One pal, the whole household

This week I set pal.fun up for my own household, and putting it in front of my own family is what settled a design decision I'd been going back and forth on for weeks. So this essay is about a call I almost got wrong: when a family wants an AI, do you give each person their own, or do you give the whole household one?

The obvious build is a swarm

Ask anyone how "family mode" should work and you'll get the answer I first gave myself: everyone gets their own pal, and the pals know about each other. A pal each, all networked so they can coordinate — pass messages, sync the calendar, hand things off. It sounds rich. It demos well. It's the version with the most boxes and arrows.

I built toward it for a while, and then I killed it, because the closer you look the more it's a trap.

A swarm of pals is a swarm of surfaces — each one its own memory to keep straight, its own identity that can drift from the others. The "they coordinate" part, which is the whole pitch, is where it falls apart: now you're writing the protocol for how five separate agents negotiate who knows what, who tells whom, who speaks when. That's not a feature, it's a distributed-systems problem wearing a friendly face — and every bit of that complexity is pointed away from what a family actually wanted, which was one helpful thing that knows them.

It also fragments the exact thing that makes a family pal useful. The value isn't five AIs that have each other's phone numbers. It's one that already knows Thursday is the recital, that there's a dentist appointment Tuesday, that we're a chili-crisp-for-the-grownups household. A swarm scatters that across five heads and then needs machinery to reassemble it. Better not to take it apart in the first place.

So I built one

pal.fun gives a household one shared pal. Named once, with one personality. Everyone in the family talks to that same pal — privately, in their own thread — and it holds the family's shared life in one place.

The piece that makes it work is the memory. A solo pal keeps one readable file of what it knows; a family pal keeps one shared file the whole household writes to. Something it picks up in my conversation is there when it talks to my wife. The calendar, the household logistics, the running context of the week — one record, contributed to by everyone. The only thing that stays personal is what the pal knows about you as an individual, which lives in your own file and nobody else's.

I'll be straight about how I got here, because it's the useful part. My first version of the shared pal still had a cautious privacy contraption bolted on — a separate "family memory" behind a gate, with the pal making editorial calls about what was safe to write where. It was clever and it was wrong. The moment I tore it out and let the household share one memory, the whole thing got simpler, cheaper to run, and easier to reason about. The best fix deleted code. It usually does.

A family is a transparent unit

The objection writes itself: one shared brain — isn't that a privacy problem? It would be, if a family were a collection of strangers. It isn't. A family is a unit that mostly should be able to see itself — the people in a household can already see the shared parts of each other's lives: the calendar on the fridge, the plans for the week. The glass box was always our answer to "how do you trust a thing you can't see into," and it's the right answer for a household too. Transparency cuts both ways.

So I stopped treating privacy as walls between the people in a household and started treating it as a property of which pal you're talking to. The family pal is a transparent unit. If you want space that's genuinely your own, the answer isn't a secret room inside the family pal — it's a separate solo pal, private by the same rules every solo pal already has. One concept applied twice, instead of a maze of per-person permissions stapled onto a shared one. (There's exactly one carve-out, and it's a safety one: a member's serious disclosure is handled by the safety floor and is never quietly written into the family's shared memory, because the architecture can't assume every member is a safe audience for it. That's the one place the transparent default has to bend, and it bends on purpose.)

The powerful controls — who can join, approving a new device, the subscription — sit with whoever set the household up, by construction. A new member joins on a device the owner approved with one tap from their own inbox; the account-level controls are simply never in a member's reach. That's not a setting someone could flip. It's the shape of the thing.

The household is the on-ramp

Here's the part that matters most, and the reason I now think this is the more important version of the product.

Most of the AI conversation is about power users — people already three tools deep, prompting like it's a second language. But most people have never really used an agent at all; to them it's a text box that does tricks. When that changes for a normal person, it often won't happen at a desk. It'll happen at home, because someone in the household set one up and now the family shares it. The household is the on-ramp, and a shared family pal — set up by whoever's most comfortable with it — is where a lot of people will meet their first agent.

That's a different design target than the power-user tool everyone benchmarks against, and it raises the bar on the things pal.fun already cares about. An AI a whole household shares — often meeting someone who's never really used an agent before — has to be legible, not seductive. You should be able to read what it is and what it knows. Anyone in the household should be able to see exactly what the shared pal has picked up. It shouldn't pretend to be more than it is. The same transparency that makes a pal trustworthy is what keeps it from becoming the kind of thing people are right to be wary of. We didn't add that property for families; families are just where it matters most.

One pal, the whole household. The obvious build was a pal each, and a pal each was a swarm, and a swarm was a tangle of machinery pointed away from the only thing that mattered. The right build was the simpler one: a single pal the whole family can see all the way into, that knows the household, and that keeps its shared life in one place anyone in the family can read. Simpler to build, simpler to trust — and the version most people will actually meet first.