David grinning at a Thai restaurant table behind a bowl of khao soi, April 6, 2025
The face I make when the khao soi arrives, which is also the face I make when you do. April 2025; the rest, dated, on Who I Am.
FRAME OF REFERENCE: THE COSMIC MICROWAVE BACKGROUND

I'll travel exactly two astronomical seconds anywhere to meet you.

Relative to the cosmic microwave background, the closest thing the universe has to a rest frame, you and I are already hurtling through the cosmos together at about 230 miles a second (370 km/s), so my dating radius is two seconds of that motion: ≈460 miles / 740 km by car, which is about eight hours in my electric Chevy once the charging stops are counted, and the same eight hours buys nearly the whole country by plane. If a nonstop from South Florida or from my Cleveland base reaches you inside that clock, you're in the radius, wherever you are, Canada included; only the Bay Area and the Pacific Northwest sit on or just over the line from Florida, and Seattle fits from Cleveland. Travel Reach has the map and the math.

460 mi by car, or ~8 hours door-to-door by plane
= 2 seconds × 230 mi/s (370 km/s, the Sun's velocity w.r.t. the CMB dipole) = 7 hours 4 minutes of driving plus about an hour at fast chargers, 8 hours 4 minutes door to door · a nonstop inside that clock, from South Florida or Cleveland, reaches everything but the Bay Area and the Pacific Northwest, and Seattle from Cleveland
Since you opened this page, we've both traveled 0 miles through the universe. Still think distance is a dealbreaker?

Who this is. David Clayman, 40, a former science teacher who now builds public-health software at the company I founded, based in South Florida with a second base in Cleveland. I work remotely, hold three passports, and can move to wherever you are on a week's notice. I read for pleasure, dance salsa when the chance comes, don't drink, and I'm divorced, which the site explains when the time is right. I want to marry and raise two or three children, soon, whether they arrive with you or after you. Everything below this line is me going first.

What Tuesdays with me look like. Coffee handled, my half of everything domestic done without being asked, a walk after dinner, two people reading in the same room and interrupting each other with the good parts. When you're sick, I carry your half of the house on top of mine. When you win, I brag about you in rooms you're not in. When there are kids, yours or ours, I'm an active, heavily engaged coparent, not a helper. And you will be danced with, in the kitchen, while dinner cooks. The long version is What You Get. This site is the demo.

What I'm looking for. Someone who wants a family, whether she's bringing children or building them with me. Someone curious enough to say "huh, I wonder why that is," and kind under pressure, to waitstaff and lost tourists especially. Someone who would rather choose each other on purpose than wait for the universe to assign us.

Contents

Two layers. Start Here is the profile: everything a first coffee needs, in one scroll. The rest of this map is the laboratory, for whenever curiosity strikes.

Travel Reach

About eight hours door to door, by car or by plane. That buys nearly the whole continent.

The rule. The 460-mile radius is about eight hours door to door in my electric Chevy, charging stops included. Hours don't care about the vehicle, so the same clock applies to flying: any city in the United States or Canada qualifies if a nonstop gets me from my door to yours inside it. After the airport overhead on both ends, that leaves roughly six hours twenty minutes of flight.

What fits. From South Florida or my Cleveland base: everything east of the Rockies, plus Denver, Phoenix, Las Vegas, San Diego, and Los Angeles. The holdouts are the Bay Area and the Pacific Northwest from Florida, though Seattle fits from Cleveland. Toronto is inside the driving radius from Cleveland, Montreal and Ottawa are short hops, and someone in Canada would be very welcome, not merely permitted.

The fine print. Nonstops only, since one connection breaks the budget, so the real limit is the route map: plenty of mid-sized cities have no nonstop from either base. Schedules change quarterly, so the set breathes. The map below is dots on a projection, drawn to make a point.

Who I Am

Basic characterization data. Spectral analysis ongoing.

Former science teacher, current founder-engineer — which means I explain things for fun and build things for a living, and I genuinely can't tell you which one is the job. Licensed drone pilot, so technically certified to operate in three dimensions while dating in two.

AGE 40.4 yrs (counting) · HEIGHT 5'10" / ~177 cm · MASS ~190 lb / ~86 kg

Left: the face I make when the khao soi arrives. Right: the face I make when someone is funnier than me. Below: the one time I jumped out of a plane, grinning because the parachute had just opened. Bottom: an evening under string lights in the loudest shirt I own. Dates are on the photos; I haven't changed since, and more recent ones are yours for the asking.

Citizenship: triple. The United States, Portugal, and Israel. Three passports, three shelves of history, and for our future kids, three sets of doors that stay open: places to study, live, work, and belong.

The longer version. I taught science before I built software, and the teaching never stopped; it changed rooms. The building is Lifesaver Labs: CtrlAltM⏻ve, which locks my screens until I've exercised, Neighbor 911, Safeword, which carries a granted US patent, and Five Nines Fertility. Before that I held jobs in Montreal, France, and China. I've jumped out of an airplane exactly once (FIG. 03), I fly drones on a license, I dance salsa when the chance comes and would happily dance with you for the rest of my life. I'm an independent voter, a Jew who runs anywhere from glatt kosher to Chipotle, and a graduate of the school of very hard knocks who came out curious instead of bitter. What I want is on every other page of this site: a partner, two or three kids, and the decades it takes to enjoy them.

