough to finish watching anything.

Per day, not per session. The reconnect policy forced this one: the phone reconnects on its own after a drop, so a “N minutes per session” allowance refills on every Wi-Fi hiccup. Plugging that hole means a cooldown rule — and a cooldown rule cannot be stated in one line on screen. A limit nobody can state is read as the app playing games. Per-day has none of that: resets at local midnight, only counts down, one sentence.

The timer’s implementation carries three “don’t get hated” details, each mapped to a failure mode that earns one-star reviews:

Count only while frames are actually arriving. A paused stream, a backgrounded window, the gap after a drop — none of it spends the allowance. An allowance that vanishes while nothing was on screen is more resented than the limit itself.
Cap any single settlement at about two seconds. Elapsed time is measured from a timestamp, not counted in ticks — so a lid closed for half an hour produces a half-hour delta on wake. Uncapped, the day’s allowance evaporates the instant the Mac wakes: the most resented possible way to lose it. Nothing was on screen while suspended; it doesn’t count.
Format “today” with en_US_POSIX. The stored key is a yyyy-MM-dd string. Follow the system locale and a region using another numbering system produces a string that never equals the stored one — every launch looks like a new day, and the allowance resets forever. A bug that only fires in certain regions, and fires in the user’s favor, which is exactly the kind you never hear about.

One piece of protocol cooperation completes it: the budget is a Mac-side limit the phone cannot see. When it runs out, the Mac must send an explicit mirror.stop — otherwise the phone keeps pushing 30fps into a paywall.

Gallery saving: reclassified from free to Pro

This is the scheme’s one reversal. An earlier version put saving originals in the free tier, reasoning: it’s equivalent to the official photo/video transfer, so by the first principle it should be free.

That “equivalent” turned out to be looking in the wrong direction. SuperHub has you pick photos on the phone and push them out. Lynsi has you browse the gallery on the Mac and pull what you want — you’re working at the computer, you need that shot from last month, and you never touch the phone. Hitting the wall and detouring to the official app means: pick up the phone, open SuperHub, find the photo, send it. The friction is far larger than “the official app also does this” makes it sound. Saving is the endpoint of the differentiated browse-on-Mac flow, not a copy of an official capability.

Two boundaries hold the reclassification together. Browsing, previews and video playback stay free — the user has to see the photo and confirm it’s the one before wanting it; “you can see it, you can’t take it” is the wall’s complete shape. And no free quota: “save phone photos to the Mac” needs no trial to be understood; three-or-five free saves buys nothing but a counter and a rule nobody remembers.

The same directional reasoning shapes the image clipboard. Its entire paid value is the Mac → phone direction (which has no substitute anywhere); the phone → Mac half can be bypassed with the system share sheet — so let it be bypassed: sharing is equivalent to the official file transfer and ought to be free anyway. But the wall locks the feature whole rather than by direction — “pasting to the phone is Pro, the other way is free” is a directional rule that doesn’t fit in one sentence, and what can’t be explained gets read as harassment.

Presenting the wall: keep the entrance, speak on the click

The hard walls share one presentation rule, three don’ts:

Don’t hide the button. A hidden feature doesn’t exist; a user who never learns it’s there never pays for it.
Don’t gray it out. A disabled control can’t explain itself, and it can’t catch the click — and that click is the moment the user expresses intent, the only conversion opportunity there is.
When blocking, explain — never error. “Saving originals is a Pro feature” and “Save failed” are entirely different events to a user; the second is a product defect. Doubly so for invisible features like the clipboard: copy an image on the Mac, fail to paste it on the phone, and the first thought is “this app is broken.”

The watch budget gets the same treatment: remaining minutes are always visible, with a warning in the last one — a picture that goes black with no warning reads as a crash and converts directly into a one-star review.

How does the phone learn the purchase state? It can’t: the phone app is permanently free with no accounts. So the Mac declares it — hello.ack carries tier: pro | free and the phone follows. A missing field means free: a Mac too old to send it predates the paid tier entirely, and reading silence as paid would gift the entitlement to everyone who never upgrades.

Three rejected schemes

A time-limited trial. The trial clock has nowhere to live: an install date stored locally resets with the container directory; preventing that requires server-side verification, which would demolish the product’s most expensive differentiator — it doesn’t touch the network. Compare the daily allowance: also local, also not tamper-proofed, but a reset gains ten minutes, while a reset trial is permanent free use. Same tamperable local state; only the one with a bounded loss is acceptable.

File-size caps on transfer. The official app transfers free and unlimited. A wall here sends users around it and leaves exactly one impression: cheap.

Capping gallery browsing at N pages (say, three pages free). Three vetoes: it would cripple a free capability’s integrity — saving requires seeing, and photo #181 becomes permanently unselectable for free users; the gallery is an infinite scroll, so “pages” are imperceptible — a scroll that suddenly stops reads as a loading failure, not a paywall, and it’s hit on every single browse; and above all, browse-the-gallery is the free tier’s strategic asset against the day Huawei ships clipboard sync — cut it to 180 photos and Lynsi shrinks back into “a widget that shows recent photos.”

What I took away

Against a free competitor, the paid boundary is the product positioning. Every wall must stand on a capability the other side doesn’t have. A wall on their free ground collects no revenue — only reviews.

Explainability of limits is a hard constraint, not a soft preference. Per-day over per-session, whole-lock over directional, page caps vetoed — behind all three is the same rule: if it doesn’t fit in one on-screen sentence, users file it under malice.

Anti-abuse starts with bounding the loss. The local budget skips tamper-proofing because the exploit tops out at ten minutes; the trial skipped existence because its exploit tops out at everything. Same mechanism, opposite conclusions, decided entirely by the bound.