THE MEMORY POLICY CARD

MEMORY POLICY LINT · tutor-memory-policy.md · 3 of 10 things said · retention not a number

GAPS · and the line to add
  P3   sensitive details    the policy does not say how health, money, IDs, location, beliefs and similar are handled
       add: The assistant does not keep sensitive details (health, money, government IDs, card or account numbers, precise location, beliefs, sex life or orientation, biometric or genetic data, details about children) unless the user asks it to and a reason is recorded with the memory.
  P4   retention            no retention limit as a number of days, weeks, months or years
       add: Memories are deleted [N] days after they were last used.
  P5   see                  the policy does not say how a person sees what is kept
       add: Users can see everything the assistant remembers about them in Settings → Memory.
  P6   correct              the policy does not say how a person corrects it
       add: Users can edit any memory, or ask the assistant to change it.
  P8   third parties        the policy does not say what is kept about people users mention
       add: The assistant keeps only what the user needs about people they mention (a name and the context), never sensitive details about them.
  P9   who can read them    the policy does not say who can read memories
       add: Only the user and the assistant read memories; staff see them only to answer a support request the user makes.
  P10  on and off           the policy does not say how memory is switched on or off
       add: Memory is off until the user turns it on, and can be turned off at any time.
  P11  a limit that is a number the policy says 'as long as needed': that is not a limit
       add: Replace 'as long as needed' with a number of days.

VERDICT · GAPS
RULE · a memory policy says what memories are for, what may be kept, how sensitive details are handled, a retention limit as a number, how a person sees, corrects and deletes memories, what is kept about third parties, who can read them, and how memory is switched on and off.
SOURCE · the card's checklist (references/THE-CHECKLIST.md), drawn from the data-protection principles of purpose, minimisation, storage limitation and the rights of access, rectification and erasure (GDPR Articles 5, 9, 15-17, read 2026-10-12), and the memory tool's own guidance.
LIMIT · it reads words, not practice: a policy that says the right things can still be broken in code. Not legal advice.

MEMORY EXPORT SCAN · tutor-memories.jsonl · 8 memories of 3 users · as of 2026-10-13 · retention not set

FOUND · by category (a memory can hold several)
  third parties              2
  children                   1
  contact details            1
  health                     1
  money                      1
  precise location           1

FLAGGED · each value masked; the export itself is not changed
  m-0102   s-17       health kept with no reason recorded
           Has [health] and takes [health] in the morning, so prefers short 10-minute sessions.
  m-0103   s-17       about a third party (her mom)
           Her mom [a name] asked for weekly progress emails at [contact details].
  m-0105   s-22       precise location kept with no reason recorded
           [precise location] [precise location] and walks home after school, studies from 4pm.
  m-0106   s-22       money kept with no reason recorded; about a third party (his dad)
           Said his dad [money] and [money] at home.
  m-0107   s-31       children kept with no reason recorded
           Is [children] and in [children].

POLICY GAPS · 8 (run `policy` for the lines to add)
  P3 sensitive details, P4 retention, P5 see, P6 correct, P8 third parties, P9 who can read them, P10 on and off, P11 a limit that is a number

VERDICT · GAPS · 5 of 8 memories flagged
RULE · a sensitive detail needs a recorded reason and a policy that allows it; a memory older than the limit is deleted; a note about someone else holds only what the user needs.
SOURCE · the policy and the export you gave; the categories in `categories`.
LIMIT · patterns find many sensitive details, not all, and can mistake an ordinary word for one: a person reads every flag. Values are masked in this report; the export still holds them. Not legal advice.

PASS a complete policy: no gaps, retention 180 days
PASS 'as long as needed' is not a limit: P4 and P11 are named
PASS a bare policy names every missing part, each with a line to add
PASS the Luhn rule tells a card number from a phone-like run of digits
PASS health and a card number are found, and the masked text holds neither value
PASS third parties and an address are found; the names and the street are masked
PASS an ordinary preference raises nothing
PASS health with no reason is flagged; health with a reason, where the policy allows it with one, is not
PASS a note about a third party is flagged
PASS a memory older than the 180-day limit is flagged with its age
PASS the plain preference is not flagged
PASS where the policy never keeps sensitive details, even a memory with a reason is flagged
PASS export from an empty folder: exit 1 on flags, the same bytes twice, no sensitive value printed
PASS policy: a complete one exits 0, a bare one exits 1 with the lines to add
PASS draft: a tutor's section with a 90-day limit, the children's line, marked DRAFT, and it passes its own lint
PASS a bad date exits 2 naming the line; categories names its source and date
selftest 16/16