Not a feature.
The shape
of the thing.
Most products bolt privacy on: a setting, a policy, a promise. Memu is built the other way round — the privacy is the architecture, and the architecture is what makes the product good.
Architecture, not promise.
The AI never knows who you are.
Before anything reaches an external model, a layer called the Digital Twin replaces every identifying detail — names, family members, places, specifics — with stable anonymous labels. Not encrypted-so-we-could-decrypt-it. Anonymised, so there's nothing to decrypt.
Your worlds can't be correlated — even by us.
Each world has its own separate identity map. The same real person is a different anonymous label in your household and your work. There is no master key. We couldn't build the complete picture if we wanted to — and not wanting to isn't good enough, so we made it impossible.
You hold the only lens that sees across.
You can look across your own worlds, because you own them. Nothing else can — not another user, not an external AI, not Memu itself acting on its own. The whole-life view exists for exactly one person: you.
You can verify all of it.
The Ledger shows you what was sent and what was done, every time. This isn't a trust exercise. It's an audit you can run yourself.
What we won’t pretend.
Anonymisation protects identity, not omniscience: an external model still sees the shape of a question, and in rare, highly specific cases shape alone can narrow who’s asking. The Ledger exists so you can judge that for yourself, exchange by exchange. If even that is too much, the answer isn’t a promise — it’s the box in your house.
Children
Children’s spaces are designed to the ICO Children’s Code: high-privacy defaults, visibility that is disclosed to the child, and data that never feeds anything beyond their own world.
Leaving
And when you leave, you leave with everything — your understanding is yours to take.