Digital immortality is not a metaphor and not a promise of an afterlife. It is an engineering problem with testable requirements: storage that does not depend on whether anyone paid the invoice this month, encryption whose key never leaves the person, and retrieval that still finds the right conversation twenty years later, when nobody remembers what the file was called or which spring it happened in.
Six properties, each one testable rather than taken on trust. If a single one of them fails, the word permanent is just decoration.
An archive has to be opened: recall the folder, guess the year, scroll past forty files. Memory answers on its own. Ask why you walked away from that supplier and you get the reason, not a list of documents containing the word supplier.
Data is encrypted with a symmetric key (AES-256-GCM) before it ever reaches permanent storage. What leaves your machine is ciphertext — bytes from which no sentence can be recovered without the key. Deleting here means destroying the key, after which we cannot read the record either.
The permanent layer lives in Arweave: a network where storage is paid for upfront and spread across thousands of independent nodes in different jurisdictions. No server, no company and no government can unilaterally switch off what has already been written.
There is no save button, because one day a person will not press it. A copy of the conversation goes to a personal folder once an hour, and immediately if the dialogue file passes 90 KB. You cannot forget to back up something nobody asks you to back up.
What is kept is not only what was said but how: the turns of phrase, the shape of an argument, what a person treated as decisive and what they let pass. That is what later answers a question nobody thought to ask while they could — instead of quoting an old email.
The format of the permanent layer is open, the transaction sits in a public network, and the record identifier belongs to the owner. If CODE the company ceases to exist, the data stays readable through any Arweave client. That is a property of the network you can verify, not a promise you have to believe.
PADAM stands for Philosophical Activation of Distributed AI Memory. The layers differ not by how important the data is, but by physics: each has its own latency, its own cost and its own lifespan. Collapse them into one and you get storage that does all three jobs badly.
The top layer holds the context of the conversation happening right now: the last few turns, the correction you made a minute ago, the names and figures needed this second. Technically it is a key-value store living in RAM — Redis or Vercel KV — and it answers in single-digit milliseconds, which is the only reason a dialogue does not stumble on every sentence.
This layer is deliberately short-lived. It lasts minutes and hours and claims nothing more. Trying to keep everything here turns a conversation into mush, where yesterday's typo weighs the same as a decision taken a year ago: the model sees both equally and takes both equally seriously.
Its useful property is that it decides nothing about your fate. Lose the whole layer and the single consequence is that the assistant asks once who you meant. Anything more expensive than one repeated question does not belong here.
Its short life is exactly what makes this the only place where text sits in plaintext. A few minutes later it is evicted: nothing is written to disk, no copies remain, nothing moves into long-term storage. Retention and security regime are two sides of one thing here.
A word on why this layer is a key-value store rather than a database: a live conversation needs fast retrieval, not clever querying. Complex questions are left to the next layer, which has time for them.
One more thing: this layer makes no long-term judgements, so it does not need to understand you. Understanding happens on the second layer, where there is enough context to compare things against.
The second layer stores experience as vectors: numeric fingerprints of meaning. Every fragment of a conversation becomes a point in a high-dimensional space, and fragments that are close in meaning end up close together even when they share no words at all.
The difference from keyword search shows up on the very first query. Ask why you dropped that contractor and the system surfaces a conversation containing neither the word dropped nor the word contractor — what it actually said was let's not get involved with them again, remember how March ended. Keyword search never finds that, and the person concludes the conversation is lost.
The layer runs on PostgreSQL with the pgvector extension, hosted on Neon. A plain relational database was chosen over a dedicated vector service for a boring reason: ordinary columns sit next to the embeddings — date, participants, access rights, which project it belongs to — and one query answers questions about all of them, with no stitching together of two stores in application code.
This is the workhorse. The assistant reaches for it whenever you ask about something that did not happen today. It is also what keeps old material from surfacing without cause: semantic distance is a number, so weak matches are cut off by a threshold rather than by taste.
Data here is encrypted at rest and access is scoped to the account. This layer lives far longer than the first and is therefore held to stricter rules — but it is still a layer that can be deleted wholesale: only the third one is truly irreversible.
