Once PIM could run as a real server for more than one machine, the next question was obvious: what happens when more than one person actually uses it? The honest answer, before this work, was “nothing good” — PIM had never had any separation between people at all. One database, one vector store, one set of files, and whoever was using it saw everyone else’s journal, mail, and history, because there was only ever meant to be one “everyone.”

The instinct for fixing that is a login screen and a user_id column checked by hand in every query. We didn’t want that, for the reason it got put to us directly: “I hate having to test every DB query with if statements with username. There has to be a better, standard way.” There is — discriminator-based multi-tenancy, a standard mechanism Hibernate already supports, rather than remembering to filter by hand in a dozen different places and inevitably missing one.

A profile is PIM’s version of “who’s using this right now” — a local identity, no password, no account, picked once per launch rather than logged into and out of mid-session. Every entity that holds something personal — a diary entry, a todo, an appointment, a piece of mail, a note — carries a tenant id Hibernate stamps and filters automatically, so code that already existed before this feature needed zero changes to become tenant-aware; Hibernate rewrites the query underneath it. The vector store got the same treatment at one central point, so every memory PIM ever stores is scoped to whoever stored it without any individual AI tool needing to remember to pass a profile id along. Exported files resolve under a per-profile folder the same way.

We tested it the only way that actually proves anything: booted as one profile, created a todo, restarted as a second profile against the very same database, and confirmed it saw nothing. Restarted back to the first profile and confirmed it still saw only its own. Same test against the vector store — searched for a memory as the person who stored it, found it; searched the identical query as someone else, found nothing at all.

The one thing worth catching ourselves on: this is genuinely a feature for the rare case, not the common one. Most people running PIM are one person on one machine, and the very first version of this shipped a “who’s using PIM?” picker on every single launch, even with only one profile ever created — pure friction for the common case, in service of something most people wouldn’t touch. Fixed by having it disappear entirely once there’s exactly one profile, staying out of the way until an actual second person shows up. The picker was never the point. Not seeing each other’s mail was.