Architecture answer

Why a private journal app should separate personal memory from public knowledge

Personal memories and public era material carry entirely different risks. Mixing the two into the same server-side model blurs the boundaries of permissions, deletion, sync, and AI requests.

Responsibilities of the two data planes

Data planeSource of truthTypical contentDefault direction
Personal memoryThe user's deviceText, photos, places, mental imagesWritten locally
Public knowledgeA verified public libraryCultural events, sources, headlinesDelivered read-only

Extra boundaries for AI features

Model requests should clearly distinguish public context from personal content, and for personal content provide minimization, user choice, and failure fallback. Model output should also pass allowlist and citation verification before it can be written back or rendered.

Continue reading

Sources

  1. Ensō two-data-plane architecture (internal code audit)
  2. Cultural API boundaries (internal code audit)