A private universe of the people you know.

Abstract

Netty is a private app for iPhone and iPad (Mac in release prep) that remembers the people in your life the way you actually experience them: as a living night sky.

You write or speak a moment, “Met Sasha at HVLV, friend of Ivan, might help with casting,” and Netty reads it, shows you what it understood, and saves it only when you approve. Each person becomes a star; each moment orbits them; everything stays exactly where you left it, so finding a memory feels like flying back to a place you know. Everything happens on your device. No account, no cloud, no company reading your notes. And every answer comes with the original notes that prove it. This paper explains how that works, and why it is built this way.

§ 01 / The problem

Four tools. Not one built to remember a person.

Who introduced you, where you met, what someone cares about, what you promised, what they said last time. That's the real material of a relationship. Plenty of tools hold pieces of it. None were built to hold the whole thing.

• CRMs are built for sales pipelines and teams: company, deal stage, follow-up date. They reward selling behaviour, not remembering. Nobody logs a friendship into a pipeline.
• Note apps capture the words but flatten the connections. “Met Sasha at HVLV, friend of Ivan” is three linked facts about two people and a place; a note stores it as one string of text, and the links between them, where the actual recall value lives, were never part of what a text field could hold.
• Social networks hold your relationship data on someone else's servers, shaped by someone else's incentives, and feed it to someone else's business model.
• AI memory tools route your most personal data through cloud models (cost, latency, and a standing privacy exposure, for a start), and they'll confidently describe things that never happened. For a memory tool, that's disqualifying.

The gap is a tool that captures a memory as casually as a note, keeps it entirely on your device, never invents, and makes recall feel like remembering, not like querying a database.

That is what Netty is. It is deliberately not a CRM, not a team tool, not a social feed, and not an AI chat companion. It is a single-user, private instrument. And, as §05 explains, some of those exclusions turn out to be safety features, not just scope cuts.

§ 02 / How it works

One loop, and every step carries a promise.

Netty's whole life is a single loop: you write → it reads → you approve → it becomes part of your sky → you ask, and it answers with receipts. Each step carries a guarantee, and each guarantee is enforced in code, not in a promise.

1 / You write it down

Capture is one calm, conversational box: talk to your universe. You type or dictate a messy human sentence, exactly the way you'd tell a friend. Voice is transcribed on the phone itself. Nothing is sent anywhere to be understood. The same box answers questions, and the difference between a note to save and a question to answer is decided by a simple, transparent rule you could explain to a child, not by a model guessing your intent.

2 / Netty reads it

When you save, ordinary, inspectable software, not a language model, reads the structure out of your sentence: the people, the places, the relationships (“friend of Ivan”), the open threads (“might help with casting”). It also writes a one-line distillation of the moment by counting against your own history: “first memory with Sasha,” and later “fourth note this month with Vera.” Same note, same result, every time. No randomness, no invention. The promise here: nothing is invented.

3 / You approve

Nothing saves itself. Netty shows you what it understood, in its own plain voice, and you confirm or correct it before anything is written. If something looks ambiguous, say two people with the same name, it flags the exact collision rather than guessing. Notes shared in from other apps land first on a holding board that works like an airlock, and never fall straight into your universe. The promise here: nothing saves itself. Every suggestion Netty ever makes is confirm-or-dismiss. There is no confidence level at which it acts without you.

4 / It becomes part of your sky

On approval, the note becomes structure: a person becomes a star, the moment orbits it, relationships become lines of light, and your raw sentence is stored word-for-word. Everything Netty derived sits beside your words, never over them. The promise here: your words are never rewritten. Your sentence is the permanent record; Netty's reading of it is only an annotation.

5 / You ask, and it answers with receipts

Recall is grounded, always. Ask “who do I know who models?” and the answer is a set of your actual saved notes, shown verbatim, with the people, dates, and how strongly each matched. Netty searches in layers so search never goes dark: your exact names first, then meaning, then plain words. And it never fabricates. If nothing matches, it says so: “Nothing found, and Netty never looks anything up online.” An empty answer is an honest answer, never a generated one. The promise here: receipts always.

§ 03 / The living universe

A place, because a place is easy to remember.

Most tools show relationships as lists. Netty shows them as a place, because human spatial memory is old, vast, and nearly effortless: the same faculty behind the ancient “memory palace.” A place only works as a memory palace if it holds still. So Netty's first law of space is simple:

A star never moves. Position is identity; light is meaning.

Where a star sits is fixed the moment it is born, derived from who it is, not from how important it is, not from how recently you spoke, not from anything that changes. New stars settle into the sky without ever nudging the old ones. Everything that does change expresses itself in light instead:

• Importance is brightness and size, never position. Someone who matters glows; they don't migrate to the centre.
• Recency is glow. A memory ages visibly. An untouched moment dims, but never disappears. Every star and every connection stays visible, always.
• Meaning is colour and shape (§04), and that may deepen as your notes accumulate.

Two more laws keep the sky honest. Real people and decoration never mix. Your people carry the meaning-colours; the thousands of faint background stars are deliberately colourless, so nothing decorative can be mistaken for someone real. And importance is never layout: there are no grids, no folders, no “top contacts” row. The universe is arranged by identity and read by light. The result is that recall becomes navigation: you fly to Ivan's corner of the sky, and Sasha is where she always was, two lines of light away, exactly as bright as she matters.

§ 04 / Seven kinds of meaning

Netty listens for what a moment is about.

As Netty reads a note, it listens for seven kinds of meaning: seven signals. They are not folders you file things into; they are things Netty notices about how you already write. A note can carry several or none. Over time each person accumulates a dominant signal, and that, not their job title, not how recently you texted, sets the colour of their star.

