PIA: Mini-assistant save cards

Status: Built after assessment; phone check pending. Written: 12 October 2026 · Last revised: 12 October 2026. Nothing here is legal advice. Children's Code citations refer to the exposure draft.

Purpose and scope

When a member accepts tasks, routines or events prepared by Add several or Describe it, their private Assistant conversation records a short card naming what was saved and where. This helps them find an action they took in another tab. The card is a record of a confirmed save, not an AI reply or a group announcement. There is no push notification, email, group-chat message or new model call.

Data and destinations

The card contains up to three saved titles, or a count for a larger batch. Titles can contain names, children's details or health information even if the feature was used for ordinary planning. Its source label says Tasks, Routines or Schedules and the entry used. Only the member whose action saved the rows sees the card. The card uses the existing private Assistant session for that group and account, subject to its current access policy and ordinary transcript retention and erasure. Its body is sealed under that member's key when available; the unsealed metadata contains only a fixed source code, never titles, descriptions, people, dates, event IDs or task IDs. A device without the key sees the existing locked-content message. No source description, rejected draft or failed save is copied into the conversation.

The phone writes the card to the group's existing Supabase Assistant transcript in Sydney after the normal writer confirms creation. The card is excluded from the recent conversation sent to the assistant model, so it creates no new inference or LangSmith input. The existing AI drafting routes and their overseas processing remain covered by Routines and list sorting and Add several events. The card does not change those routes' eligibility or consent. A failed card write never reverses a saved task, routine or event; it may leave the private activity record incomplete.

Risks, controls and residuals

Risk to a person	Control	What remains
A title is copied into another place where it may be read.	The record is in the actor's per-group, per-user Assistant session, behind the existing access policy and sealed-content path. Only confirmed titles are copied, with a three-title limit.	The same person can read the title in two places. The card can outlive a row they later delete or undo until transcript retention or erasure removes it.
A batch partly fails yet the card claims every item was created.	The card is built from returned successful writes, not from the input or proposed drafts; no card is written when nothing saves.	A later undo or deletion can make the historical statement stale.
A group change sends the card into the wrong conversation.	The phone checks the current group and account again before inserting into that pair's session. The database restricts access to the session owner.	A failed or interrupted insert can omit the card.
The card prompts another AI call or a notification.	It is a system record excluded from model context, and this path invokes no push or group-chat writer.	Opening Assistant still loads the private transcript as usual.

Sources

This uses the existing Assistant tracing and transcript assessment for the private conversation's storage and Routines and list sorting and Add several events for the source features.