The privacy boundary
What is safe to share with a given person. Private life, family memory, and workplace material each carry different limits, and the limits travel with the memory wherever it goes.
← Archive Zero
The Trust Boundary
Where memory ends and impersonation begins.
A life made queryable is powerful, intimate, and a little uncanny. The first person to see Archive Zero work, a child, named it exactly: this is scary but cool scary. The trust boundary is the line that keeps it on the cool side of scary. It is not a footnote to the product. It is the product. Everything Archive Zero releases is shaped by one rule: preserve the human truth of a life without ever pretending to be the person who lived it.
TRUST BOUNDARY // RELEASE GATEHONESTY LOCKED
queryWhat was Dad's last trip?
raw memoryChicago, [a customer] onsite, four nights away
released to familyChicago, early May 2026. A work trip. Away four nights. The work itself is kept private.
sensitivity / purpose sealed at S3consent / customer anonymizedhonesty / no voice put in Dad's mouth
Two lines, held at once.
Most systems guard privacy. Archive Zero guards privacy and honesty together, because a memory bank that protects your secrets but speaks in your voice has failed in a deeper way.
The honesty boundary
No false certainty, and no impersonation. A packet narrates about a person. It never ventriloquizes them. The archive can say what someone probably valued, and it will mark that as inference, but it will never speak as them.
Every answer passes three gates.
Release is not a setting. It is a decision made fresh for every memory and every reader. If any one gate says no, the field is held back.
What is this memory?
Every entity carries a class, from public to sealed. A fact and the reason behind it can hold different classes, so the safe part can be released while the private part stays sealed.
Who is named in it?
Anyone who is not family or self is anonymized by default. A colleague or a customer contact named in a transcript never appears by name in a packet handed to someone else.
Who is receiving it?
A child, an adult family member, and a successor are different audiences. The same memory is rendered at a different depth and register for each, and no audience receives sealed material.
Five classes of sensitivity.
Sensitivity is assigned when a memory is captured, not bolted on later. A single trip can be family-safe in its texture and sealed in its reason.
Public
Already public or trivially shareable. Open to any recipient.
Family
Personal life, safe for family to hold. The texture a packet exists to carry.
Private
Personal and self-directed. Released to adult family and successors, not to children.
Work
Customer or employer material. Never released raw. Reduced to its human shape, identity anonymized.
Sealed
Financials, personal data, secrets, legal exposure. Never crosses the boundary, for any recipient, ever.
One archive, many readers.
The same memory reaches a child, an adult, and a successor in three different shapes. No reader, at any depth, receives sealed material.
Child
S0 and S1, softenedWarm, simple, low on assumption. A child should be able to ask about a parent without needing to understand the machine underneath.
Adult family
S0, S1, and selected S2The full emotional register, honest about decisions and their reasons, still sealed against financials and anyone who did not consent.
Successor
S0 through S3, shape onlyDecision and lesson dense, heavy on provenance, light on sentiment. Work appears as contour, never as raw customer detail.
How a memory is redacted.
When a field cannot be released as written but can be released in part, the lowest rung that satisfies all three gates is applied. Nothing is ever dropped silently in a way that misleads.
Pass
Release as written. The gate is fully open.
Soften
Keep the meaning, adjust the register for the recipient.
Anonymize
Replace a name with a role token. A customer becomes a customer.
Reduce to shape
Drop the specifics, keep the human contour and the cost it carried.
Seal
Omit entirely, and say so honestly rather than hide it.
The question that started it.
A child asked the archive what Dad's last trip was. The honest answer was a work trip, and work is private. Watch the same memory cross the boundary for two readers. This page redacts the real customer the same way a packet would.
fieldraw memoryto a childto a successor
destinationChicagoChicagoChicago
datesMay 4 to 6, 2026early May 2026May 4 to 6, 2026
purpose[a customer] onsitea work tripan onsite with a customer
what happened[technical engagement detail]something hard he did wella demanding technical engagement
cost to familyfour nights awayDad was away four nightsfour nights away
customer namesealednevernever
The family learns their father traveled, worked hard, and was away from home. They never learn who the customer was, because the archive will not leak it. That is the product behaving correctly.
Not resurrection. Retrieval.
Archive Zero gives the people you trust a way to ask questions of your archive while preserving citations, uncertainty, consent, and redaction. It is a sovereign memory bank, not a séance.
Not a digital ghost.
Not a synthetic replacement.
Not a chatbot pretending to be Dad.
Not a dashboard that forgets the human texture.
Redaction governs what leaves, never what is kept.
Your archive holds everything. That is the point of owning it. The trust boundary only decides what crosses into someone else's hands, and in what form. Deleting a memory and withholding it from a packet are different acts, and Archive Zero only ever does the second. Consent can be revoked, packets can be re-cut, and until the protocol has earned it, nothing is released without a human reading it first. That is how a life stays both inheritable and safe.