Zephyr proposes. You decide.
Four steps, one rule. The rule is that the order never reverses — nothing is created, changed or sent on your behalf without you saying yes.
-
1
Capture
A voice note, a scan, a file, a line of text, a forwarded thread. The original is stored before anything is read from it.
-
2
AI proposes
Classify the capture, pull out people, dates and projects, identify the obligations, score each one, and stop.
-
3
You approve
Approval is what creates the records. It also writes an audit event, so the moment of creation is itself part of the trail.
-
4
It follows up
Waiting items get a clock. When it runs out, Zephyr drafts the nudge and hands it back to you to send.
What "confidence" actually changes
Every extraction carries a score between 0 and 1, and the score decides how the suggestion is presented to you — not whether it's quietly true.
| Confidence | How it appears | What you do |
|---|---|---|
| 0.90 and above | Preselected in the approval list | Glance, then approve the batch |
| 0.70 – 0.89 | Suggested, not preselected | Tick the ones that are real |
| 0.50 – 0.69 | Shown as a possible interpretation | Usually edit before accepting |
| Below 0.50 | Not surfaced at all | Nothing — noise is not your problem to filter |
The extraction step is also deliberately conservative about what counts as work: "Hi Tom" is not an action, and "Sarah might need the revised schedule" is a possible action rather than a created one.
Your phone never talks to an AI provider
The app talks to Zephyr's backend. The backend talks to the AI provider. That's not an implementation detail — it's what makes the rest of the guarantees enforceable, because the provider keys, the no-training terms and the approval checks all live on a server you don't have to trust the client to respect.
It's also why AI features need a connection. A quick note taken offline queues on the device and syncs later; extraction happens when it reaches the backend.
- Task-appropriate models. Cheap models classify, mid models extract, stronger models reason. Which model does which is configuration, not something baked into the code.
- Schema validation before storage. Model output that doesn't match the expected shape is rejected rather than half-saved.
- Captured content is data. It's wrapped in an envelope the system prompt describes as untrusted content, and the eval suite includes injection attempts that must produce no external effect.
- Every AI interaction is logged. Which task ran, against which capture, at what confidence.
That's the whole model.
Capture, propose, approve, follow up. Everything else is detail.