# Ask Pholu — designing an AI you can check

> Case study: an AI that answers questions about your own memories — retrieval on the device, explicit consent before the model sees anything, and every sentence traceable to a source you can open. Shipped in Pholu.

Source: https://ricardoportfolio.xyz/work/ask-pholu
Language: en

---

Ask Pholu
Case study · AI · Shipped in Pholu
Live
AI product design · Retrieval · Trust
# An AI that asks before it reads your life.
Ask Pholu answers questions about your own memories, in the words you would actually use. The hard part was never the chat box. It was making an answer you can check, out of data the model only sees once you have said yes.
See the product it lives in
![The Ask Pholu screen: suggested questions and a single ask field, with the note that Pholu searches locally first](https://ricardoportfolio.xyz/art/Ask-Pholu%20%E2%80%94%20ask.png)
Ask Pholu · Shipped
Role
Product design · AI UX Front-end
Year
2026
Scope
Four screens, shipped inside Pholu
Stack
React Native · Expo Supabase
01 — The problem
## Human memory is not a database query.
Pholu already held the photos, the videos, the voice notes and the written memories. Finding one again meant remembering the metadata — the date, the album, the place name. That is the one thing nobody remembers.
What the gallery wants
IMG_3847 · 13/10/2026 · Hangzhou
What you actually remember
“That birthday when it rained and we ate cake near the lake.”
So the product question was not “how do we add AI to this”. It was: how do people ask for a memory the way they hold it — and how does an answer come back that they can check, rather than one they have to believe?
02 — Retrieval first
## The model is the last step, not the first.
Search runs on the device before anything is generated. Pholu looks through its own index — captions, people, places and dates — and only then is there anything for a model to work with. The line at the bottom of the screen says so in four words: Pholu searches locally first.
The screen is also deliberately not a chatbot. It opens as search, with four example questions that teach the capability far better than an empty cursor does — you learn what you are allowed to ask by reading one.
- 01Index locally, retrieve locally.Matching happens on the device, against memories the app already holds.
- 02Reason selectively.A model is only involved once there is retrieved context to ground it in.
- 03Look like search, not like a chatbot.Suggested questions set expectations before the first query is typed.
![The Ask Pholu entry screen](https://ricardoportfolio.xyz/art/Ask-Pholu%20%E2%80%94%20ask.png)
Entry · Suggested questions
03 — The decision
## Consent before inference, even though it costs a tap.
Most products send context to a model silently. Ask Pholu stops and shows you what it found: eighteen memories, each one listed, each one you can take out. Only what is still selected is sent, and a line under the button names exactly what leaves the device — your question, plus the context you approved.
This step is the reason the rest of the feature can be trusted. Any memory that matches is eligible to be retrieved, including ones kept only on the device — so the honest design is not to promise the model never sees something, but to show the user precisely what it is about to see, and let them cut it down.
“The user should never have to guess what was sent.”
![Review before AI: eighteen relevant memories listed with checkboxes, and a note that only selected information will be used](https://ricardoportfolio.xyz/art/Ask-Pholu%20%E2%80%94%20review.png)
Review before AI · Shipped
04 — The answer
## The model may interpret your memories. It may not become them.
The answer arrives as a short paragraph, and directly beneath it the memories it was built from: the photographs themselves, then numbered sources you can open. Every factual sentence traces back to something you saved. The model is doing the summarising; your memories remain the record.
That ordering is the whole trust model. An answer on its own asks to be believed; an answer with its sources under it asks to be checked. The follow-up field keeps the thread going without ever hiding the evidence.
![A grounded answer about a trip to Hangzhou, with the supporting photographs and five numbered sources beneath it](https://ricardoportfolio.xyz/art/Ask-Pholu%20%E2%80%94%20answer.png)
Grounded answer · Shipped
High confidence
State it plainly.
You went to Hangzhou on 6 October.
Interpretation
Say that it is one.
It looks like this may have been your first visit.
Ambiguous
Ask, do not guess.
I found two trips that might match.
No evidence
Say so, and offer a way on.
I could not find enough in your memories to answer that.
Four states, one rule: the wording changes with the evidence. A system that sounds equally certain whether it knows or not has taught the user to stop reading carefully.
05 — What it actually does
## Shipped, and the part that is not.
Retrieval today runs over what the memory says about itself. That is enough for most of the questions people actually ask, and it is not the same as understanding the photograph — so here is the line, drawn where it really falls.
Searchable now
- Written memories and captions
- People tagged in a memory
- Places and locations
- Dates, and relative time — “last October”
- Spaces: personal, love, family
Not yet — and what it would take
- Image content: “the photo where we were eating noodles” needs on-device visual embeddings, which is the next real piece of work.
- Audio and video: searching what was said needs transcription, and transcription of private recordings needs its own consent step.
- Text inside images: menus, signs, handwriting — OCR, and the same question about where it runs.
06 — The same engine, unprompted
## Recaps: retrieval you did not have to ask for.
Once retrieval is grounded and consented, it can run on a schedule as well as on a question. Recaps gather a week, a month or a year into something with a shape — August, forty-two memories, five people, three places — and the same rules hold: it is assembled from memories you can open, not written about you.
It is also the part that answers “why would I keep using this”. A search feature waits to be needed; a recap gives the archive a reason to come back.
![Recaps: weekly, monthly and yearly options, with an August recap of forty-two memories across five people and three places](https://ricardoportfolio.xyz/art/Ask-Pholu%20%E2%80%94%20recaps.png)
Recaps · Shipped
07 — Privacy, stated precisely
## What is true is more useful than what sounds safe.
Memories are encrypted before they are stored or transmitted remotely. On your device, decrypted data lives inside Pholu’s private app storage and is protected by the security of your device and operating system. Media is deliberately outside the end-to-end guarantee, and the app says so rather than implying otherwise.
For the AI specifically: retrieval runs locally; what reaches the provider is the question plus the context you approved on the review screen, and nothing else; and you can see that list before it goes. That is a narrower promise than “private AI”, and it is one the product can actually keep.
08 — What I would test next
## Shipped is not the same as proven.
The feature is in beta users’ hands and the feedback so far is that it works. That is encouraging and it is not a finding — nobody has yet been given a task and watched. These are the four questions I would put a study against, in this order.
The questions
- Time to memory: find a specific moment by asking, versus scrolling for it.
- Does anyone read the review screen, or is it a button they learn to hit?
- Is the uncertainty wording believed, or heard as the same confident voice?
- Wrong retrievals: how often, and what does one cost in trust?
What I would change first
- If the review step is skipped without reading, it has become a dialog — it would need to summarise rather than list.
- If sources go unopened, they are decoration, and they should move into the sentence they support.
- If people ask visual questions the system cannot answer, that is the argument for image embeddings, made by users rather than by me.
The product this lives in →
Pholu
Brand, product and front-end for a private memory app for couples and families.
Ricardo Costa
Product · Brand · Visual · Front-end
© 2026 Ricardo Lourenço da Costa
Designed in Figma · Built with React
Leeds, UK