Principles
Five North-Star statements. When two design options conflict, these are the tie-breakers.
The product is for operators, not visitors.
A buyer-office runner uses Huchu for eight hours a day. We optimise for the third hour of the second day, not the first ten seconds. That means density over delight, keyboard over click, and the experienced default over the helpful tour.
What this means
Every screen is built to be re-used, not explored. No onboarding banners; no "discover" copy. The operator already knows why they're here.
What this rules out
Marketing surfaces inside the product. Tooltips that explain icons. "Tips" or "did you know" prompts.
Quiet is correct.
No celebratory motion. No confetti, no "great job", no animated checkmarks. The work is the reward. When something happens, we tell the user once, in past tense, and move on.
What this means
Toasts are one-line and disappear. Status changes are visible by colour and label, not by animation.
What this rules out
Bouncing checkmarks, looping spinners on a finished task, exclamation points in any product copy.
One screen, one job.
A page solves one problem at a time. Multi-table mega-dashboards split into focused surfaces — each with its own header, one primary action, and a clear way back. Side rails carry related work; the main column is the job.
What this means
Exactly one primary button per screen. Settings is multiple pages, not one with twelve sections. Detail pages anchor to one record.
What this rules out
Crowded screens with three side-by-side modules competing for attention. Modal-in-modal. "Quick view" patterns that try to be two pages at once.
Audit is a feature.
Every consequential action is timestamped, attributed, and undoable for as long as policy allows. Approvals carry the approver's name and the moment they approved. Settlement carries the variance.
What this means
List items show who did what and when. Edits leave a trail. Reversals create their own record, never silently undo.
What this rules out
Anonymous actions. Silent re-writes of data. "Are you sure?" patterns that try to substitute for audit — confirmations don't help if you can't reconstruct what happened.
Every operator carries their own context.
A cashier at till 02 doesn't see the owner's group dashboard. A bursar at Trinity College doesn't see a parent's invoice screen. Permissions aren't decorative; they shape every surface. The portal you log in to is the portal that fits your role.
What this means
Portals are separated by shell, not by tab. Roles change which modules and which records appear, end-to-end.
What this rules out
"Switch view" dropdowns. Generic "users" — staff, parents, students, cashiers and platform admins are different audiences with different shells.