A Meditation App That Doesn't Upload Your Data: How On-Device Rules Make It Possible 不上传数据的冥想 App 怎么做？全端侧规则引擎的技术实现

Here's an uncomfortable truth about most wellness apps: when you tell them you're feeling anxious or depressed, that information often gets sent to a server. Your emotional state — arguably the most private data you have — lives in a database somewhere, analyzed for product improvement, targeted advertising, or worse. What if it didn't have to be this way? 这里有大多数健康 App 不愿明说的事实：当你告诉它们你感到焦虑或低落时，这些信息通常会被发送到服务器。你的情绪状态——可以说是你最私密的数据——存在于某处的数据库中，被用于产品优化、定向广告，甚至更糟。如果可以不这样呢？

The short answer is yes. Here's how we built MoodFlow's on-device emotion engine — and why it matters. 答案是能。下面是我们构建心境端侧情绪引擎的方式——以及为什么这很重要。

The Architecture: Rules, Not Models 架构方案：规则引擎，而非大模型

The first design decision was the most consequential: we don't use a cloud LLM. No GPT, no Claude, no server-side inference. Instead, the matching engine is a deterministic rule-based system that runs entirely in-process on iOS. 第一个设计决策也是最重要的一个：我们不使用云端大语言模型。没有 GPT、没有 Claude、没有服务器端推理。匹配引擎是一个确定性的规则系统，完全在 iOS 进程内运行。

Here's the architecture in a nutshell: 架构概览：

• 14 moments, covering 72 emotions, each mapped onto three-dimensional coordinates: arousal (high/low), emotion type (angry, anxious, sad, joyful...), and attention (scattered, focused, drowsy). 14 个此刻诉求，合计覆盖 72 种情绪，每个都映射到三维坐标：唤醒度（高/低）、情绪类型（愤怒、焦虑、低落、愉悦……）、注意力状态（分散、专注、昏沉）。
• A rule table mapping each state profile to the optimal intervention chain: which breathing pattern targets this physiological state, which body scan or noting exercise follows, and which ambient soundscape creates the right sensory environment. 一个规则表，将每种状态画像映射到最佳干预链：哪种呼吸模式靶向这一生理状态，后续接哪个身体扫描或正念标记练习，以及哪种环境音景营造合适的感官环境。
• 16 breathing patterns with precise inhale-hold-exhale ratios and phase durations, each targeting specific mechanisms: 4-7-8 for sleep onset, extended exhale for down-regulation, box breathing for attentional anchoring, physiological sigh for rapid stress reset. 16 种呼吸模式，带有精确的吸呼屏气配比和阶段时长，每种靶向特定机制：4-7-8 助眠、延伸呼气下调神经系统、方块呼吸锚定注意力、生理性叹气快速压力重置。

All of this — the tag definitions, the rule table, the breathing patterns — ships as JSON files bundled with the app. The matching algorithm is a few hundred lines of Swift. No network call. No server round-trip. Everything happens in under a millisecond on your iPhone. 所有这些——标签定义、规则表、呼吸模式——都作为 JSON 文件打包在 App 内。匹配算法仅几百行 Swift 代码。无网络调用、无服务器往返。一切在你的 iPhone 上毫秒内完成。

Why Rules Beat Models for This Use Case 为什么规则优于模型

In a world obsessed with machine learning, choosing a rule-based system might seem like a step backward. But for emotion-to-intervention matching, rules have specific advantages: 在一个沉迷于机器学习的世界里，选择规则系统似乎是一种倒退。但在情绪到干预的匹配场景中，规则有其独特优势：

• Determinism. The same emotional state always produces the same recommended intervention. This is critical for trust — the user learns that "when I'm feeling this way, this is what helps." A probabilistic model that gives different recommendations each time undermines that learning. 确定性。相同的情绪状态始终产生相同的推荐干预。这对信任至关重要——用户会学到"当我这样感觉时，这个就有用"。概率模型每次给出不同推荐，反而破坏这种学习。
• Zero inference cost. No GPU, no API fees, no latency. The matching completes before the UI transition animation finishes. 零推理成本。不需要 GPU、不需要 API 费用、没有延迟。匹配在 UI 过渡动画完成之前就结束了。
• Auditability. Every matching decision is traceable. If a user reports that tapping "anxious" led to a breathing pattern that felt wrong, we can look at the exact rule that fired and adjust it — with surgical precision, not model retraining. 可审计。每个匹配决策都可追踪。如果用户报告点"焦虑"后匹配到的呼吸模式感觉不对，我们可以查看触发的确切规则并精确调整——无需重新训练模型。
• Works offline. The app is fully functional without an internet connection. This isn't just a privacy feature — it's a reliability feature. Meditation shouldn't depend on your cell signal. 离线可用。App 无需网络连接即可完全运行。这不仅是隐私特性——更是可靠性特性。冥想不应该依赖手机信号。

What "On-Device" Really Means for the User "端侧运行"对用户到底意味着什么

No account needed. You open the app and start. No email, no password, no OAuth, no phone number. The concept of a "user account" simply doesn't exist in the architecture. 无需账号。打开即用。无需邮箱、无需密码、无需第三方登录、无需手机号。"用户账号"这个概念在架构中根本不存在。

No server exists. There is no MoodFlow backend. No database. No API. The entire product is the iOS app binary and its bundled assets. 没有服务器。心境没有后端。没有数据库。没有 API。整个产品就是 iOS 应用二进制文件和打包的资源。

Your history is yours. Session records and mood check-ins are stored locally in your device's SwiftData store. They sync to your other devices via iCloud if you choose — Apple's encrypted sync, not ours. Delete the app, and the data is gone. We couldn't restore it even if we wanted to. 你的记录是你的。练习记录和情绪打卡存储在设备的 SwiftData 中。如果你选择通过 iCloud 同步，走的是 Apple 的加密同步通道，不是我们的。删除 App 后数据消失，我们即便想恢复也做不到。

The Tradeoff: What We Can't Do 权衡：我们做不到的事

Being honest about the architecture means being honest about its limitations. Because there's no server-side aggregation, we can't: 诚实地讨论架构，意味着诚实地面对它的局限。因为没有服务器端聚合，我们做不到：

• Train models on aggregated user data to improve recommendations over time用聚合的用户数据训练模型来持续改进推荐
• Offer cloud-synced accounts that work seamlessly across all platforms提供跨平台无缝同步的云端账号
• Do A/B testing on intervention effectiveness at scale大规模做干预效果的 A/B 测试
• Recover your data if you delete the app without a backup在你删除 App 且没有备份时恢复数据

We consider these acceptable tradeoffs. The ability to tell users "your data never leaves your device" — and mean it literally — is worth more than a marginally better recommendation engine. 我们认为这是可接受的权衡。能够告诉用户"你的数据永远不会离开你的设备"——并且字面意思上做到——比一个稍微好一点的推荐引擎更有价值。