# MULTI-USER + METERING

Foundation for later phases — **shaped now, not hardened now.**

v1 is a mockup. Data must **not** be super-safe. We demonstrate the idea of “each person has their own log and their own token bill,” we do not ship a bank.

## Users (shape)

- Every meal, photo, inventory row, rating, coach note, letter has a `user_id`
- Telegram account ↔ user is 1:1 (a household is many users, not one shared diary)
- Do not mix two people in one LLM prompt on purpose
- Delete-my-data can be “delete this folder / these rows.” No legal programme in v1

**Not in v1:** encryption at rest, keyed tenant isolation, SSO, audit SIEM, hardened auth. A single shared DB or even markdown directories is fine for the prototype.

## Usage meter (shape, for later billing)

Every future SpaceXAI call should record (when we start calling):

- user, channel (telegram/web), kind (chat / vision / stt)
- model, input tokens, output tokens, estimated USD
- request id, timestamp, success/fail

Running totals per user per day/month. Admin can see cost. Billing switch stays **off** through the prototype. The meter exists so a price list later does not need a migration.

Caps (pause vision if someone blows the month) are a later switch on the same table.

Hello World does **not** call the AI and does **not** need this table yet. Do not build it in Phase 1.