Three storage layers, each with one job. The encryption key belongs to the person, not to us: content is sealed before it leaves our perimeter. The permanent layer is paid for upfront and does not depend on whether our company exists tomorrow.
Not “the cloud” in the abstract, but three separate stores — each with its own job, its own lifespan and its own cost of failure.
Redis or Vercel KV. This holds the context of the conversation happening right now: the last few turns, the open threads, the things the assistant leans on for its next sentence. Answers come back in milliseconds because nothing has to be fetched from far away. This layer keeps nothing for long, and it is not supposed to.
pgvector inside a Neon database. Experience broken down into vectors of meaning: not “which words were said” but “what this was about”. Retrieval works by closeness of meaning, so the question “what did we decide about moving house” finds the conversation where the word “moving” never appeared.
Arweave, plus a compressed NFT on Solana as the receipt. Storage that cannot be rewritten or withdrawn, paid for once and in advance. Data arrives already encrypted: the network's nodes hold a block of bytes whose contents are unknown to them.
AES-256-GCM. Encryption happens before the upload and the key stays with the owner of the memory. We can confirm a record exists, state its size and the time it was written, and hand it back — but not read it. That is a property of the architecture, not an internal policy.
A copy goes to the permanent layer automatically once an hour, and if a conversation file grows past 90 KB it goes immediately, without waiting for the hour to end. There is nothing to press: no “save to eternity” button exists, and none is planned.
Every upload has a transaction identifier. With it, the record can be located through any public gateway of the network — so checking that your memory is still there does not require asking us or logging into our dashboard.
Conversations do not pour into one common pool. Every user has a folder on the server tied to them personally, on paid plans and on free access alike. Backups are packed and uploaded folder by folder: each person's memory is their own copy, and a restore follows the same boundary.
Every upload carries only what changed since the last one. This is not a penny-pinching trick: re-sending everything would make the cost climb in step with the years you have spent in the system, while increments keep a backup in the tenth year exactly as cheap as one in the first.
What physically happens to a message while you are reading the reply to it.
You send a message. It lands in the working layer — a fast key-value store holding the context of the current session: the last few turns, who the other party is, the things already clarified that nobody should have to ask twice. This layer exists for one property: speed. An assistant that walks to long-term storage for every word turns a conversation into an exchange of letters.
That is why the first layer has a short memory in the literal sense. It is built for minutes and hours, not years. If the system consisted only of this, every morning would start with introductions again — which is precisely how most assistants you have used behave.
So the first layer is never the only one. It is a shop window, not an archive.
It is also the layer most easily mistaken for memory. What many products call “remembering you” is really this layer's window opened a little wider: the session ends, the window closes, and everything starts from zero again.
In parallel, meaning is extracted from the conversation. Turns are converted into vectors — numeric fingerprints of significance — and stored in Postgres with the pgvector extension. This is not a summary and not a compression: a vector does not hold text, it holds the position of a thought among other thoughts.
This is where the ability to remember something six months later comes from. When you ask “we agreed about the doctor, didn't we”, the system does not grep for the word “doctor” across your files. It looks for conversations close in meaning to your question and lifts them into context.
The second layer is the only one that can answer “what do you know about me”. The first is too short-lived; the third is too still — it stores magnificently and is entirely unsuited to being rummaged through.
One more thing worth stating: a vector cannot be read back as speech. It is a string of coordinates that can tell you how close two pieces of content are, and it cannot be turned back into text. So even someone who got hold of this database would be holding a pile of numbers.
The permanent layer is not written after every message — the transaction count and the storage cost would grow for no benefit. Two rules run at once. First: once an hour, a copy of the personal folder goes up. Second: if the conversation file passes 90 KB, the upload starts immediately, without waiting out the hour.
The point of the second rule is protecting a long conversation. An hour of dense talk easily produces more than ninety kilobytes of text, and waiting for the full hour would mean leaving the richest part unsaved. The threshold fires ahead of the timer in exactly the cases where a loss would hurt most.
Neither rule requires the person to do anything. There is no save button — not because someone forgot to build it, but because any manual button eventually goes unpressed. Memory that depends on the owner's discipline is not memory, it is a habit.
This also fixes how much is lost in the worst case: at most the last hour, and only the part of it that has not yet reached ninety kilobytes. We put the number here because any claim of “zero loss” has to explain first how it was counted.
Before upload, the package is sealed with AES-256-GCM. What matters is not the key length in itself but the order of operations: encryption happens before the data leaves the protected perimeter, not “on the storage side”. What travels to the network is an array of bytes and an integrity tag — nodes accept them without knowing what is inside.
