Intelligence

Intelligence controls where AI runs and what processes your notes in the background. It is separate from Do’s own slider, which governs how much Do acts on your behalf.

Intelligence appears only once it is turned on for your account. Until then there is no Intelligence row in Settings, no Intelligence card on Mac and no Intelligence step in setup, and Cloud AI works the way Cloud AI, explained describes.

• On this device: Only on-device models (Apple Foundation Models where available, on-device embeddings for filing and search). No note content leaves the device for AI. Cloud planner is off and Top 3 falls back to the deterministic ladder. Cloud summaries, morning report composition beyond deterministic facts, Do, goal proposals and cloud capture are off.
• Ask first: Cloud AI only when you ask, through capture, Do or explicit actions. No background processing of note content. Overnight intelligence, background self-sorting, REM insights and goal proposals are off. Notes can still sort on device where supported.
• Full: Everything, including background intelligence: notes sort themselves, overnight preparation, morning report and goal next steps. Full is the onboarding preset; cloud processing still requires explicit Cloud AI consent.

Where to find it

• iPhone: Settings, under AI & your data, the Intelligence row. Its value is your level, with _Customized_ after it when a switch differs from the level. The page opens with the three positions side by side, left to right from the most private, and the sentence for the level you are on. At the largest text sizes the three positions stack so each name reads in full.
• Mac: Settings, the Intelligence card just above Privacy. The three positions are a segmented control, the level's sentence sits under it, and Customize opens in place with each feature as a checkbox. Customize opens by itself when your setting is customized.

The sentence for each level:

• On this device: Only on-device models run, so nothing you write leaves your device for AI.
• Ask first: Cloud AI runs only when you ask, and never works on your notes in the background.
• Full: Notes sort themselves, and your day is ready each morning.

Customize

Customize lists every AI feature this version of Kept has, each with its own switch on iPhone and its own checkbox on Mac, grouped under Notes, Today, Capture, Goals, Questions and memory, and Setup and health. Features that are paused in this version (for example meal analysis while Body is paused) are not listed.

• Moving the level resets every switch to that level's defaults.
• Turning a switch off keeps the level and shows Customized. Use Full defaults (or the level you are on) puts that level's switches back.
• A switch can never show on while its level keeps it off. Turning on a feature that works in the background, such as Notes sort themselves or Your day, moves the level to Full. Turning on a feature that runs when you ask, such as Capture sorting, moves On this device to Ask first. A switch that would move the level names the level it needs under its description, for example _Needs Full_.
• Turning off every background feature at Full settles on Ask first, and turning off everything settles on On this device.

Server enforcement treats On this device and Ask first as ceilings: enabling a switch cannot authorize cloud processing at On this device or background processing at Ask first.

Cloud AI permission comes first

Ask first and Full use Cloud AI, so they need your Cloud AI permission. Choosing either one when Cloud AI is off opens the same Cloud AI permission sheet Settings uses, with who receives what and why. Allow Cloud AI gives the permission, and your level is saved once that permission reaches your account; until then the page says _Saves once your Cloud AI permission reaches your account._ Closing the sheet any other way changes nothing. Choosing a level never turns Cloud AI on by itself. On this device never asks.

If your level is Ask first or Full but Cloud AI is turned off (for example in Privacy), the page says _Cloud AI permission is off, so only on-device models run for now._ with Turn on Cloud AI.

Saving, and changes from another device

A change shows at once and the page says _Saving_ while it is on its way; nothing spins. If it cannot be saved, your previous setting comes back with _Could not save that change. Your previous setting is still on._ and Try again. If you changed Intelligence on another device in the meantime, Kept does not overwrite the newer choice: the page shows the latest setting with _This setting changed on another device. Showing the latest._ and you can choose again.

In setup

When you choose Allow Cloud AI during setup, the next screen asks _How intelligent should your notes be?_ with the three positions preset to Full and one sentence for the level you pick. You can slide down to Ask first or On this device; Continue moves setup on at once and records your choice once your Cloud AI permission reaches your account. If you keep Cloud AI off in setup, there is no Intelligence screen and your account stays On this device. Change it any time in Settings.

