A memory in our system is a small record: latitude, longitude, a timestamp, a radius, and a time window. The product question is simple to state and annoying to implement — given one memory, find every other discoverable memory whose place and time both fall inside the chosen bounds.
Two dimensions, two different problems.
Space is the easy half. Coordinates go into a geospatial index, and a scan becomes a bounded radius query. The defaults are tight — fifty metres, and users can narrow to a few — so candidate sets stay small even in a dense city.
Time is where naive designs fall over. The window is not a global constant; it lives on each individual memory, not on the account. One photograph from a concert might be findable for two minutes while an imported trip uses a whole afternoon. That means an overlap is only valid when it satisfies both sides' windows, so you cannot prefilter on a single fixed interval. You intersect ranges, and you do it per pair.
The third dimension is consent, and it constrains everything above. A memory is sealed by default and contributes nothing to the index until its owner makes it discoverable. Returning it to the vault must remove it from matching immediately, not on the next batch job, and deleting it must purge it from the index and from anyone's pending inbox. So the index cannot be a slow-rebuilt artifact — visibility changes have to propagate as fast as a user can tap.
The nice side effect of building it this way is that near misses are free. A candidate that clears the spatial query but fails the window intersection is not garbage; it is a result the product wants. Eleven metres, nine minutes, just outside. We route those to an inbox instead of dropping them.
We are building this into Presque, an iOS app that finds the people who were in the same place at the same time as you.
