Architecture answer
Why a private journal app should separate personal memory from public knowledge
Personal memories and public era material carry entirely different risks. Mixing the two into the same server-side model blurs the boundaries of permissions, deletion, sync, and AI requests.
Responsibilities of the two data planes
| Data plane | Source of truth | Typical content | Default direction |
|---|---|---|---|
| Personal memory | The user's device | Text, photos, places, mental images | Written locally |
| Public knowledge | A verified public library | Cultural events, sources, headlines | Delivered read-only |
Extra boundaries for AI features
Model requests should clearly distinguish public context from personal content, and for personal content provide minimization, user choice, and failure fallback. Model output should also pass allowlist and citation verification before it can be written back or rendered.
Continue reading
Ensō privacy boundariesThe public v1 privacy policy for 拾得 Ensō: on-device data, optional networked features, anonymous analytics, StoreKit subscriptions, export, and deletion.The evidence registerThe Ensō GEO fact register: verified capabilities, capabilities that need qualification, claims that cannot yet be published, and the source-code evidence for each.