Status · last reviewed 26 September 2026
Where things actually stand.
Most pre-launch sites describe the finished thing in the present tense. Here is the real state instead, because a company arguing for data honesty should start with its own.
- Stage
- Private development; deployed app synthetic-only
- Users
- None — real-data admission remains behind domain-general gates and each domain's own review. CAP-24's Open external human review applies specifically to training/sleep guidance.
- Revenue
- None — pre-revenue by design; monetization sequencing is an Open product decision
- Certifications
- None earned. No SOC 2, ISO 27001, HIPAA, FIPS, or other audit claim.
- Development app
- Hosted separately from this site; synthetic data only; not a public product
Six words, used precisely.
Built · synthetic
Working code, present in the development application or built locally, tested only with synthetic or non-sensitive data. Never customer or production proof.
Partially built
An important slice exists, but the described customer capability is incomplete.
Being validated
Built, and now being tested for usefulness or acceptance. One passing scenario is evidence for that scenario only.
Designed
Recorded in a reviewed specification or architecture decision, not implemented.
Later
Directional design for a future layer. Not started, not promised for a date.
Open
A material product, legal, technical, or commercial decision that has not been made. We do not invent an answer to make a page read better.
Twenty-six capabilities, one honest label each.
Sourced from the product's capability map. “Must” means required for the invited alpha; “Later” belongs to a future layer.
| ID | Customer capability | Status | Alpha position | Next proof required |
|---|---|---|---|---|
| CAP-01 | Register, sign in, and receive an identity-derived private namespace | Built and deployed synthetically | Must | Production account lifecycle and mobile evidence |
| CAP-02 | Store customer-key-encrypted private records in a managed vault | Built and deployed synthetically | Must | Independent acceptance of the exact zero-knowledge protocol and hosted release channel plus the applicable operational-security baseline; CMVP only if an ADR-0015 trigger occurs |
| CAP-03 | Recover a vault without a Tech City recovery key | Built locally and browser-validated synthetically | Must | Supported-device recovery and ceremony evidence, hostile tests, independent production review, and the applicable operational-security baseline; CMVP only if an ADR-0015 trigger occurs |
| CAP-04 | Import user-selected data through reviewed source adapters | Partially built | Must | Real document parser/security boundary, real calendar provider semantics, alpha adapters, consent UX, provenance, deployed proof, and full mobile import proof |
| CAP-05 | Create a visual Vision Board for outcomes, motivations, time horizons, and life areas | Built locally with encrypted browser save/restore; production persistence remains gated | Must | Accepted zero-knowledge/release and operational-security boundary, hosted exact-object lifecycle, mobile devices, and invited-user evidence |
| CAP-06 | View cross-domain evidence on one understandable timeline | Partially built locally | Must | Real adapter integration, provenance UI, missing-data treatment, and user comprehension evidence |
| CAP-07 | Add, correct, date, remove, and control personal context | Built locally for Goal Studio | Must | Hosted encrypted persistence and mobile evidence |
| CAP-08 | Preview exactly what an AI analysis will receive | Built locally; synthetic hosted path exists | Must | Prove understandable private consent and hosted device flow |
| CAP-09 | Receive evidence-linked cross-domain observations | Fixed synthetic benchmark and weekly private bridge exist; no-calendar day preview is local-only | Must | Resolve provider date semantics and day-level inference before any day packet can enter the governed model path |
| CAP-10 | Convert an observation into a bounded experiment while respecting human authority | Partially built locally | Must | Complete experiment lifecycle and comprehension testing |
| CAP-11 | Use Goal Momentum for voluntary progress, milestones, reflection, correction, and celebration | Built locally with synthetic tests | Must | Hosted lifecycle validation and invited-alpha evidence |
| CAP-12 | Avoid manipulative engagement mechanics | Designed and tested in current Goal Momentum scope | Must | Ongoing product and telemetry review |
| CAP-13 | Share an immutable encrypted snapshot with a verified recipient | Built and deployed synthetically | Should | Production crypto, privacy, accessibility, retention, and recipient UX review |
| CAP-14 | Revoke future access and remove all hosted ciphertext versions | Built and deployed synthetically | Must for sharing | Production monitoring, retention decision, and external acceptance |
| CAP-15 | Export usable customer records and product history | Partially built | Must | Whole-account portable export contract and restore/interoperability proof |
| CAP-16 | Understand storage, AI, and service costs before being charged | Cost model built; billing not built | Must | Pricing model, usage UX, subscription provider, limits, refunds, and notices |
| CAP-17 | Use the funding demonstration comfortably on a phone | Responsive PWA partially validated | Must | Current iOS Safari and Android Chrome device evidence |
| CAP-18 | Present education, certification, achievement, and expertise selectively | Designed | Active build / M5 | Credential standards, issuer verification, live persistence, selective-presentation UI, and fraud review |