GCM mode adds integrity checking to encryption. Change a single byte inside an encrypted package and decryption does not return slightly damaged text — it refuses to run. Tampering cannot disguise itself as a glitch, which is exactly the behaviour you want from an archive somebody will open in twenty years.
The key is not stored alongside the data and is not transmitted with it. That is the only reason we can honestly say we do not read your conversations: not “our policy forbids it”, but “we have nothing to read it with”.
It is worth marking the edge of that statement: encryption protects the copy that has already been packed and uploaded. A conversation happening right now has to reach the model in clear text, or the model cannot answer. We say so plainly instead of covering it with a blanket “encrypted end to end”.
The encrypted package goes into the permanent layer, and it is paid for once — upfront, for the whole storage term, rather than monthly. In return comes a transaction identifier, and a compressed NFT is written on Solana: a compact receipt stating that a given portion of memory exists, of a given size, with a given timestamp.
The receipt does not contain the conversation. It contains proof. The difference matters: proof can be shown to anyone — an heir, a lawyer, yourself twenty years from now — without revealing a single line of content.
The way back is shorter. The owner arrives with the key, the system pulls the package by its identifier, decrypts it and hands it over. If our dashboard is unavailable for any reason, the package can still be retrieved through a public gateway and decrypted locally, on your own machine.
The way back is deliberately built to route around us, for a plain reason: people come for their memory at the least convenient moments — a move, a change of country, an illness, a funeral to arrange. On days like that, every additional party you must contact is one more place where things get stuck.
Pushing three jobs into one store sounds simpler, and in practice each of them ends up done badly. To be fast, data has to sit next to the computation, and a place like that is volatile by definition. To be searchable by meaning, content has to become vectors with an index, and an index has to be rebuilt often. To last to the end, it has to be written to a medium that cannot be rewritten — and what cannot be rewritten cannot be reindexed.
The requirements fight each other, so they were separated: the first layer trades lifespan for speed, the second trades immutability for understanding, the third trades flexibility for immutability. None of them is enough on its own; together they make a memory.
The split has a by-product: the credentials split with it. The keys that run the fast cache do not open the vector database, and the vector database holds only numbers. Even if somebody gets through one door, a person's life does not add up from it. Security here is not a shell bolted on top but the natural result of a division of labour.
This is also why we do not say “we store your data in the cloud”. The cloud is a blanket word, whereas each of these layers has a specific way of failing and a specific remedy for it. Saying those out loud is more useful than offering a reassuring noun.
Eight properties, every one of which can be checked rather than taken on trust.
Encryption happens before upload and the key stays with the owner of the memory. We physically cannot read the content — only confirm that it exists and hand it back. This is an architectural property, not an internal rule that a new owner could rewrite by memo.
A record cannot be erased from immutable storage: the property that grants permanence also works against you. But an encrypted package without its key is noise, indistinguishable from random numbers. Destroying the key counts as erasure, and no honest alternative exists — for us or for anyone else.
The permanent layer takes no monthly fees: storage is paid for once, at the moment of writing, out of a fund sized for the long run. Your subscription ending, our service ending, or our company ending does not stop the storage, because the storage no longer depends on our payments.
The working, semantic and permanent layers live in different systems with different credentials. Access to the fast cache does not grant access to the vector database, and access to the vector database does not grant content: what sits there is numbers, not text. Breaching one layer does not add up to reading a life.
GCM mode produces an integrity tag: an altered package does not decrypt at all. An archive cannot be quietly forged — an attempt to edit it turns it unreadable, and that shows up immediately rather than years later when there is nothing left to compare against.
Every portion of memory has a transaction identifier. Its presence is checked through the network's public gateways, so nobody has to trust our dashboard, our report or a support agent's word. They look for themselves — which is the whole difference between storage that is verified and storage that is promised.
Conversations export to an open text format, transaction identifiers export to a list, and the key is yours already. With those three in hand we stop being a required link. A system you cannot walk out of, however well it is described, is not your memory.
A package carries labels: whose it is, when, how large, which part of the conversation it covers. They let the right piece be located later without unlocking the whole archive. The content itself stays sealed, and the labels give away nothing about what was discussed.
Eight steps, none of which the person performs.
Every user has their own folder on the server, tied to them personally. Dialogues accumulate there on paid plans and on free access alike. Saving conversations is not a paid add-on: everyone has it, because without it the whole construction loses its point.
Once an hour the scheduler takes whatever changed since the previous run. Not the whole archive — only what is new, otherwise cost and upload time would grow in step with the length of your life inside the system.
