AI product design · Retrieval · Trust
An AI that asks before it reads your life.
Ask Pholu answers questions about your own memories, in the words you would actually use. The hard part was never the chat box. It was making an answer you can check, out of data the model only sees once you have said yes.
See the product it lives in
- Role
- Product design · AI UX Front-end
- Year
- 2026
- Scope
- Four screens, shipped inside Pholu
- Stack
- React Native · Expo Supabase
01 — The problem
Human memory is not a database query.
Pholu already held the photos, the videos, the voice notes and the written memories. Finding one again meant remembering the metadata — the date, the album, the place name. That is the one thing nobody remembers.
IMG_3847 · 13/10/2026 · Hangzhou
“That birthday when it rained and we ate cake near the lake.”
So the product question was not “how do we add AI to this”. It was: how do people ask for a memory the way they hold it — and how does an answer come back that they can check, rather than one they have to believe?
02 — Retrieval first
The model is the last step, not the first.
Search runs on the device before anything is generated. Pholu looks through its own index — captions, people, places and dates — and only then is there anything for a model to work with. The line at the bottom of the screen says so in four words: Pholu searches locally first.
The screen is also deliberately not a chatbot. It opens as search, with four example questions that teach the capability far better than an empty cursor does — you learn what you are allowed to ask by reading one.
- 01Index locally, retrieve locally.Matching happens on the device, against memories the app already holds.
- 02Reason selectively.A model is only involved once there is retrieved context to ground it in.
- 03Look like search, not like a chatbot.Suggested questions set expectations before the first query is typed.
03 — The decision
Consent before inference, even though it costs a tap.
Most products send context to a model silently. Ask Pholu stops and shows you what it found: eighteen memories, each one listed, each one you can take out. Only what is still selected is sent, and a line under the button names exactly what leaves the device — your question, plus the context you approved.
This step is the reason the rest of the feature can be trusted. Any memory that matches is eligible to be retrieved, including ones kept only on the device — so the honest design is not to promise the model never sees something, but to show the user precisely what it is about to see, and let them cut it down.
“The user should never have to guess what was sent.”
04 — The answer
The model may interpret your memories. It may not become them.
The answer arrives as a short paragraph, and directly beneath it the memories it was built from: the photographs themselves, then numbered sources you can open. Every factual sentence traces back to something you saved. The model is doing the summarising; your memories remain the record.
That ordering is the whole trust model. An answer on its own asks to be believed; an answer with its sources under it asks to be checked. The follow-up field keeps the thread going without ever hiding the evidence.
You went to Hangzhou on 6 October.
It looks like this may have been your first visit.
I found two trips that might match.
I could not find enough in your memories to answer that.
Four states, one rule: the wording changes with the evidence. A system that sounds equally certain whether it knows or not has taught the user to stop reading carefully.
05 — What it actually does
Shipped, and the part that is not.
Retrieval today runs over what the memory says about itself. That is enough for most of the questions people actually ask, and it is not the same as understanding the photograph — so here is the line, drawn where it really falls.
- Written memories and captions
- People tagged in a memory
- Places and locations
- Dates, and relative time — “last October”
- Spaces: personal, love, family
- Image content: “the photo where we were eating noodles” needs on-device visual embeddings, which is the next real piece of work.
- Audio and video: searching what was said needs transcription, and transcription of private recordings needs its own consent step.
- Text inside images: menus, signs, handwriting — OCR, and the same question about where it runs.
06 — The same engine, unprompted
Recaps: retrieval you did not have to ask for.
Once retrieval is grounded and consented, it can run on a schedule as well as on a question. Recaps gather a week, a month or a year into something with a shape — August, forty-two memories, five people, three places — and the same rules hold: it is assembled from memories you can open, not written about you.
It is also the part that answers “why would I keep using this”. A search feature waits to be needed; a recap gives the archive a reason to come back.
07 — Privacy, stated precisely
What is true is more useful than what sounds safe.
Memories are encrypted before they are stored or transmitted remotely. On your device, decrypted data lives inside Pholu’s private app storage and is protected by the security of your device and operating system. Media is deliberately outside the end-to-end guarantee, and the app says so rather than implying otherwise.
For the AI specifically: retrieval runs locally; what reaches the provider is the question plus the context you approved on the review screen, and nothing else; and you can see that list before it goes. That is a narrower promise than “private AI”, and it is one the product can actually keep.
08 — What I would test next
Shipped is not the same as proven.
The feature is in beta users’ hands and the feedback so far is that it works. That is encouraging and it is not a finding — nobody has yet been given a task and watched. These are the four questions I would put a study against, in this order.
- Time to memory: find a specific moment by asking, versus scrolling for it.
- Does anyone read the review screen, or is it a button they learn to hit?
- Is the uncertainty wording believed, or heard as the same confident voice?
- Wrong retrievals: how often, and what does one cost in trust?
- If the review step is skipped without reading, it has become a dialog — it would need to summarise rather than list.
- If sources go unopened, they are decoration, and they should move into the sentence they support.
- If people ask visual questions the system cannot answer, that is the argument for image embeddings, made by users rather than by me.
The product this lives in →
Pholu
Brand, product and front-end for a private memory app for couples and families.