High-Stakes Onboarding & Error-Recovery System

Redesigned device onboarding for connected hardware

WHISKER

High-Stakes Onboarding & Error-Recovery System

High-Stakes Onboarding & Error-Recovery System

Redesigned device onboarding for connected hardware

Redesigned device onboarding for connected hardware

TL;DR

Context

The redesigned onboarding helps new owners connect their Litter-Robot, recover from setup errors, and reach a working device without getting stuck.

The redesigned onboarding helps new owners connect their Litter-Robot, recover from setup errors, and reach a working device without getting stuck.

Problem

A 15-screen setup where one unexplained error locked people out — of the app and the robot. ~20% first-time drop-off, and the #1 driver of CX contacts.

A 15-screen setup where one unexplained error locked people out — of the app and the robot. ~20% first-time drop-off, and the #1 driver of CX contacts.

Solution

9-screen with a named cause and a way out of every error — plus a reusable error-writing system every new device inherits.

9-screen with a named cause and a way out of every error — plus a reusable error-writing system every new device inherits.

Team

Design Lead + 3 designers · PM · UX Writer · Data Analyst · Researcher · FE & BE Engineers.

Design Lead + 3 designers · PM · UX Writer · Data Analyst · Researcher · FE & BE Engineers.

At a Glance

Error recovery

The old errors named nothing. The new ones name the cause — and a way out.

Connect first. Name it later.

Naming moved out of setup into a clear, skippable step after the robot connects — warmer copy, and nothing blocking the one job: getting it connect.

Meet Emma

Every metric is a person. This one is Emma.

Emma unboxes her new Litter-Robot and starts setup. Ten minutes in, it stalls on an error that explains nothing — and she’s locked out of both the device and the app.

Emma unboxes her new Litter-Robot and starts setup. Ten minutes in, it stalls on an error that explains nothing — and she’s locked out of both the device and the app.

Emma wasn't alone. Onboarding caused a ~20% first-time drop-off and was the leading driver of support tickets. On a device this expensive, that's a returned product, not a funnel metric.

Emma wasn't alone. Onboarding caused a ~20% first-time drop-off and was the leading driver of support tickets. On a device this expensive, that's a returned product, not a funnel metric.

Owners, in their own words — stuck mid-setup, in public.

Three problems sat under Emma’s story — only one was about settings:

Three problems sat under Emma’s story — only one was about settings:

  • No priority — a jam and an activity summary arrived the same way.

  • No priority — a jam and an activity summary arrived the same way.

  • Built around devices, not people.

  • Built around devices, not people.

  • Costing the business — muted users stopped opening the app, and Whisker+.

  • Costing the business — muted users stopped opening the app, and Whisker+.

Where I Started

Before I redrew the flow, I went to the people who absorb every failure.

Before I redrew the flow, I went to the people who absorb every failure.

I knew this flow cold — which is why I didn't trust myself to fix it from memory. I spent the first week with Customer Experience and Quality Engineering. CX showed me the same failures returning as tickets instead of self-serve fixes — onboarding was their #1 contact driver, 35% of tagged conversations. QE knew exactly where setup broke, and why it had never reached design.

Knowing a flow is not understanding it. I couldn't say why it was hard until the people downstream told me.

Knowing a flow is not understanding it. I couldn't say why it was hard until the people downstream told me.

Top Pain points

The failures weren't random. They clustered.

Mapping the 15-screen flow against the drop-off data, device-not-found was the single most common error — 42% of all error events. Underneath it, three patterns did the real damage:

Mapping the 15-screen flow against the drop-off data, device-not-found was the single most common error — 42% of all error events. Underneath it, three patterns did the real damage:

1

Wi-Fi connectivity failures

Wi-Fi connectivity failures

Wi-Fi connectivity failures

No context to self-troubleshoot, so people dropped and trust eroded.

No context to self-troubleshoot, so people dropped and trust eroded.

Drop-off

Drop-off

Eroding trust

Eroding trust

2

Serial scanning friction

Serial scanning friction

Serial scanning friction

Scanning failed often and blocked any forward motion.

Scanning failed often and blocked any forward motion.

Frustration

Frustration

Disconnecting

Disconnecting

3

Lack of guidance

Lack of guidance

Lack of guidance

Generic messages explained little and offered no next step.