Alongside the timer, a threshold watches the conversation file: cross 90 KB and the upload begins at once. A dense conversation does not wait for the end of the hour, and this is the only exception to the hourly rhythm.
Changes are gathered into a single package and labelled: whose it is, when, how large, which part of the conversation it covers. The labels exist so that the right piece can be found later without decrypting the entire archive.
AES-256-GCM with the owner's key. After this step the content no longer exists in readable form anywhere outside the protected perimeter — not on intermediate disks, not in queues, not in logs.
An upload to Arweave with a single payment made in advance. Once there, it cannot be recalled or rewritten — which is precisely what we were after when we chose this kind of storage.
A transaction identifier and a compressed NFT on Solana. From this moment the existence of the record can be proven without us, while reading it still requires the key. Identifiers accumulate in a list the owner can export.
The list of identifiers and the key are handed over in advance, not requested once something has already happened. A request assumes someone is left to receive it; we want an heir to recover the memory with those two things even when nobody is. There is no technical difficulty in this step, but it is the one that decides whether all the previous ones count.
Compared on the properties that start to matter not today, but a decade from now.
| Property | Ordinary cloud | PADAM memory |
|---|---|---|
| Who holds the key | The provider — otherwise search and previews break | The owner of the memory; encrypted before upload |
| If payment stops | Data is deleted after a few months | The permanent layer was paid for at write time |
| If the company closes | An email saying “export within 30 days” | Records stay in the network, the key stays with you |
| Can an old record be changed | Yes, and no trace remains | No; editing breaks the integrity check |
| Search | By file name and words inside | By meaning, through vectors |
| How often a copy is made | On a schedule, or manually | Every hour, or instantly at 90 KB |
| What the custodian sees | Files, names, previews | Bytes without a key |
| Proof that a file exists | A row in the provider's interface | A transaction identifier in a public network |
| Verification without the provider | Not possible | Through any public gateway |
| What “delete” means | A deletion flag, then emptying the bin | Destruction of the key |
| Who pays for storage in twenty years | You, monthly, for as long as you keep paying | Nobody: it was paid at write time |
| Export format | Usually proprietary: exported and then unopenable | Open text, readable in any editor |
| How an heir recovers it | Through support, if the company still exists | With the key and the list of identifiers, without us |
| Changes to the terms | The provider rewrites them unilaterally and retroactively | A written record is not affected by any terms |
Independence is not a slogan; it is a set of unglamorous engineering decisions.
Any service holding your memory is a contract with a legal entity. Contracts get terminated, entities go bankrupt, jurisdictions impose restrictions, and providers change storage terms retroactively. None of this requires anyone's bad intent: a change of ownership is enough.
That is why the third layer is deliberately placed where there is no single owner: a network where independent nodes hold copies of the record and the storage fee has already been paid. We are not a “partner with a guarantee” there — we are simply one more participant who wrote something into it.
The practical consequence is simple. To erase your memory it is not enough to close our company, revoke our licence or block our domain. You would have to switch off a distributed network, and that has no master switch and no office where the request could be filed.
None of this means we do not matter. The first two layers are still run by us, and how comfortably they work depends on how well we build them. The difference is only this: if we build badly, you are inconvenienced; if we are gone, you do not lose the memory.
Storage costs money, and “we will pay forever” is worth nothing without a source. So the source is built into the economics of the ecosystem: 65 % of everything passing through the Solana router goes to the treasury and is spent buying AR — the resource of the very network where the permanent layer lives.
The rest is split just as rigidly: 5 % to the Founder's Fund, 5 % to burn, and 15 %, 7 % and 3 % to partners at the first, second and third levels. If a level has no partner, that share does not settle with us — it goes to burn.
The ecosystem token is $GALATIN on Solana, with a hard-capped supply of 10 000 000 000 and not a single unit beyond. The point of the cap is not speculation: it is that the storage fund cannot be topped up by printing, only by real payment flow.
We spell the whole chain out on purpose: storage that calls itself permanent but cannot say who pays for it in ten years is permanent only for the length of the sentence. Here it can be said — where the money comes from, where it goes and in what proportions it is split.
Assume the worst: the service stops. The first layer vanishes instantly — it was built for minutes and there is nothing there to lose. The second, the semantic one, is a database that can be exported; it is reconstructible, because vectors can be recomputed from the source records.
The third does not change at all. Encrypted packages stay in the network, transaction identifiers stay public, and the receipts on Solana do not go anywhere. To recover the memory an heir needs two things: the key and the list of identifiers.
That is why we insist the key and the list are exported to the owner in advance, rather than “on request in a difficult moment”. A request assumes there is someone left to process it — and we are building a system that works when there is not.