There is a less obvious benefit too: vector search makes memory cross-lingual. A conversation started in Spanish is found by a question asked in English, because what gets encoded is meaning rather than spelling. For anyone working across two languages that matters more than retrieval speed.
The bottom layer is the reason the rest exists. An encrypted snapshot of memory goes into Arweave: a network where you pay once, after which storage is funded by the yield of an endowment modelled over centuries. That is a fundamentally different economy from a monthly cloud bill, where storage stops the exact moment the payment stops.
A pointer to the record is anchored in Solana as a cNFT, a compressed non-fungible token. It is cheap enough that thousands of records cost pocket change, it belongs to the owner of the memory, and it serves as proof: this record existed on this date and has not changed since.
Nothing written can be edited after the fact — only appended to. That is inconvenient every single time you would like to tidy up the past, and it is the one thing that turns an archive into testimony. Memory that can be quietly revised proves nothing, neither to others nor to you twenty years from now.
The permanent layer is slow: a write takes minutes, not milliseconds. So it never participates in live conversation. It is not there for when you ask — it is there for when there is no longer anyone to ask.
Precisely because it cannot be undone, someone has to decide what goes in, and that someone is you. The system does not pour everything into eternity on your behalf: what belongs there is what has to outlive companies and devices.
The write rhythm here is nothing like layer one: it is measured in hours. A copy lands at once in the personal folder on the server and on chain, rather than shifting with every sentence; and if the dialogue file passes 90 KB, there is no waiting for the next hour.
No single layer can be fast, semantic and permanent at the same time; those are mutually exclusive trade-offs. Working memory is fast because it never leaves RAM, and for the same reason it does not survive a restart. Permanent storage is immutable because it is spread across thousands of nodes, and for the same reason it will never answer in fifteen milliseconds.
Separation buys a second thing: different privacy regimes. Layer one holds plaintext of the current sentence and lives for minutes. Layer three receives ciphertext only. Between them sits a database encrypted at rest with access scoped to your account. The longer the retention, the stricter the regime.
And a third: graceful degradation instead of a cliff. Redis goes down and you lose the thread of a sentence — the assistant asks again. The database is unreachable and the answer arrives without depth, but it arrives. We disappear and Arweave plus your key remain. Every failure is partial. Systems built on a single store fail differently: all at once.
Put those three arguments side by side and it is clear why the layers do not collapse into one. What can be simplified is the interface, not the physics.
People ask whether the first and third layers alone would do. They would — except that every act of recall would mean decrypting an entire life. The second layer exists so that remembering stays affordable on an ordinary day, in compute and in time alike.
A cloud drive is an excellent tool for as long as the contract holds. Below are the questions on which the contract runs out.
| Question | Ordinary cloud drive | CODE permanent memory |
|---|---|---|
| Who pays for storage | You do, every month, indefinitely | One payment upfront, then the network endowment |
| What happens if payments stop | Data is deleted 30–90 days after notice | Nothing: this record's storage is already paid for |
| What happens if the company folds | Service is switched off; export if you were quick | Records stay in a public network, the key stays with you |
| Who can delete a record | The operator, by its own rules or on official request | Nobody; only the decryption key can be revoked |
| How old material is found | By filename, folder and date | By the meaning of the question, via vector search |
| Who can technically read it | The storage operator | Nobody: only ciphertext leaves your machine |
| Proof the record was not altered | None beyond trusting the operator | A Solana transaction with a date and a hash |
| What happens when you change devices | Sync, if it is enabled and working | Nothing: memory is not tied to hardware |
| What a backup looks like | Manual, or a schedule you have to configure | Hourly or instantly at 90 KB, with no human involved |
| What happens when the AI model changes | Not the drive's business, but you re-explain the context | Memory lives outside the model; nothing to re-explain |
| Can it be found across languages | No: literal matching, each language searched separately | Yes: vectors encode meaning, not spelling |
| What heirs actually receive | A login and password, if anyone wrote them down | A key and a record address, transferable like any key |
| What decides the data's fate in fifty years | Whether the company still exists | Whether the Arweave network still exists |
People with something to lose who worked that out before the loss, not after it.
Years of decisions, mistakes and conclusions should not walk out of the door with a change of tool. The value is not in the final document but in the chain of why we chose this and not that — and that chain is usually the first thing to go.