Existing accounts with active Cloud AI consent migrate to Full. Accounts without active consent migrate to On this device. New accounts start at On this device until an explicit choice and consent. Device capabilities and unsupported on-device filing are tracked by the client lane; this server contract does not add on-device models.

The account API reads and saves your level and feature switches. A stale choice cannot reopen cloud processing after a newer change, and On this device can always withdraw permission. If settings cannot be read, cloud processing pauses until they are available again. Choosing Ask first or Full requires the existing provider disclosure confirmation first.

Ops can view daily Intelligence level distribution on the AI features dashboard. The chart shows counts only, including zero-count levels and an explicit unavailable state. History begins with migration, and older distributions are not inferred from today’s choices. The chart is hidden while the rollout flag is off.

When enabled, these permissions also cover cloud job titles and file uploads to a model provider. Removing a permission blocks future processing; it does not recall material already sent. Ordinary account synchronization and storage have their own controls.

Do respects the separate Note search and Memory search switches when retrieving cloud results. Remembering a fact you explicitly ask Do to save uses Do permission; turning Goal coach off does not disable that action. Goal coach still requires its own permission when it saves a fact.

When Cloud AI consent remains active and the scheduled cycle is otherwise allowed, turning overnight Intelligence off clears the overnight patterns at the next night, since Kept would no longer write them for you, and the rest of the night still arrives. A failure to read the setting is not a setting: it defers the pattern stage and keeps the existing patterns that night's data still supports.

Cloud note search and meal analysis return a permission response when their feature switch is off, including a change made while a request is running. The response directs you to Intelligence in Settings instead of asking you to retry a server failure.

The cloud admission response uses HTTP 503 with a retryable unavailable code for a temporary failure to read Intelligence settings, including when it happens between model steps. Missing or invalid settings also pause cloud processing. This does not mean permission was withdrawn, and changing a setting will not repair the outage. Existing overnight insights stay available while processing is deferred.

Cloud note search and meal analysis report temporary unavailability if Intelligence settings become unreadable during a request. Meal analysis also rechecks before coaching. These responses ask you to retry, with no instruction to change permission.

If a scheduled pattern stage cannot verify Intelligence at its final provider check, it defers and carries existing insights without replacing them. A failed carry read also leaves stored insights untouched.

Do and shared-document questions also distinguish temporary Intelligence unavailability from permission denial. Before a response opens they return a retryable unavailable response. During a Do response, the existing unavailable stream error asks you to try again.

Capture routing and task enrichment return retryable unavailability if a permission lookup fails before cloud processing. They do not write a replacement result for that failed step. A capture response that is already streaming sends a retryable error event.

Kept Cloud Agents run requests report retryable unavailability when Intelligence cannot be checked. They do not claim a successful run or publish an empty result for that failure. A run whose advancement becomes unavailable is cancelled before the retry response, and its organization reservation is released once cancellation is confirmed.

MCP clients receive a typed retryable unavailable tool result when Intelligence cannot be read. The JSON-RPC transport keeps its normal HTTP response; the tool error carries status 503. Valid Intelligence denials carry status 403 and are audited as denied.

Capture, including the Mac global capture panel, Ask Kept, Do, Top 3 refresh, meals, note search, and Goal coach show Off in Intelligence with Change in Settings opening Intelligence directly from an accessible action for a refused feature, or Intelligence is temporarily unavailable with an explicit Try again for an outage, while preserving your draft, conversation without adding status messages to it, the latest item edits, results, and current picks and keeping refusal states scoped to your current account, while ordinary capture failures offer the manual Event, Task, or Note choice. A refused AI request never retries automatically: saved planner captures retain their words and pause recovery across relaunch, with Retry saved captures available in Intelligence once cloud planning is enabled, and note search pauses further cloud requests until you reopen it, clearing previous-query results if you type a different query; Notes Tidy uses the same denial and outage recovery once its native integration is enabled.