The people in your life are the most sensitive thing an AI memory can hold. Lethe’s rule, from the first privacy design onward: names become numbers before anything is stored.Your device keeps the map — “Person 2 is Priya” — and the cloud only ever learns that Person 2 moved a deadline. On your own screen, names rehydrate locally at display time, so you see Priya and storage never does.
Then we broke it
In August we found a numbering bug that had been quietly assigning distinct people to the same record. Not two or three: 418 real humans filed under one “Person 1.” A pseudonym system that merges people is failing twice at once — the facts are wrong (merged people means merged lives), and the privacy promise is hollow (a label shared by 418 people protects nobody in particular and misleads everyone).
The fix, and the rule behind it
The cause was that several code paths each invented person numbers on their own. The fix is structural: every path that stores a person now commits through one stable ledger — one door, one numbering, covered by tests. And we disclosed it, in public, on this site, because the pseudonym system is a trust product: it deserves belief exactly in proportion to how it behaves when it fails. A privacy feature whose failures are secret is a privacy claim.
What stands today: pseudonymisation before storage, real names only on your device, one ledger on every write path — and a public record of the day that wasn’t true.