A voice, a set of habits, the way someone argued and the way they joked: exactly what children will want to ask about once there is nobody left to ask. Family access lets several people keep one shared memory and hand it on.
Someone who remembers you whole, does not ask the same question a third time, and does not tire of listening at three in the morning. This is not a substitute for people and not treatment. It is simply something that remembers.
The model updates, the context window runs out, the chat closes — and everything you spent three months explaining has to be explained again. Memory lives outside the model, so swapping models does not erase it.
Research, a dissertation, a building, a lawsuit: work measured in years where the outcome matters less than the version history — what was tried, what failed, and precisely why. Three years on, nobody remembers the why.
One hundred and forty-eight songs in this ecosystem were written by a human and an AI together, and the drafts behind them were kept. Co-authorship is demonstrable when the process survives, not only the finished track.
On the internet, forever usually means for as long as the card keeps working. Here it means something else, and numbers explain that more honestly than adjectives.
A subscription is a promise made by a company. Companies live, on average, shorter lives than people: services get shut down, acquired, repositioned, and the data is handed back at best as an export nobody ever opens again. A promise to keep someone's memories forever is worth exactly as much as the legal entity that made it.
Arweave is built the other way round. The fee is paid once and enters an endowment whose yield funds the storage. The network's model is deliberately conservative: it assumes the cost of storing a gigabyte keeps falling roughly as it has for the past forty years. That is an engineering assumption rather than a guarantee — but a checkable one, because both the model and the state of the pool are public.
The difference in the nature of the promise matters more than the difference in price. In one case you are trusting a company. In the other, a network with no owner who can change their mind.
There is a further difference that usually goes unnoticed: with a subscription you pay every month for storage to continue; with an upfront payment you pay for what is already stored. The first asks you to make the decision again every month, and in any life there are months when nobody has the attention to spare.
Spark — $15 a month. Access to the AIfa assistants and memory retention: the ordinary daily setup for one person.
Family Archive — $100 a month. Higher limits, personal knowledge bases, family access to a shared memory and the ability to pass it on.
Digital DNA — $1 000 once per device, then $200 a month. A personal protected perimeter on dedicated hardware with continuous anchoring of identity on chain.
It is worth being equally clear about what carries no charge at all. Conversation archiving into your personal folder runs on every tier, including the zero one: once an hour, or immediately past 90 KB. Memory is not a paid feature. What you pay for is volume, speed and the depth at which the assistants work.
There is a practical reason for arranging it this way: if saving itself carried a charge, the person who most needs saving is usually the first to stop paying. Memory behind a paywall fails precisely when it must not.
Worth spelling out too: the tiers differ in resource limits and level of protection, not in how reliably memory is kept. The bottom layer is the same one for everyone, and there is no paid option to have something stored a little more securely.
On-chain payments in the ecosystem pass through a smart-contract router on Solana that splits every incoming amount into fixed shares, identical for everyone: 5 % to the Founder's Fund, 5 % burned, 15 / 7 / 3 % across the three ambassador levels, and 65 % to the treasury.
That last share is not about yield, it is about physics. Two thirds of every payment go to the treasury, which buys AR and tops up the permanent storage pool. Most of the money turns into paid-up years of storage rather than into marketing — storage being the only resource this system genuinely consumes.
If a level of the grid has no referral attached, that share does not settle with the company: it is burned. $GALATIN emission is capped at ten billion tokens (10 000 000 000) and cannot be increased. That is a property of the contract, not a policy to be revisited at the next board meeting.
All the shares are written into the contract, and anyone can check on chain how a given payment was actually split. That matters more than the percentages themselves: a rule you can verify and a rule printed on a page are two different kinds of thing.
For partners who bring their own client base (Ambassador Team) there is, alongside the on-chain 15 / 7 / 3 %, a second channel on fiat sales with three levels: 7 / 3 / 1 %; if payouts are taken in $GALATIN the rates are 8 / 4 / 2 %. Inside the ecosystem these payments are called the network validation fee.
