A Friend — Values
Canonical source-of-truth for A Friend’s value positions. Every FAQ answer, every campaign-page claim, every interview reply anchors here. When a value is restated, this is the file to update — not the answer-doc downstream.
This file is the what we stand for layer beneath the campaign. It is intentionally narrower than a manifesto and broader than a press-release. Each section names a value, what it concretely means, what it explicitly does NOT mean, and where the open questions still live.
V01 — Privacy by default
The claim: Privacy is the foundation A Friend is built on, not a feature toggled on later. The default state of every user is the privacy-safer state.
What this concretely means:
- Memory data is treated as the user’s, not the company’s. Sovereignty over what is remembered, what is shared, what is exported, what is deleted — sits with the user.
- We do not sell user data. We do not use it to train models for third parties.
- The defaults err on the side of less data collection rather than more. Performance-premium features that involve more data routing are opt-in, not opt-out.
What this does NOT mean:
- We are not a local-only device. Memory processing requires server-side coordination. Pretending otherwise would be dishonest.
- We do not promise zero data leaves the device. We promise that what leaves is what the user has consented to, and that it leaves under terms the user can inspect.
Open questions:
- Granular consent UX — how the user opts into each routing decision without UX fatigue. (TBD — product design pass)
- Audit log — does the user get a viewable log of what was sent where, and when? (TBD)
V02 — User data sovereignty
The claim: The user owns their A Friend memory. They can view it, edit it, export it, and delete it — without friction and without conditions.
What this concretely means:
- A user-facing view of “what A Friend remembers about you” — readable, scrollable, searchable.
- Selective deletion — delete a single memory, a topic, a time window, or the entire memory store.
- Full export — download the memory in a portable format (likely structured JSON or markdown).
- Account-deletion is full memory-deletion. No silent retention. No “we keep an anonymized copy” hidden in TOS.
What this does NOT mean:
- This is not the same as local-only storage. The memory lives in cloud infrastructure under our operational control. Sovereignty is about authority over the data, not about its physical location.
- We do not promise that deletion is instantaneous across every cache, backup, and replica. We promise an honest deletion window with a stated SLA. (SLA-number TBD — see Open-Decisions when that doc exists)
Open questions:
- Export format — JSON, markdown, both, something else? (TBD)
- Deletion-window SLA — 24h, 7d, 30d? (TBD)
V03 — Cloud-required, transparently
The claim: A Friend is a cloud-paired experience. We do not claim otherwise. The honesty about this is itself a value.
What this concretely means:
- Conversation, memory, personalization, and continuity require server-side processing.
- The device is the interface and the body of the experience. The intelligence layer is server-coordinated.
- We say this on the campaign page. We say this when asked. We do not bury it in fine print.
What this does NOT mean:
- It does not mean A Friend is useless without internet. See V04.
- It does not mean the user has no leverage over which cloud(s) their data passes through. See V05.
Open questions:
- Long-term operation commitment — how many years of cloud-side service do we guarantee, and what is the deprecation/wind-down policy? (TBD — campaign-page material decision)
V04 — Offline resilience scope
The claim: When the device loses internet, a defined subset of behavior continues to work, and we are explicit about which subset.
What concretely works without internet (current scope, design intent — may shift before ship):
- LED visor expressions — stored locally, can cycle through cached states
- Touch and motion response — capacitive feedback, sleep/wake based on motion
- Audio output for cached recent moments — depends on local storage budget
- Visible “offline mode” indicator so the user knows the device knows
What concretely does NOT work without internet:
- New conversation depth
- Memory updates (writes queued locally if storage permits, synced when back online)
- Personalization changes
- Voice-model upgrades or persona shifts
What we commit to for long-term resilience (services-change scenario):
- Open data-export at any time, including after wind-down notice
- A clearly stated minimum operational period for cloud services (the duration the device is guaranteed to retain full functionality post-ship)
- A documented graceful-degradation path — what the device does if the service is ever sunset
- No remote-bricking. The device hardware remains the user’s; software-side reduction is bounded, not destructive
Open questions:
- Minimum operational period — 2 years? 3? 5? (TBD — campaign-page commitment)
- Local audio cache size — how many minutes of cached output makes sense? (TBD — hardware spec)
- Local-export of memory before sunset — automatic offer or user-initiated? (TBD)
V05 — Model-choice with data-locality awareness
The claim: Where the user’s data is routed depends on which models the user chooses. We do not hide the geography of the routing.
What this concretely means:
- Some models — for example premium voice — are only accessible from US-based providers. The user who enables that model is opting into US data-routing for the data flowing through that model.
- The default model stack is the privacy-safer combination. Premium-performance models are opt-in.
- Per-feature transparency: when the user enables a feature that changes the data-locality, the UX tells them which jurisdiction the data will pass through.
What this does NOT mean:
- We do not claim every model is available in every jurisdiction. Reality says otherwise.
- We do not promise the cheapest privacy-safer model will always match the premium-performance model in quality. The trade-off is real and disclosed.
Open questions:
- The UX shape of the data-locality disclosure — pop-up, settings-page, both? (TBD)
- Whether voice-cloning or personality features require a stricter consent step than ambient conversation. (TBD)
V06 — Hardware longevity
The claim: The device is built to last beyond the cloud-service. The fabric, the visor, the touch surface, the speaker — these are the user’s regardless of whether our servers are still humming.
What this concretely means:
- No remote-bricking under any circumstance.
- Spare-part availability and repair documentation for a stated minimum period post-ship.
- If cloud services wind down, the device retains the offline-scope of V04.
- Hardware design choices that favor reparability and replaceable components where structurally feasible.
Open questions:
- Spare-part guarantee period — (TBD)
- Open repair documentation — public or warranty-only? (TBD)
V07 — Honest scoping
The claim: We say what A Friend does. We say what it does NOT do. We do not claim it does everything.
What this concretely means:
- The campaign page lists the explicit feature set at ship and the explicit feature set 3, 6, 12 months post-ship.
- We do not invent integrations we do not have.
- We do not show mockups as if they were product. UI mockups are labeled “design preview” when they are not yet built.
- When a feature is exploratory, we say “exploratory” rather than “coming soon”.
Open questions:
- The ship-date feature-set commitment — what is locked? (TBD — see Backlog)
- The exploratory-vs-roadmap line — explicit list maintained where? (TBD)
How to extend this file
When a new value position emerges:
- Add a new section
## V0N — <name>. - Follow the four-block shape: claim · concretely means · does NOT mean · open questions.
- Cross-link from any FAQ entry that anchors this value with
[[Strategy/Values#v0n-slug|V0N-<slug>]]. - Update the FAQ entry’s
linked_values: []frontmatter to list the V-IDs it touches.
When an open question resolves:
- Move the resolution into “concretely means” or “does NOT mean”.
- Append to status log if the resolution date is campaign-material relevant.
Do not delete answered open-questions silently — fold them into the body so the resolution is visible.