Private AI Memory on Android: What Good Apps Should Do

Memory taxonomy

An assistant should not call every stored byte "memory." Current-turn context exists for one generation. Chat history preserves messages. Explicit facts are deliberately reusable notes. Inferred summaries compress prior conversations and can be wrong. Attachments preserve source files. Embeddings or indexes make content retrievable. Preferences configure behavior. Each category has a different risk and lifecycle.

The interface should name the category and purpose. A single memory switch cannot explain whether disabling it deletes existing notes, stops retrieval, clears chat history, or only prevents new inferred summaries.

Retention matrix

Consent and provenance

Explicit memory should record what was saved, why, when, and from which conversation or user action. Inferred memories should show the proposed wording before becoming durable, especially for health, relationships, beliefs, identity, finances, or work. "User prefers concise responses" is a different category from "User is anxious," and the latter should not be inferred casually from one chat.

Provenance improves correction. If a note came from an old project, the user can decide whether it still applies. If it was generated by the model, the UI can present uncertainty. A memory without source or purpose becomes hard to trust and easy to retain forever.

Retrieval as disclosure

Local storage is not the final boundary. When the app retrieves a note and includes it in a prompt, the active inference route decides where that note travels. A phone model can consume it locally. A personal server receives it over the selected network. A BYOK provider receives it under the user's provider relationship. The app should retrieve the smallest relevant snippet and display route status before sending.

Avoid attaching an entire user profile to every turn. Use project, topic, recency, and explicit scope to narrow candidates. Let users disable memory for one conversation. Never silently inject unrelated private facts because they happen to be semantically similar.

Correction, ageing, and expiry

Memory quality degrades as circumstances change. Add last-confirmed and last-used information. Prompt periodic review for old or sensitive notes. Support expiry for temporary projects and preferences. When two notes conflict, ask the user rather than allowing whichever vector score wins to define identity.

Correction should replace the active fact and remove stale indexes, not append a second contradictory note. If a summary is rejected, record only the rejection state needed to prevent immediate re-suggestion, not a hidden copy of the same sensitive text.

Deletion and derived copies

Deleting a memory should remove its primary record, derived embeddings or indexes, and retrieval eligibility. Deleting a source attachment should trigger deletion of extracted text and vectors linked to it. A complete local reset should cover chats, memory, attachments, model profiles, credentials, and settings according to the confirmation shown.

Explain what remains outside the app: exported files, screenshots, Android or third-party backups, clipboard copies, personal-server logs, and provider requests already made. Honest deletion language describes the app's control surface instead of promising universal erasure.

Export and portability

Export data in a readable, structured format with categories, timestamps, and provenance. Let the user select projects or categories rather than forcing an all-or-nothing dump. Warn that the export is now a sensitive file outside app protection. Do not include provider API keys or authentication tokens.

Portability supports local-first trust because users are not trapped by a cloud account. It also lets people inspect what the system accumulated. The ability to leave is part of memory ownership.

Device and backup protection

Use app-private storage and Keystore-backed cryptographic protection where appropriate. Lock access behind the device or app security setting. Limit notification previews and accidental screenshots for sensitive screens where the product design justifies it. Review Android backup inclusion carefully and document whether local data moves through any backup service.

Security controls should not make deletion impossible or create false certainty. Keystore reduces key-extraction risk; it does not protect plaintext while an unlocked compromised app uses it. Keep the stored data minimal enough that a future vulnerability has less to expose.

A review checklist for users

Create one test memory, inspect its exact wording, edit it, use it in local mode, switch to an online route and observe the warning, then delete it and confirm it no longer affects answers. Export a small sample and inspect the file. Reset a test profile. Repeat after major updates.

Phos's memory design is intended to make those actions normal rather than hiding personalization behind an account. Useful memory should feel like notes the user owns, not a dossier the assistant owns about the user.