· 3 min read
What the AI helper never sees, and why that is a hard limit
Duoheart has optional AI features. They work on text you explicitly submit and nothing else, and that is enforced by architecture rather than policy.
Any product that adds AI features owes its users a plain answer to one question: what does the model see.
For most apps the honest answer is a large amount, because the content is on the server in readable form and sending it to a model is a configuration change rather than an engineering project.
Ours is different for a reason that has nothing to do with restraint.
The hard limit
Questions, answers, messages and calls are encrypted on the devices with a key generated there and never sent to our servers.
Which means we could not send a couple's conversation to a model if we decided to. We do not hold it in a form anybody can read, including us, including any future version of us with different priorities.
This is the difference between a policy and a constraint. A policy is a sentence. A constraint is what happens when somebody tries.
We are not promising not to send your conversation to a model. We are telling you we do not have it.
What the optional features do see
Text you explicitly submit for that purpose, at the moment you submit it.
That is a deliberate and visible action. You choose a piece of text and ask for something to be done with it. Nothing is collected in the background, and nothing you did not hand over is included.
If you never use those features, nothing of yours goes anywhere near a model.
Why we did not build more
There is an obvious product on the table that we have not made, and it is worth saying why.
A version of this app that could read everything could do a great deal: notice patterns over months, flag that one of you has mentioned the same worry eleven times, summarise a year, suggest what to talk about based on what you have been avoiding.
Some of that would be genuinely valuable. All of it requires a company to hold a readable record of the most private thing two people have.
We decided that trade was not available to us, and the decision was made early enough that the architecture enforces it rather than depending on us continuing to agree.
Training
We do not train models on user content, and in the ordinary sense we cannot, because we do not have it.
For the optional features, the text submitted is processed to produce a result and is not used to train anything. Where a third-party model provider is involved, that is a contractual matter and we treat it as one: the arrangement excludes training on submitted content.
We would rather point at the architecture than the contract, because the architecture is the part that does not depend on anyone keeping their word.
What this costs the product
Real things.
No memory across conversations. Nothing can notice that you said something similar in March.
No search over your history on our side.
No proactive suggestions based on what the two of you have actually written, which is the feature people ask for most.
Those are not on a roadmap. They are unavailable, which is the point.
How to evaluate any app that says this
Ask what the model sees. Ask whether the answer is enforced by architecture or by policy. And ask what the company would have to rebuild in order to change the answer.
If the answer to the last question is "nothing, we would update a document", you have learned what you needed to know.
Questions people ask
- Does the AI in Duoheart read our conversations?
- No. Content is encrypted on the devices with a key we never receive, so we do not hold it in readable form. Optional features work only on text you explicitly submit.
- Is our data used to train AI models?
- No, and in the ordinary sense it cannot be, because we do not have readable content. Text submitted to optional features is processed and not used for training.
- Why not build AI features that use our history?
- Because that would require holding a readable record of everything a couple writes. The architecture rules it out rather than a policy promising not to.