The seventh is the Central Self, gold, the notes where you appear in your own universe: reflection, belief, feeling. The self sits at the galactic centre, the one star everything else is arranged around.

Readable for every kind of eye

Colour alone would exclude anyone whose colour vision differs, so the signals are drawn shape-first. Each star wears a thin ring whose small gap carries the meaning; colour merely repeats it. The one star with a closed, gapless ring is you. Even the palette was chosen by measurement: one colour was moved because it was indistinguishable from another for red-green colour-blind readers. Craft, here, is an accessibility decision, not a decoration.

§ 05 / How it stays honest

Deterministic first. Models last. Models may only reword.

Netty's intelligence follows one principle: the app must stay excellent with every AI feature switched off. That is both a resilience property (it is tested that way, with no models present at all) and a privacy property: nothing needs to leave the phone, because nothing heavier than the phone is required.

It thinks when you write, not when you ask

The costly work happens once, quietly, at the moment you save. From then on, asking is instant, free, and offline. Cost scales with how often you capture, not with how often you browse, and the reading path never waits on a model.

A model's only job is to phrase, never to decide

There is exactly one thing a language model is allowed to do in Netty: take facts that ordinary software already retrieved and say them warmly. It runs on the phone, only for rare and explicit actions, and it is fail-closed: every sentence it writes is checked against the real notes behind it, and if it strays even slightly, the plain receipts are shown instead of the prose. A model failure can soften phrasing; it can never bend truth. And everything a model touches is visibly marked, so you always know which words are yours, which are Netty's reading, and which a model phrased.

Confidence you can act on: behaviour, not a percentage

Netty never shows a raw percentage as a truth-claim, and it never posts a limp “AI can make mistakes” disclaimer. The research is blunt that those change nothing. Instead every derived claim behaves differently depending on how sure it is:

• Sure. Stated plainly, one tap to act on.
• Probably. Offered as a suggestion, reviewable before it applies.
• Might be wrong. Hedged in so many words, kept short, and never pre-selected.

Uncertain output gets shorter, not longer, because a confident-sounding explanation inflates trust without adding accuracy. And no level of confidence, not even “sure,” bypasses your approval.

The nightly caretaker

Overnight, with no network, a small caretaker tidies your universe. It is a janitor, not a character. It notices important people drifting cold, pairs of people who keep appearing together but aren't yet connected, an open promise you made and haven't closed. Before anything reaches you, it dedupes its own output, drops anything a fresher note contradicts, and caps the volume hard: the morning inbox is a whisper, not a feed. Every suggestion carries its receipt: the reason it appeared and the notes that ground it, one tap away. And it learns only from your own yes/no, counted on your own device; nothing about you is inferred and shipped anywhere, because there is no anywhere to ship it.

§ 06 / Privacy by architecture

Not a policy that promises. An architecture with nowhere to look.

A privacy policy says “we won't look at your data.” An architecture makes there be no place to look. Netty has no Netty-operated cloud, server, account, analytics, telemetry, or third-party crash reporting — the closest thing to a server, an optional local one on your own Wi-Fi for pairing your iPhone and Mac, never leaves your network and never reaches us. Not restrained, but absent. The strongest privacy promise a design can make is that the sensitive path does not exist.

• Single-user, local-first. The entire vault (people, memories, relationships, images) lives on your device, behind a Face ID / passcode gate.
• No hidden data flows. No scraping, no contact enrichment, no looking up the people you mention. Recall searches only what you saved.
• You own the exit. Export your whole vault as one portable file, re-import it, or delete everything. Each a first-class setting.
• The models are local too. Speech, reading, and any rewording all run on the phone. Airplane mode is a supported way of life, not a degraded state.

Permissions, with honest reasons

Netty asks for each permission at the moment a feature first needs it, never as a wall of dialogs at launch. Each exists for a reason you can check.

The App Store privacy manifest declares exactly what this section does: no tracking, no data collected off the device.

§ 07 / Why it is built this way

Each choice tracks a published result.

The honest parts of Netty's intelligence are not invented. They follow load-bearing findings from peer-reviewed research, which the project keeps carefully separated from philosophy.

• Written principles work as quality control. A short list of written rules, applied through critique and revision, measurably shapes model output, as engineering, not as a truth guarantee. Netty governs every model call this way.
• Self-correction needs an outside signal. Models asked to check themselves with no external evidence get worse, not better, so Netty's checks always test a draft against something outside it: your real notes. And because hallucination cannot be eliminated in general, those checks fail closed.
• Calibration is behaviour, not decoration. Verbalised confidence is systematically overconfident; first-person hedges measurably reduce over-reliance, while blanket disclaimers do nothing. Hence the three behavioural bands, and no disclaimers.
• Monitoring belongs apart from generation. A process that watches, separate from the process that produces, triggered by detected conflict: the shape of the caretaker's review and the ambiguity flags.

Selected references below.

§ 08 / Where it's going

Deepen recall until finding a memory feels like flying to it.

Netty's next chapter is about the feel of remembering, not new surface area:

• Recall as flight. Guided journeys along relationship paths, recent memories nearer and brighter, arrival that you feel.
• Warmer phrasing, identical guarantees. Better on-device wording behind the same fail-closed checks.
• Gentle import. Bringing in what you already have, always with a preview and your approval, never a silent bulk grab.
• An optional, end-to-end-encrypted sync. If it ever ships, it stays optional and never becomes a dependency. Local always remains primary.

Everything on this list has to clear the same bar the rest of the app already meets: nothing saves itself, nothing invents, nothing nags, and the warmth points at your people, never at the software.

References