Generic messages explained little and offered no next step.

High support

High support

Low insight

Low insight

Setup wasn't failing because it was long. It was failing because every dead end was actually dead — built around the hardware, not the user.

Setup wasn't failing because it was long. It was failing because every dead end was actually dead — built around the hardware, not the user.

The Reframe

Can we design a flow that guides people through a simple, intuitive path — minimizing explicit instructions — and still provides guidance when errors occur?

Simplifying the flow

Six directions, one goal: fewer steps, fewer places to drop off.

Six directions, one goal: fewer steps, fewer places to drop off.

I explored six directions to simplify setup, pressure-testing each against the hardware's real constraints — then iterated the strongest toward the shipped flow.

I explored six directions to simplify setup, pressure-testing each against the hardware's real constraints — then iterated the strongest toward the shipped flow.

Built with AI

I prototyped the fix — then put it in front of people to break.

I prototyped the strongest direction with AI. Figma Make cut the “spaghetti work” of wiring screens, so all four error paths were interactive enough that testers could actually try to recover — and the prototype became the shared reference that aligned engineering before anything was built, not a static file left open to interpretation.

That let me de-risk the direction cheaply — real testers hit the flow before a single screen went into production.

AI prototyping was fast — and real enough to fail in: testers hit an actual dead end and found their own way out.”

People didn't quit because setup was long.
They quit because errors left them guessing.

People didn't quit because setup was long.
They quit because errors left them guessing.

Testing · two rounds

Round one settled the flow. Round two settled the errors.

Round 1 — the flow

Round 1 — the flow

Traditional vs. proposed, thinking aloud.

  • The proposed flow was consistently faster and preferred.

  • People wanted a flow that finds the device itself, not manual steps.

  • Simpler, more intuitive, clearer information.

Round 2 — the errors

Round 2 — the errors

Four scenarios: permissions, device not found, serial in use, Wi-Fi.

  • Support is a safety net, not a first step — people wanted to solve it themselves.

  • Human copy beat codes — “Incorrect password” over “Credentials invalid.”

  • Serial-in-use was the most discouraging; a clear retry restored control.

I'm not sure what this means — I'd try to figure it out myself before reaching out for help.” — participant, user testing

I'm not sure what this means — I'd try to figure it out myself before reaching out for help.” — participant, user testing

The pattern underneath both rounds: people didn't quit because setup was long — they quit because errors left them guessing.

The Call I Made

Two decisions set the structure.

The insight pointed at two things: fewer steps, and a recovery path at every one. Each needed a call that wasn't the obvious one.

The insight pointed at two things: fewer steps, and a recovery path at every one. Each needed a call that wasn't the obvious one.

The “Name it” screen — moved to after the robot connects, and skippable.

1

1

The call — scope

The call — scope

Connect first. Name it later. Onboarding does one job: get the robot working.

Connect first. Name it later. Onboarding does one job: get the robot working.

Connect first. Name it later. Onboarding does one job: get the robot working.

Instead of

Instead of

Naming up front, the way PM and marketing wanted — they argued naming builds attachment, and multi-robot homes need names to tell devices apart.

Naming up front, the way PM and marketing wanted — they argued naming builds attachment, and multi-robot homes need names to tell devices apart.

What it cost

What it cost

The early attachment moment. I gave every robot a default name so nothing breaks, and made naming the step right after it connects — skippable.

The early attachment moment. I gave every robot a default name so nothing breaks, and made naming the step right after it connects — skippable.

Who I brought

Who I brought

PM and marketing — aligned on the default-name compromise instead of winning the argument outright.

PM and marketing — aligned on the default-name compromise instead of winning the argument outright.

2

The call — shipping under constraint

The call — shipping under constraint

Couldn't remove the scan, so I made it impossible to fail.

Couldn't remove the scan, so I made it impossible to fail.

Couldn't remove the scan, so I made it impossible to fail.

Instead of

Instead of

Removing the scan entirely — the right fix, but a long timeline for older devices. The hardware constraint ruled out a quick re-architecture.

Removing the scan entirely — the right fix, but a long timeline for older devices. The hardware constraint ruled out a quick re-architecture.

