Engineering notes
The intelligence stays home
July 16, 2026 · Kaloyan Lachezarov
Deforget is a diary that reads what you write and quietly turns it into reminders, calendar events, meeting notes, and an index of the people in your life. One rule shaped every other decision in the project: nothing leaves the device. Not the text, not embeddings, not analytics, not crash reports. There is no server to breach and no account to leak. The model is Apple's on-device foundation model, sync goes through the user's own iCloud private database, and integrations go through the system - EventKit and Contacts - rather than anyone's API.
That constraint sounds limiting. It turned out to be the most productive engineering decision I made, because it forced an honest relationship with a small model.
What a small on-device model is actually like
Fast, free, private, and wrong in specific, recurring ways. A few from my field notes:
- It truncates lists. Given a meeting block with five talking points, it reliably extracts about two. The fix was architectural, not prompt-engineering: one small model call per bullet. Each call is trivial and reliable; the sum is complete.
- It emits twins. One appointment becomes both a calendar event and a commitment, phrased differently. Cross-type deduplication has to understand that "Coffee with Maya" and "Meet Maya for coffee" are one fact.
- It invents people. The person field comes back as "None", "[Self]", or - a new one from the iOS 27 beta - "Writer": the diary's author, cast as a participant. The rule now: a person's name must literally appear in the paragraph, or no person is created. An invented name can never be grounded.
- Its date arithmetic drifts. "Friday" occasionally lands on a Thursday. Dates named in the text are re-derived deterministically, and everything anchors to the diary page's date - a paragraph written Tuesday and processed by another device on Thursday must still mean Tuesday's "tomorrow".
- It over-triggers on feelings. "Today was one of those days where everything just clicked" once became a commitment. For a diary this is the worst possible failure: your feelings turning into to-dos. I call the counter-property restraint, and it is tested more heavily than any feature.
The model proposes, deterministic code disposes
Every extraction passes through a layer of typed, tested, boring rules before it touches the diary: date repair, declared-type detection ("we decided..." is a decision no matter what the model labeled it), paraphrase-aware deduplication, restraint guards, grounding checks. The model contributes recall - it finds things. The deterministic layer contributes precision - it makes them true. Neither is asked to do the other's job.
This also means model upgrades are pure upside. When the OS ships a better model, recall improves underneath an unchanged correctness layer.
Measure the seam
I run a fixed evaluation corpus - thirty-five diary scenarios with typed expectations - on real hardware, on every iOS beta. Every case is scored twice: once on the raw model output, once on the final result after the deterministic layer. The gap between those two numbers is the deterministic layer, measured.
On iOS 26.5, the Foundation model passed roughly 46 percent of checks and the full pipeline about 75 percent. On the current iOS 27 beta the model itself improved to about 61 percent raw - and the pipeline lands at 91 percent. The deterministic layer's contribution stayed near thirty points across both, which is the property I care about most: model gains and engineering gains compose instead of cannibalizing each other. Restraint went from the weakest category to a perfect run.
One wall clock, on a leash
A small story about defaults. A date named without a time used to become a 9 AM reminder - nobody wants an alert at midnight. Then a tester wrote "remind me today" at noon and received a reminder for 9 AM, a time that had already passed and could never fire. The rule now: if the named day is today and 9 AM is gone, the reminder lands an hour from now, rounded up to the quarter hour. That check is the extraction pipeline's only permitted read of the wall clock, and it may only decide a time of day - never a date. Small models make you precise about strange things.
What it costs
Honesty requires the other column. The intelligence is tuned and tested for English; other languages often work, but I do not promise them. It requires Apple Intelligence hardware, so the App Store offers Deforget only on devices that can run the model. And the model's behavior shifts between OS releases - which is exactly why the evaluation harness exists and runs on every iOS 27 beta before any user meets one.
Why bother
A diary is the most private document a person owns. "We don't read your data" is a policy; "we cannot" is a design. On-device also means extraction works in airplane mode, costs nothing per token, and gets faster with every chip generation - the economics of privacy point the right way for once.
More notes soon. The sync layer - in which deleted paragraphs had to learn to stay dead - deserves a post of its own.