One world = one directory: data ownership as an engineering decision
Every app claims your data is yours; the storage architecture decides whether it's true. Foreverse's version: each world is a directory on your device, character cards are standard chara_card_v3 files, lorebooks are JSON, a companion packs into a moving-box zip, community imports carry provenance records, and AI-generated images get machine-readable origin marks. Here is the file-first architecture laid open — costs included.
“Your data belongs to you” has been said so often it means nothing. There is exactly one way to audit the claim: look at the storage architecture. If your data is rows in a platform database and export is a button the platform may or may not grant, the sentence actually means “leased to you for now.” If it is standard-format files in directories on your own device, the promise has an engineering guarantee behind it. This post lays out Foreverse's file-first architecture: what it looks like, why, and what it costs us.
One world = one directory
| Content | Stored as | Format |
|---|---|---|
| Novel prose and branches | Files in the world directory | Markdown-family plain text |
| Character cards | Standalone files | chara_card_v3 (PNG/JSON, public spec) |
| Lorebooks | Files in the world directory | JSON, desktop-tavern compatible |
| Chat logs | Files in the world directory | Exportable structured text |
| A companion's whole life | Own directory + moving box | zip (persona / memories / stickers / avatar / transcripts) |
| API keys | Device-encrypted storage | Never leave the device; requests go direct to providers |
The direct corollary: migration is a copy operation. New phone, backup to a computer, sending a tuned card to a friend — all file-level actions needing no platform cooperation, which means no “what if they turn off export someday.” Our cards open in desktop SillyTavern and the reverse holds, because both sides read the same public spec.
Three details that usually get skipped
The companion moving box. Companion data is the loss people fear most — months of memories and shared history. We built departure as an explicit feature: one-tap zip export with persona, every memory entry, stickers, avatar, transcripts; the importer validates entries against a whitelist, rejects path traversal, and rolls back automatically on failure. The round trip is tested as a first-class feature, not decoration buried in settings.
Community provenance. Cards and lorebooks imported from the community carry a provenance record (which pack, which version) in their metadata, there for your verification. The mirror-image design matters more: the record does not propagate on re-share. A card you pass along travels as a clean file without your download history. Provenance serves the owner, not surveillance.
AI-output marking. Images generated inside the app get machine-readable origin marks written at the file level (standard PNG and JPEG metadata fields) identifying them as AI-generated. When an image leaves for another platform, the mark travels with it — our small engineering contribution to AI-content identifiability.
The costs, stated plainly
File-first is not a free lunch. No cloud sync: your data on your device means no copy on our servers, so migration rides the moving box and directory copies; real-time multi-device sync does not exist yet (it is on the roadmap, end-to-end encrypted when it comes). File I/O is slower than a database: long chat loading took real indexing and chunking work to claw performance back. And backups are your responsibility — the files are in your hands, and if you delete them we cannot conjure them back.
Two halves of the same position
Files govern where data lives; BYOK governs where it travels: keys encrypted on-device, requests straight to your chosen provider, nothing routed through us. Together they make ownership whole — content in your directories, traffic on your own contract. Users who migrated from platform apps feel this architecture most concretely: the most expensive part of leaving a platform is never having had archives, and file-first means archiving is the default state instead of a rescue operation.
FAQ
What does file-first storage mean concretely?
Each of your worlds (a book or a card's whole life) is a directory on your device: prose, branches, lorebook, character dossiers, chat logs — visible files in standard or documented formats (chara_card_v3, JSON, markdown). Moving out is a copy operation, not a plea for an export endpoint.
Can AI companion data leave too?
Yes, through a dedicated moving box: persona, individual memories, stickers, avatar, and transcripts export as one zip and restore on another device. The import side validates hard — entry whitelist, path-traversal rejection, automatic rollback on failure — so a corrupted box cannot poison existing data.
What's different about content downloaded from the community?
It carries a provenance record — which community pack, which version — written into the content's metadata for your verification. Deliberately, that record does not propagate on re-share: when you send a card to a friend, they get a clean standard file, not your download history. Provenance serves you; it is not a tracking beacon.
Do BYOK keys or chat contents ever get uploaded?
API keys are encrypted and stay on the device; requests go directly to the provider you chose, never through our servers. Chats live in local directories; the optional official billing channel records billing-side data only. The data-export page can produce a full export or deletion at any time.
Questions or ideas? Join our Discord →