There is also a level-alignment rule: referral income is calculated on your own tier rather than on the tier of the person you brought in. The gap between the two is shown separately in your account as lost opportunity, so that upgrading is a choice with a number in front of it rather than a piece of persuasion.
Every permanent-storage system faces one honest question: what remains if the people who built it are gone. The answer has to be verifiable before the verification is needed, because at that moment there will be nobody left to ask.
Three things remain here. Arweave transactions, still served to any client of the network. Solana pointers by which those transactions are located. And the key, which was in your hands the whole time. None of the three requires us to be alive.
The same answer marks the boundary of what we can promise: a record lasts exactly as long as the network does, and a lost key means the contents are unreadable for good. Neither sentence is pleasant, but both are true — and a promise is only worth something when it can be proved wrong.
And an answer to the usual follow-up: we do not promise that Arweave will still be there in a few hundred years — that is not ours to promise. What we promise is narrower: no switch of ours sits between you and your data.
We spell it out at this length because in products of this kind what usually breaks is not the technology but the wording. An overstated promise is generally paid for by whoever believed it.
Six steps, four of which ask nothing of you beyond an ordinary conversation.
Signing up on the main site takes a minute and creates a personal folder that belongs to you alone. Everything that happens afterwards lands in it.
There is no recording mode to switch on. Ordinary working conversations with the assistant are the raw material that memory is later made of.
An hour in — or the moment the dialogue file passes 90 KB — a copy appears in your folder. There is nothing to press, and no way to press it.
A week later, ask about something from day one, not by keyword but by meaning: what were we arguing about back then. That is the simplest test of whether the semantic layer is doing its job.
Not everything deserves eternity. Send to Arweave what has to outlive companies and devices; the rest stays on the semantic layer, under your control and deletable in the ordinary way.
The key is the one thing support cannot restore — that is the entire point of encrypting on your side. Decide in advance where it is kept and who receives it after you. That decision happens outside the system, as it does with any other key.
As literal as engineering ever gets. Arweave charges once and places the fee in an endowment whose yield pays for storage; the model runs over centuries and assumes storage costs keep falling. If that assumption breaks, the promise breaks with it — but you would see it coming, because the state of the pool is public.
The difference from a cloud service is not that we promise more. It is that here the promise can be checked without asking us.
A more accurate way to put it: as long as the network is there, the record is there. That sounds weaker than forever, but it can be checked, and checkability is the only thing here that is worth anything.
In passing: we do not control Arweave's economics and do not vouch for them — we are one of its users. That is both a disclaimer and the whole point of the design: the network is valuable to you precisely because it is not ours to run.
It stays readable. Permanent-layer records do not live with us: they live in Arweave, the pointers live in Solana, and the decryption key lives with you. Reading your own data requires any client of the network plus the key, and neither of those is issued by our company.
This is not generosity, it is a consequence of the architecture. Making our disappearance destroy your data would have been extra work, and we did not do it.
It follows that we cannot keep the key for you. Convenience and inalienability are a choice of one here, and we chose the second.
So there is exactly one thing to do now: put the key and the record address somewhere we cannot reach. Until that step is done, the paragraph above does not apply to you.
On the permanent layer, nobody but the key holder. Encryption happens before transmission and only ciphertext leaves. We hold no copy of the key, so a request that demands it is one we cannot physically satisfy.
On the semantic layer the data sits in a database encrypted at rest and scoped to your account. On the working layer there is only the context of the current conversation, alive for minutes. The longer the retention, the stricter the regime.
Put differently: the longer something is kept, the fewer people can reach it. Usually it works the other way round, and that is exactly the order we wanted to reverse.
One practical caveat, said up front: encryption protects the contents, not a screenshot you forwarded yourself. The boundary the system holds ends at the ciphertext; past that, it is on you.
The transaction itself, no — and that is deliberate: the ability to erase the past would devalue everything else. But what was written is encrypted, and destroying the key makes the contents permanently unreadable. To any observer, what remains is bytes without meaning.
So here, delete means revoke the key. The practical effect is the same; the difference is that the decision belongs to the owner rather than to the operator of the storage.
Which is why it is worth thinking about what goes to the permanent layer at all. Semantic-layer records can be deleted outright at any moment; permanent-layer ones can only stop being readable.
