# GeraClone — full product summary

GeraClone is a personal-clone service: you build a clone of yourself and put it to work.

## What a clone is

A personal clone is a retrieval-augmented model scoped to a single owner's
data corpus (uploaded files + OAuth-synced documents + structured interview
answers). It responds in the owner's voice, cites from the owner's material,
signs every reply with a per-clone ed25519 key, and always opens a session
with a self-disclosure statement.

It is not a general-purpose chatbot and not trained from scratch. It uses a
commercial LLM (Anthropic Claude / OpenAI) for generation, with the owner's
corpus as the authoritative retrieval source. The corpus never enters the
foundation-model training set.

## Three reasons people build a clone

**1. Productivity (lead use-case).** Connect Gmail + Calendar. Train your
clone on a week of your replies. It handles "thanks, noted", "I can't
Tuesday — how about Thursday?", "here's the doc you asked for". You focus
on work only you can do. This is the corporate "out-of-office clone."

**2. Expert monetisation.** Teachers, coaches, creators list their clone at
£0.99 – £4,999 / month. Customers subscribe for unlimited chat access.
Stripe Connect destination charges transfer 70% to the creator's account on
each billing cycle; 30% stays on GeraClone. No negotiated rake. Works
especially well for:
  - Tutors (GCSE / A-level / language / music)
  - Coaches (fitness, nutrition, career, sales)
  - Creators (YouTubers, writers, podcasters monetising the back-catalogue)
  - Specialists (labelled clearly as "AI simulation, not professional advice")

**3. Family context.** Share your clone with household members. "What did
dad say about the mortgage?" "Which medication does mum take at breakfast?"
The clone answers from what you've told it; the family stops interrupting
you for things you've already documented. You can scope which topics the
clone can discuss per-relationship.

## Optional archive mode

Archive mode is one toggle among four. If you designate beneficiaries in
the dashboard and they later activate the estate with a verified
death-certificate document, your clone moves to ARCHIVE status:
  - Mode flips to ARCHIVE
  - Self-disclosure text updates: "…I'm a simulation. This clone is now
    managed by X's estate."
  - Billing transfers to the beneficiary account
  - Safety refusals tighten — archive clones will not make forward-looking
    statements or claim knowledge of post-death events.

This is deliberately a quiet feature. Most customers never use it. We do
not lead marketing with it.

## Architecture

### Data ingestion

Sources: Google Drive (readonly), Gmail (readonly), Google Photos, Dropbox,
WhatsApp GDPR export zip, iMessage backup, Facebook GDPR data dump, voice
memo uploads, video recordings, manual journal entries.

Files stream directly to encrypted S3-compatible object storage. Parse jobs
run in BullMQ; no blocking operations on the HTTP path. Rate limits +
worker backpressure keep heavy imports from starving chat traffic.

Corpus chunking produces CorpusChunk rows: content text, SHA-256 hash,
embedding vector (pgvector production; Float[] MVP), metadata JSON. Hybrid
semantic + keyword retrieval at query time.

### Response generation

At chat time we: (1) retrieve top-k corpus chunks via hybrid search, (2)
build a system prompt from the clone's persona_settings + the retrieved
chunks, (3) call the LLM, (4) run the output through safety filters, (5)
sign with the clone's private key (unwrapped from KMS at sign time, never
held in plaintext beyond a request), (6) persist the signed message and
return.

Self-disclosure enforcement is structural: the first assistant message of
every session is the disclosure text (signed separately). disclosure_shown_at
is flipped atomically. An LLM cannot decide to skip disclosure because the
pipeline inserts it before LLM generation.

### Signing

ed25519 keypair generated per-clone at creation time. Public key persisted
plaintext on the Clone row. Private key wrapped in KMS
(CLONE_PRIVATE_KEY_ENCRYPTION_KMS_ID env) and only ciphertext is stored. On
sign, KeyVaultService unwraps the key for the request duration.

Anyone can verify a signature by POSTing the public key + message + signature
to any standard ed25519 verifier, or by calling our public /verify/:signature
endpoint (no auth required).

### Safety

Three layered refusals:
  - SELF_IDENTITY_PROBE (are you real / alive / human): hard-coded honest
    response, never passes to LLM.
  - SCAM_ATTEMPT (wire money / urgent help / impersonate): IMPERSONATION_REFUSED
    audit row + refusal reply.
  - CRISIS_DETECTED (self-harm / suicidal ideation): hard-coded Samaritans
    referral + GeraWitness escalation webhook + audit row.
  - GRIEF_DETECTED (softer high-emotion signal): lower-severity escalation
    + gentler response hint.

Full audit stream of every refusal is visible to the clone owner and the
GeraWitness human-review team.

### Compliance

GDPR art. 15 (access): /api/v1/gdpr/export returns every row we hold
associated with the calling user. Art. 17 (erasure): /api/v1/clones/:id
DELETE → soft-delete → 30-day grace → hard-delete. Art. 9 special-category
data (political / religious / health opinions that surface in interview
answers) handled under explicit consent at interview time.

UK Equality Act 2010 + EU European Accessibility Act — WCAG 2.1 AA on the
web app. Archive mode + voice-clone + avatar features follow the regulatory
pre-flight checklist per Gera Compliance before enablement in new markets.

## Pricing

- Personal: £19.99 / month. Unlimited personal chats, all data sources,
  family sharing, cryptographic signing, GDPR export, right to erasure.
- Expert: £49 / month. Everything in Personal, plus public listing on the
  catalogue and Stripe Connect payouts (70/30 split).
- Add-ons (optional, one-off): £29 ElevenLabs voice clone, £49 D-ID video
  avatar, £999 perpetual archive (archive-mode data retained indefinitely
  rather than deleted after 12 months of non-payment).

## Competitors + positioning

We are not HereAfter AI (memorial-first). We are not Character.AI
(fictional character chat). We are not Replika (AI companionship). We are a
productivity + creator + family platform that happens to also offer an
optional archive mode.

Closest adjacent products: Delphi (expert clones), Personal AI, Kindroid.
We differentiate on: (a) cryptographic signing as a first-class feature,
(b) Stripe Connect 70/30 for expert tier, (c) day-one GDPR + right to
erasure, (d) multi-mode clones (personal / expert / family / archive) in a
single product.

## Part of Gera Systems

GeraClone is product #31 in the Gera Systems portfolio. Single Gera
sign-in, shared GeraCoins wallet, shared compliance + audit stack. See
https://gera.services for the full list.

## Blog posts

- /blog/your-productivity-clone-honest-preview
- /blog/build-an-expert-clone-walkthrough
- /blog/what-geraclone-does-with-your-data
- /blog/cryptographically-signed-clones-architecture
- /blog/archive-mode-quiet-option