An AI companion with memory, on a pipeline that cannot identify anyone

Memory is the feature that makes a companion feel like one, and it is the feature most likely to become a liability. The design here separates the two. Nothing is remembered at all unless the person has granted a specific consent for it — not the terms of service, not an implied opt-in, a consent record of its own type that can be withdrawn on its own. When it is granted, a small extraction pass reads the conversation and emits add, update and remove operations against a per-user memory table, so what accumulates is a set of revisable statements rather than a transcript.

There is a second control most products do not have, and it exists because “delete everything” and “keep learning” are not the only two things a person might want. Pausing memory means the assistant still remembers what it knows and stops learning anything new. Reads continue, writes stop. It is one boolean, and it is the difference between a product that offers a privacy setting and one that offers a useful one.

The crisis screen runs before the model, not after it. A message matching any of the configured patterns short-circuits the whole pipeline: no request is made, no recommendation is attached, and the reply is a fixed bilingual text carrying real helpline numbers. Routing a distressed person through a generative model and hoping the system prompt holds is a design decision, and it is the wrong one — the moment the answer matters most is the moment you want it to be a constant rather than a sample. The message is stored flagged, so the operators can see it happened.

What the platform will not learn about you is enforced by the shape of the pipeline rather than by a promise in a policy. Every vision step is handed a closed vocabulary and asked to answer from it: the coffee and palm flows return entries from a symbol and pattern catalogue held in the database, and the compatibility flow returns five coarse attributes from an enumerated whitelist in configuration, each with an “unknown” value, a confidence threshold and a hard cap on how often it may be mentioned at all. Its prompt names the special categories — race, ethnicity, religion, health, disability, personality — and forbids inferring any of them. No step in the system has an output shape that could carry a biometric template, because no step is allowed to answer in free text about a person’s face.

Retention is written down as numbers with reasons beside them. Photographs attached to a request are deleted a fixed number of days after that request completes, because the purpose they were collected for has ended, and the config file says so in those words. Temporary uploads expire in twenty-four hours and signed URLs in one. Conversations belonging to visitors with no account are hard-deleted on the same clock. Orders are kept for ten years, because Romanian fiscal law requires it and privacy is not a licence to destroy records somebody is obliged to hold. Each of those is a scheduled command rather than an intention, which is the only version of a retention policy that survives a busy quarter.

Payments were built as a contract before they were built as an integration. One interface — register an order, refund one, declare which currencies you support, say whether you are enabled — and three processors implementing it, chosen per order at run time rather than compiled in. Prices are held and charged in the buyer’s own currency, converted at the national bank’s published rate, and every operation lands in an audit table. Adding a fourth processor is a class; it was a class the second time, which is how you find out whether the abstraction was real.

Spending is bounded in two places, because a conversational product with an unbounded one is a product with an unbounded bill. Daily message counters are kept per visitor, per account and per address; a subscription that grants unlimited access lifts the ceiling but not the counting, so the operational dashboards keep seeing real volume rather than only the volume that was charged for.