The order matters too: hand over the ability to retrieve first, and only then talk about other features. In a system that ties people in first and promises to add an exit later, the exit usually never gets added.
The encryption key. We do not keep it, which means losing it is unrecoverable: without the key nobody restores the content, us included. That is the flip side of nobody reading the conversations, us included. The two are not sold separately.
The list of transaction identifiers. An ordinary text file with which anyone with an internet connection can locate the encrypted packages through a public gateway, bypassing our site and our dashboard entirely.
An export in open formats. Conversations remain text, not a proprietary database that “only the app knows how to open”. Portability is a property of the infrastructure too, not a courtesy from support.
Together these three make a very plain test: if we all disappeared tomorrow, would what you are holding be enough to read the memory back. The answer has to be yes — and if it is not, the fault is in our design, not in your failure to keep a backup.
We do not keep a backup of the key. From the outside that looks like a missing courtesy, but the moment we take it on, everything said above about “we cannot read it” is cancelled at a stroke: any mechanism that returns the key to you can be triggered by somebody else using the same words.
We do not promise “full deletion from the blockchain”. Nobody can erase bytes from an immutable network; what can be done is destroying the key, leaving the package as noise. A vague phrase looks like an extra guarantee, while in fact it is one honest sentence less.
We do not turn saving into something the user has to keep in mind. There is no sync button and no reminder to “export your archive this month”. A backup that depends on a person remembering is, statistically, no backup at all.
Nor do we intend to sell “memory” as an emotional promise. Everything here is checkable: the encryption algorithm, the writing rhythm, the place of storage, the source of the money, the method of verification. The rest — what those conversations actually meant — belongs to the people who had them, not to the infrastructure.
On three layers at once, and this is not duplication for its own sake. Working context sits in a fast key-value store (Redis or Vercel KV). Semantic fingerprints sit in Postgres with the pgvector extension, hosted on Neon. Encrypted archives sit in Arweave, with a receipt in the form of a compressed NFT on Solana.
Each layer has a different lifespan: minutes, years, and “for as long as the network exists”. Writing everything only to the third would be slow and expensive; writing only to the first means forgetting you every morning.
There is one more foothold between those layers — the personal folder on the server: a conversation is written there first, and from there it goes off to be encrypted and uploaded. So the precise answer to “where are my conversations” is: in four places at once, and only one of them can be read.
The holder of the key. Encryption happens before upload and the key does not travel with the data. Our staff, the storage network's nodes, and anyone who gained physical access to the disks all see the same thing: a block of bytes and an integrity tag.
We can say a record exists, how large it is and when it was written. That is everything we can say — which is not modesty but a description of our capabilities.
The same boundary applies to legal requests: we can be required to hand over a package, but what gets handed over is ciphertext. Only the holder of the key can turn it back into text.
The content becomes permanently inaccessible. That follows directly from us not holding it: there is no system where support can restore access but an outsider with the same arguments cannot.
So treat the key the way you treat a will or a safe-deposit key: one copy somewhere reliable, another with someone you trust. We do not replace that procedure and do not pretend to.
A side note: losing the key does not stop the record from existing. The package stays in the network and the transaction identifier stays public — it is only that nobody can read it as text any more. That is not the same as “the data is gone”.
Bytes cannot be erased from an immutable network — not by us, not by you, not by anyone. This is the same property the permanent layer was chosen for: a record that can be pulled on request will not outlive its owner.
Practical deletion works differently: the key is destroyed. After that the package becomes noise indistinguishable from random data, and no content can be recovered from it. We call this what it is and do not promise “full erasure from the blockchain” — no such button exists anywhere.
The first two layers can be cleared in the ordinary way: the working layer expires by itself, and vectors in the semantic layer can be deleted. So “make the assistant stop remembering this” is entirely doable; what is not doable is making ciphertext already written into the network disappear.
That is an honest risk and we do not hide it. The permanent layer is built on a model where the fee is paid upfront and spent on storage over a long horizon, while independent nodes around the world hold copies of the record. The wider the network, the less plausible a simultaneous failure.
The second mitigation is portability. The owner holds the encrypted packages and the key. A package is a file: it can be put anywhere else as well, including an ordinary drive in a cupboard. We deliberately avoid a format tied to a single network.
Put differently: we do not stake everything on a single network, and we do not advise you to either. The permanent layer removes the need for somebody to remember to renew a payment, not the need for a second copy.
The hour is a compromise between transaction cost and the size of a possible loss. Writing after every message is expensive and pointless; writing once a day means losing a whole day of conversation sooner or later.
