Outcome 0
Generic score
Brand-new user — no behavioral signal. Recommendation = the calibrated /v1/score verdict, identical for everyone.
01
Cold-start → personalized
From generic verdict to personal model, one outcome at a time
A new user has zero behavioral signal — but you can't show them a useless answer for two months. Personalization ramps in stages: archetype assignment after a handful of outcomes, personal MLP after a few weeks. Until then, the calibrated score is shown unchanged.
Outcomes 1–4
Archetype assignment
User's first sessions place them in an archetype × spot-tier cell (e.g. 'intermediate freerider · tier 2 alpine'). Cell median outcome blends with score.
Outcomes 5–30
Personal blend ramping
Per-user MLP (17-dim feature, 17→16→1 sigmoid) starts learning. Personal weight ramps linearly from 0 → ~0.6 as outcomes accumulate.
Outcomes 30+
Full personalization
Personal MLP dominates the blend. Score remains the authority for hard physics gates (lightning, AQI, storm) — personalization never overrides safety.
02
Authority hierarchy
Five layers, in strict order
Personalization is bounded. The physics gates always win — a brand-new beginner and a five-year veteran both see GO-NO when there's lightning. The calibrated score is the authority; the personalized MLP modulates within a known band; the LLM generates copy last.
1
Hard physics gates
Lightning proximity ≥0.85, AQI hazardous, storm-class wind always force the unsafe verdict. Personalization is dropped: a brand-new beginner and a 5-year veteran both see GO-NO on a thunderstorm cell.
2
Calibrated score
Authority for the meteorological + physics decision. The personalized MLP modulates the score within a bounded band; it never inverts the verdict.
3
Archetype blend
When the user has ≥5 outcomes but <30, the archetype × spot-tier cell median is the secondary signal. Cell median requires k≥10 distinct users (anonymity floor).
4
Personal MLP
Bound by [0, personalBlendWeight(n)] ∈ [0, 0.6] for n ∈ [5, 30]. Warm-started from the prior night's weights. Retrained nightly per pseudonymized user.
5
LLM reasoning
Last in the hierarchy. Generates the natural-language explanation + key factors + safety notes. Hallucination-guarded against the structured score + archetype output. Falls back to template if anything fails.
03
Privacy by design
GDPR Article 17 — fully cascaded erasure
Personalization stores per-user model weights. That makes it personal data under GDPR, which makes Article 17 (right to erasure) a hard requirement. The DELETE endpoint cascades across every store. Anonymous aggregates (Recital 26) survive — that's the legal floor we publish, not just the technical one.
Pseudonymization
Tenant supplies a stable pseudonym (HMAC of the user-id, salt held by tenant). We never see the real user-id. All behavioral storage keyed by pseudonym.
Right to erasure
DELETE /v1/decision/user-data/:pseudonym cascades across the per-user MLP, the audit-log rows, the decision-runs trace, and the cohort signal. Returns X-Anonymized-Rows + X-Receipt headers for the tenant's DSAR file.
k-anonymity
Cohort signals (Recital 26 anonymous aggregates) require k≥2 distinct pseudonyms + n≥3 outcomes. Archetype cells require k≥10 users. Below the floor, the surface returns null — never a leak.
Audit trail
Every decision-agent call writes a decision_runs row: personal score, archetype score, cohort signal, critical-alert short-circuit, degraded reason, per-step latencies, LLM tokens, retries. Pseudonymous, tenant-scoped, queryable via GET /v1/admin/decision/runs.
04
Three audiences
Where this lands
Komoot · Strava · AllTrails-class
Consumer apps
Per-user 'recommended for you' verdict in a generic outdoor app.
Drop /v1/decision into the route-planner. Beginner sees gentler wind cells; ex-pro sees the harder ones. Your existing user-id becomes the pseudonym (HMAC of it, never sent in clear).
Kite · ski · surf · climbing brands
Brand apps
First-party loyalty app — owner of the user-data + the equipment context.
The user_profile object carries the equipment fleet (kite size, board volume, climbing grade). The MLP learns which conditions THIS user picks given THIS gear. Equipment changes? The model adjusts within a few sessions.
FareHarbor · Bookeo · vertical
Booking platforms
'Recommended for you' on the booking page, not just 'today's score'.
Operator's existing customer base — their bookings ARE the behavioral data. Returning customer sees personalised verdict; new customer sees the calibrated score. Cold-start handled gracefully.
05
Access + activation
Pro plan and up
Surface
POST /v1/decision — same shape as /v1/score but accepts a pseudonym + optional user_profile object. Pro and up; per-tenant monthly LLM budget reused from the AI explainer.
Activation
Personal MLP retrains nightly per pseudonym with ≥3 outcomes. Archetype models populate weekly once cells hit k≥10. Typical activation curve: 4–6 months for a freshly seeded vertical (kite / ski-touring) to reach archetype-blend coverage on its main spot tier.
06
Try it