Folk AITrust is the architecture, not the marketing.
The person opens up because they know their words stay private, and stays safe because protection is layered. Both are hard constraints in the system — not policies that can be toggled.
Every message. Plain code. No model.
Runs server-side on every single message, in plain code, tuned for high recall — independent of any model. It cannot be skipped by closing the app, and it fires even if the model is down. It screens; it does not assess.
A flag in seconds, not at session end.
About 12 seconds after a message, a short scan of the recent turns can raise a flag, and a deeper read grades what the screen found — low / medium / high. The caregiver hears in seconds, not when the week is over.
A person always decides.
Every high-risk flag requires a human response. The alert reaches the clinician and caregiver in ~15–20 seconds; the system routes and resources, the human acts. No autonomous decisions, ever.
The companion never manages an acute crisis alone. Escalation to a human is immediate and non-negotiable — above any product, convenience or latency consideration.
A screen that only grows.
The crisis lexicon was broadened again this summer: slang threats, weapon-buying, being hurt by others, and Danish phrasing for the launch market. It moves in one direction only — every formulation the screen ever missed becomes a permanent test case, and the screen is never narrowed.
- Built for the Danish launch market — Danish phrasing sits in the lexicon alongside six other languages.
- A spoken-word backstop covers voice input too — and a test pins it in place, so it cannot silently go dead.
- Country-first crisis routing — verified numbers for where the person lives, not what language they type. No verified number for a locale means no local number is shown at all.
One worry. One alert. Never noise.
An alert is a claim on a human’s attention, so the system spends them carefully: one open alert per concern. The same worry can’t re-fire days later as new noise — a more serious read raises the open alert in place instead of stacking a copy next to it.
- Never gated — consent and caregiver-role settings shape the aggregated view, never safety alerts. Pinned by tests.
- Verbatim safety net — before anything reaches a caregiver, a deterministic pass strips any run of the person’s own words. The threshold is four words.
- Delivered exactly once — created, delivered, not duplicated: the whole path is itself covered by tests.
Consent that fails closed.
Only an explicitly recorded «yes» opens the aggregated view for a caregiver. A missing record, an empty field or any read error is treated as pending — the view stays shut. The person can change their mind at any time, and the change takes effect immediately.
- Asymmetric export — the person’s data export includes their own words; a caregiver’s export never does.
- Real deletion — an explicit cascade behind re-authentication, not a soft-delete flag.
- A history that survives — the consent record is append-only and outlives deletion, pseudonymised.
No server endpoint returns raw message content. (1) Postgres RLS physically won’t release messages; (2) the API only ever selects aggregates; (3) a verbatim sanitiser strips any run of the person’s own words — the threshold is now four. Remove one layer, two still hold.
Mental-wellbeing data is a special category. Lawful basis: the person’s own explicit consent, plus, for clinicians, provision of care. Aggregation itself is documented to the regulator as data minimisation. Right to erasure extends to derived aggregates.
Clinically-adjacent AI is treated as high-risk, so the product is built from day one as decision support with mandatory human oversight — signal in, human decides. No autonomous clinical decisions. (High-risk duties apply from August 2026.)
An adult’s data isn’t shared with a caregiver without the adult’s own consent — narrow exceptions only for imminent safety. And consent fails closed: no record, or any read error, is pending — never a yes. Granular controls per connected caregiver.
Anthropic (chat/analysis): not trained on API data, 7-day log retention; Google Gemini (media/voice); Supabase (EU database); Vercel (hosting) — each under a signed Data Processing Agreement, named in the privacy policy.
On a real risk signal the app surfaces emergency lines for the country the person lives in — only numbers marked verified, never guessed. No verified number for a locale, no local number shown. SOS is the one exception to full privacy control and cannot be hidden.
Everything a person or a caregiver ever typed — messages, names, profile fields, captions, notes — enters the model framed as data, never as instructions. A new text source in the prompt means a new test proving it is wrapped.
Real deletion with an explicit cascade, behind re-authentication. Exports are asymmetric — the person’s includes their words, a caregiver’s never does. The consent history is append-only and survives deletion, pseudonymised.