| CAP-19 | Operate an expertise storefront and receive compensation | Designed | Active build / M5 | Working hosted UI lifecycle, then payment, tax, disputes, privacy, retention, and accessibility |
| CAP-20 | License selected data to a verified research organization for compensation | Designed | Later / M6 | Counsel, research/ethics controls, buyer verification, withdrawal, payment, and pilot |
| CAP-21 | Publish content and participate in a portable user-controlled social/creator economy | Directional design | Later / M7 | Narrow launch wedge, protocol decision, deliberate inspectable-state transition, known-CSAM hash gate, specialist legal acceptance, moderation/reporting, age assurance, settlement, and portability |
| CAP-22 | Keep private, shared, licensed, limited-audience, and public data states distinct | Designed | Must before M5–M7 | Canonical state model, UI language, policy enforcement, inspectable CAP-21 transition, and hostile tests |
| CAP-23 | Connect independently built applications through customer-controlled developer interfaces | Directional design | Later / M7 | Versioned scopes, consent, revocation, partner verification, rate limits and hostile-client proof |
| CAP-24 | Discuss a selected goal through a governed typed or optional voice conversation | Hosted typed path passes current H17 suite and fixed 3/3 synthetic benchmark; human-review package is ready | Should / phased | Engage qualified external human reviewer before invited alpha; then decide typed-alpha placement and consider voice adapters |
| CAP-25 | Invoke a time-bounded camera observation and confirm or reject its meaning | Directional design | Later / post-alpha | Legal/safety review, on-device feasibility, bias evaluation and explicit permission architecture |
| CAP-26 | Publish exact user-authored terms with dated, hashed, tamper-evident integrity evidence | Directional design | Later / independent | Select attestation strength, canonicalization, immutable versioning, neutral registry seam, and legal acceptance |
Authenticated ownership
Protected requests, accepted saved results, and recovery now revalidate one authenticated subject around each sensitive operation and fail closed on sign-out or account change.
Deletion boundary
The synthetic hosted path derives ownership from the verified subject, returns a complete managed-object inventory, deletes exact versions, and monitors for ciphertext without an authoritative control record.
Evidence boundary
This is bounded local and deployed synthetic engineering evidence—not production acceptance, private-data authorization, invited-user proof, or a complete whole-account deletion claim.
Before any private data or invited alpha.
- Exact pilot scope, private-data authorization, participant eligibility, informed consent, withdrawal, and stop conditions
- Independent review of the exact vault, recovery, and hosted release implementation
- Applicable U.S. privacy review, with focused health-data legal review for health paths, including final retention periods
- Production identity, isolation, recovery, deletion, and monitoring acceptance on the exact release
- Supported provider date semantics and day-level inference rules; unsupported semantics remain blocked
- One separately authorized, no-retry private CAP-09 request after every upstream private-data gate passes
- Qualified external human review of the exact typed training-and-sleep CAP-24 release
- Exact-build accessibility evidence plus physical iOS Safari and Android Chrome device evidence
- The applicable operational-security baseline: least privilege, content-free monitoring, incident response, release and dependency integrity, and tested rollback
- Pricing, billing, support procedures, and portable whole-account export
- A reviewed, atomic release and rollback process
- A written Endorphin pilot agreement preserving participant, coach, clinician, support, confidentiality, and exit boundaries
Not decided, and not guessed.
- The exact visual interaction model for the Vision Board.
- The minimum source-adapter set for the invited alpha.
- The accepted customer-controlled encryption client and release implementation and supported device and platform matrix; a validated-module path reopens only if an ADR-0015 trigger makes it material.
- Final retention periods for ciphertext, control records, operational metadata, and AI usage.
- Alpha pricing, included storage, included analysis, overage behavior, and hardship controls.
- The threshold and evaluation method for a useful cross-domain observation.
- The complete portable account-export format.
- The exact accepted credential and issuer standard and manual compensation evidence for the selected Tier 1 individual-buyer wedge; research licensing and later social use remain separate decisions.
- Whether time-bounded camera observation can provide enough reliable benefit to justify its privacy, affect-inference, and compliance risks.
One fictional scenario, six criteria, one pass.
On 4 September 2026, one bounded fictional four-week training-and-sleep scenario produced an accepted result: software computed the comparison (training stress 450 to 200, sleep unchanged at 6 hours) with four citations and checked claims; the model supplied uncertainty, four limitations, a coach-discussion question, and the authority boundary. Manual review passed all six usefulness criteria. That is evidence for that scenario. It is not proof for private records, clinical validity, source truth, every model response, or other goal families—and the site will not describe it as any of those.
Synthetic development evidence · one request, no retry · no private data