In three ways. Economics: there, storage is billed monthly and ends with the billing; here it is paid upfront. Retrieval: a drive searches filenames, memory searches meaning. Dependency: a drive works for as long as the company does.
None of that makes cloud drives bad. They solve put a file somewhere and get it back very well. Remember a person is a different problem and needs a different shape of solution.
In practice the two do not compete: keep the files on the drive and give the part that needs remembering to memory.
If you keep one sentence: a drive answers where the file is, memory answers why it was decided that way at the time.
No. We do not claim that stored memory is consciousness and we do not promise anyone's return. The claim is narrower: what a person accumulated — their decisions, their reasoning, their tone, their way of weighing things — stays reachable and answers questions asked afterwards.
We describe the human–AI relationship as co-creation: a tool that remembers and a person who decides. Anything beyond that would be a promise with nothing behind it.
On this we would rather understate. With this subject, a promise made with margin to spare is paid for by the person who believed it.
If someone promises you a consciousness upload, the first question worth asking is how exactly they intend to verify that it worked. A promise with no answer to that is usually not an engineering problem but a rhetorical one.
There are three tiers. Spark — $15 a month: assistant access and memory retention. Family Archive — $100 a month: higher limits, personal knowledge bases, family access. Digital DNA — $1 000 once per device and $200 a month thereafter: a personal protected perimeter.
Archiving conversations into a personal folder works on every tier, including the zero one, and is not billed separately. You pay for volume, speed and the depth of the assistants' work — not for the right to be remembered.
You can move up a tier at any time; memory already saved does not change because of it — it never belonged to a tier in the first place.
Nothing. Memory lives outside the model — in the database and in permanent storage — and the model queries it as an external source. That is precisely why the layers are separated: models change every few months, and memory has to outlive all of them.
The practical consequence is that moving to a new model requires no migration and no re-explaining of who you are and what you have been working on.
The same holds for us: which model to swap out is a technical choice, and a technical choice should not force the user to start over.
The reverse holds too: if one day you stop using our assistants, the memory stays yours, because it was never inside the model to begin with.
No, and that is a reliability requirement rather than interface minimalism. Any button means that one day it will not be pressed, usually on the day it mattered most. A copy leaves automatically once an hour, or immediately if the dialogue file exceeds 90 KB.
We do not have the button either: an administrator cannot turn saving off for an individual user, because no such control exists.
The two triggers work side by side: the hour comes and a copy goes; the file grows and a copy goes at once, without waiting for the next hour.
The only thing left for you to decide is what goes to the permanent layer. The saving itself needs nothing from you.
The permanent layer is not an automatic dump of everything. What goes to Arweave is what has to outlive companies and devices; the rest stays on the semantic layer, under your control, with ordinary deletion available.
A reasonable rule of thumb: if a record will mean nothing to anyone in twenty years, it has no business being in eternity.
Worth remembering that this judgement is made once: after a write, what can still be changed is readability, not the fact of the write.
In practice most people send too little to the permanent layer at first and revise it after half a year of use. That order is the right one: better to add later than to send too much up front.
The Oracle is a technical site audit of 42 checks against GDPR and OWASP. It reports not an abstract maturity score but the specific places where visitors' personal data leaks out.
What it finds can be fixed by the ecosystem team: a fixed price of $500 once, and 48 hours. It has nothing to do with permanent memory directly, but it rests on the same principle — promises should be checkable and deadlines should be stated in advance.
In sequence it usually comes first: while a site is still leaking data, talking about long-term storage is pointless.
All 42 checks are listed item by item in the report, and each can be re-run against the same list once the fixes are in. That is what checkable means here.
The ecosystem's sites and assistants work in Russian, English, Spanish and Chinese. Memory itself is not language-bound: a conversation started in Spanish is found by a question asked in English, because vectors encode meaning rather than spelling.
Write to contact@codeofdigitaleternity.com. People answer. Where someone else's memory is at stake, an automated reply is the wrong instrument.
If you are planning to use all this for a whole team or a whole family, say in the letter how many people and roughly what for — the reply will be more specific.
The content of the four language sites is written separately rather than translated from one to the others: on the same subject, a reader in Chinese and a reader in Russian care about different things.