90 KB is the size at which a chat stops being a few messages and becomes a substantial piece of a life. The threshold fires ahead of the timer exactly when the conversation is running dense — that is, in the most valuable cases.
Taken together, the two rules work out like this: on a quiet day one upload an hour is enough, and on the day you say a great deal in one go the system speeds up its own rhythm, without you having to remember anything.
Yes. Every user's conversations go into a personal folder and into the archive regardless of plan — that is part of the architecture, not a paid feature. Plans differ in limits, in the depth of personal knowledge bases and in the volume of the permanent layer, not in whether saving happens.
Worth stressing separately: no manual clicks on any plan. A user should never have to “sync” anything — because if they had to, one day they would not.
The decision looks generous, but it is actually self-interested: in a system where only paying users are preserved the memory has holes, and memory with holes cannot carry the phrase “digital eternity”.
Ordinary search matches characters. Semantic search matches closeness of meaning: a message becomes a vector, and the records that end up nearby are the ones about the same thing, even when the words differ.
The difference shows on questions like “what did we decide about my father”. Keyword search returns every mention of the word “father”. Meaning-based search returns the conversation where the decision was actually made, while it was being called “this whole business”.
The price is that the semantic layer gets things wrong: closeness of meaning is no guarantee that this is the record you wanted. So it only brings candidates to the surface; whether they are the right ones is settled between you and the assistant in conversation.
It is a compact record on Solana that costs a fraction of a cent and serves as a receipt: this portion of memory was uploaded, of this size, at this time. It contains no content and cannot.
The receipt matters wherever something has to be proven without us: to heirs, to a lawyer, to yourself twenty years from now. A link to our dashboard is not proof. A public transaction is.
The compressed form was chosen for cost: an ordinary on-chain record would be absurdly expensive at one backup an hour, while a compressed NFT makes “a receipt for every portion of memory” economically possible.
Philosophical Activation of Distributed AI Memory — the name of the approach to restoring the integrity of an AI's memory. In practice it is the rule of splitting into three layers — working, semantic and permanent — each with its own job and its own lifespan.
The name points at the idea that an assistant's memory is assembled from meaning rather than from logs: what matters is not which bytes passed through, but what the person meant and what followed from it.
It is more useful to read it as an engineering agreement: any piece of memory should answer three questions — is it usable now, will it be findable later, will it survive in the end. One layer answers each.
It does. Memory is tied not to a device but to your personal folder and the semantic layer. Change the phone, move to another computer, carry on in Spanish instead of English — the same context comes back.
That is one of the gains of making the semantic layer a layer of its own: a vector records meaning, and meaning does not belong to one language. Whatever language the question is asked in, the same thing is found.
What is in the personal folder does not vanish because one upload failed: the next run tries again. Both the hourly rhythm and the 90 KB threshold fire repeatedly — this is not a single chance.
A portion counts as written to the permanent layer only once a transaction identifier has come back. No identifier, no record — a simple rule, and it is the one that rules out the “I thought it was saved” case.
Spark — $15/mo: baseline access to the AIfa assistants and memory saving. Family Archive — $100/mo: extended limits, personal knowledge bases, family access. Digital DNA — $1 000 once per device, then $200/mo: a personal protected perimeter and full recording of the personality.
The one-off part of the top plan is precisely about the permanent layer: its cost is paid in advance, because the storage fee in the network is itself paid in advance.
Worth keeping separate: a plan buys limits, depth and volume, not whether saving happens. Saving is open to everyone, it does not change with the plan, and stopping payment does not claw back what has already been written.
$GALATIN on Solana is the ecosystem's unit of account, with a supply capped at ten billion. Payments pass through the router, and 65 % go to the treasury to buy AR — the very resource that pays for the permanent layer.
The connection is not symbolic: the more memory is preserved, the more money flows into preserving it. Another 5 % goes to the Founder's Fund and 5 % to burn, while 15 %, 7 % and 3 % go to partners across three levels; where a level has no partner, that share is burned.
Anyone who simply wants their things stored in peace does not need to memorise these percentages. They exist to answer one question: who pays the storage bill in ten years. The answer is not “trust us” but a distribution rule written into the contract.
Yes, and it is verifiable rather than declared: an export of conversations in open text format, the list of transaction identifiers, and the key. With those three things our service stops being a required link in the chain.
We consider that a condition of honesty. Infrastructure you cannot leave is not permanent memory, it is dependency. If anything in this description does not match what you see in your dashboard, write to contact@codeofdigitaleternity.com — that is a discrepancy, not a feature.
After you leave, whatever has already been written to the permanent layer stays yours: closing an account does not recall it, and reading it does not require our approval. By design, that is not ours to decide.