What it cost

What it cost

A step testers disliked stays in the flow. I made it foolproof — clear framing plus a manual serial fallback so a bad scan never dead-ends. Full removal is now in development.

A step testers disliked stays in the flow. I made it foolproof — clear framing plus a manual serial fallback so a bad scan never dead-ends. Full removal is now in development.

Who I brought

Who I brought

Engineering — the real constraint only surfaced because I took the prototype to them early.

Engineering — the real constraint only surfaced because I took the prototype to them early.

Fifteen screens became nine — and every dead end got a way out.

I cut onboarding to one job — get the device connected — and moved everything non-essential to after setup: Wi-Fi pulled inline, real progress instead of a spinner, success stated explicitly.

I cut onboarding to one job — get the device connected — and moved everything non-essential to after setup: Wi-Fi pulled inline, real progress instead of a spinner, success stated explicitly.

1
Power on
2
Connect mode
3
Network
4
Ready to scan
5
Scan QR
6
Connecting
7
Connected
8
Name it
9
Success

The old errors named nothing. The new ones name the cause and offer a way out.

Provided enough context for users to troubleshoot issues on their own, and offer help as an option.

Provided enough context for users to troubleshoot issues on their own, and offer help as an option.

Rewritten with the UX writer, every recovery screen follows the same four-part shape — name the cause, show the fix, lead with a retry, and always offer a second exit. Underneath, it's one component; each device swaps in its own cause, hint, and illustration.

Rewritten with the UX writer, every recovery screen follows the same four-part shape — name the cause, show the fix, lead with a retry, and always offer a second exit. Underneath, it's one component; each device swaps in its own cause, hint, and illustration.

I built it into a skill the whole team uses — the checklist lives in our Figma, so no device ships an error missing any of the four.

I built it into a skill the whole team uses — the checklist lives in our Figma, so no device ships an error missing any of the four.

Impact · in testing

Nobody got stuck. Setup got a third faster.

0%

0%

drop-off in testing — every participant finished, both rounds (n = 11)

drop-off in testing — every participant finished, both rounds (n = 11)

32%

32%

faster to a working device — 1:48 → 1:13, −35 seconds

faster to a working device — 1:48 → 1:13, −35 seconds

9

9

screens, with error recovery built in

screens, with error recovery built in

Traditional · 15 screens

  • Manual QR scan

  • Select device from a list

  • Limited error handling

Proposed · 9 screens

  • Scan made foolproof, manual serial fallback

  • Device found inline, Wi-Fi pulled in

  • A named cause + a way out of every error

There's no live data in the wild yet — so I set the baseline before launch (first-try success, CX contact share, time-to-first-device) to measure against at 30 / 60 / 90 days.

There's no live data in the wild yet — so I set the baseline before launch (first-try success, CX contact share, time-to-first-device) to measure against at 30 / 60 / 90 days.

Proven in testing, not yet in the wild — real-world drop-off is the number I'm watching next.

Proven in testing, not yet in the wild — real-world drop-off is the number I'm watching next.

Proven in testing, not yet in the wild — real-world drop-off is the number I'm watching next.

What outlasted the project

The work didn't end at my nine screens.

This flow was never just one product's. It's the pattern every new Whisker device now starts from — instead of inheriting the broken one.

A reference flow

The new onboarding is the baseline the next device starts from — not the broken flow it would have inherited.

What ships on it

Feeder-Robot and future devices adopt the same flow and recovery path, so the work compounds.

A reusable component

The error-recovery pattern is a UX-writing checklist — name the cause, show the fix, lead with a retry, second exit — now built into our Figma, so no device ships an error missing any of the four.

A shared mental model

CX, QE, engineering and PM now share one bar: recovery at every step, support as a safety net — not a first step.

It also changed how the next device team starts.

It also changed how the next device team starts.

What I'd carry forward

Three things I'd change.

Three things I'd change.

Start with the downstream teams, not end there. CX and QE held the answer the whole time; I'd open the next project in their inbox, not mine.

Test beyond the building. Eleven Whisker employees is directional, not proof. I'd push for outside users before calling a pattern validated.

Take the hardware to engineering sooner. The scan constraint reshaped the flow and surfaced late. I'd pressure-test the physical limits before the first prototype.

Internal logic doesn't always match the user's mental model. Good onboarding is what bridges that gap.