The range. I've done real coursework in health sciences, law, economics, business, and computer science, and I've used all five: the patent, the EMT certification I'm working toward, the finances on The Work, the companies, the code. None of it came with the diploma that usually goes with it, so I hold the opinions loosely and debate them cheerfully. Bring up almost any topic and I'll have some background and an early view. The Erasmian ideal, a life of action and a life of mind in one person, is the one I'm chasing.

Languages. English natively, with most of its technical dialects. French studied through high school and college and used on the job in Montreal and France, which with enough practice I can get close to bilingual; beginner Spanish, beginner Hebrew from childhood Hebrew school, and beginner Portuguese picked up as an adult. One lesson learned the hard way: app-only language study, without classes or immersion, never got me to the fluency a wife would need from me. If our happiness depends on your mother tongue, we budget for formal classes, and you bring patience while I practice.

I build software for emergencies and for trust — systems that have to work when it matters most. I bring the same philosophy here: everything on this site is checkable if you ever care to check, and it matters more to me that you could than that you do.

Ask me about the time being wrong in public taught me more than being right, or why I think the two best first-date questions are "what do you believe that you can't prove?" and "what have you changed your mind about that you once felt strongly on?"

What You Get

The other side of the ledger: what being loved by me is actually like. Spoiler: coffee.

The Tuesday test. Grand gestures are cheap to promise and rarely needed. A marriage is mostly Tuesdays, so judge me on the Tuesday forecast: coffee handled, my half of everything domestic done without being asked, a walk after dinner, two people reading in the same room and interrupting each other with the good parts. I explain things for fun and I listen the same way; you will never finish telling me about your day to a man scrolling his phone.

When it's hard. I build software for emergencies; calm under pressure is literally my trade. When you're sick, I carry both halves of the household and cancel what needs canceling. When you're grieving, I don't vanish into fix-it mode unless you ask for fixes. When we disagree, you've read the Dealbreakers page: negotiating table, never a battlefield, and the Feedback Clause means complaints get repaired instead of archived.

When it's good. Teacher instinct: I brag about the people I love and I'm not discreet about it. Your wins get celebrated at full volume, your name gets defended in rooms you're not in, and the salsa offer stands for life: you will be danced with.

The coparent. Whether the children are yours already or ours together, expect an active, involved, heavily engaged coparent: the one at the pediatrician, the school pickup, the 3 a.m. feeding, and the homework table, not the one who "helps out." The Partnership page promises half of everything domestic; parenting is the half I care about most.

The warmth. I'm an affectionate partner: hands held in public, a real hug at the airport, dancing in the kitchen while dinner cooks. The engineering brain runs the spreadsheets. It does not run the marriage.

The attention. The honest pitch is right in front of you. You've seen the attention I paid to a website about finding you; point that same attention at loving you for fifty years and you have the actual offer. This site is the demo.

The Shelf

The Dealbreakers page says reader; this is where the evidence goes. The short shelf first; the frighteningly complete version, Supreme Court opinions included, one click down.

CATALOGThe frighteningly complete version: six shelves, every link
  • Shelf 01 Books Twenty-seven spines, grouped the way they live in my head.
    On media and minds: Amusing Ourselves to Death (Postman), You Are Not a Gadget (Lanier), The Design of Everyday Things (Norman), Habit (William James), and The Cambridge Handbook of Expertise and Expert Performance.
    Fiction I evangelize: the Three-Body trilogy, the Ender's Game quartet, Stranger in a Strange Land, Cloud Atlas, The Giver, the Harry Potter series, and Catch-22.
    War, witnessed: War and Peace, Hiroshima (Hersey), and The Sorrow of War (Bảo Ninh).
    Builders and healers: Mountains Beyond Mountains, The Snowball, The Illusions of Entrepreneurship, Coders at Work, and Paul Graham's essays.
    Older wisdom: On Liberty (Mill), Pirkei Avot, 1000+ Greatest Poems, Our Nation's Archive, and the innumerable opinions of the Supreme Court.
    The kitchen shelf: How to Cook Everything (plus the vegetarian edition) and Food Rules (Pollan).
    The anti-recommendation: Thoreau's Civil Disobedience. No book on this shelf has gotten me into more trouble. It romanticizes resistance to unjust laws in a way that leaves the protesters who follow him exposed to far harsher punishment than Thoreau ever faced. He had accomplices in conditioning my occasional civil-disobedience streak: King's Letter from Birmingham Jail, Gandhi's life and writings, Antigone burying the brother Creon had declared a traitor, and Kohlberg's theory of moral development, which crowns postconventional, self-initiated, selfless moral reasoning as the highest stage, all read through the Jewish lifesaving override of pikuach nefesh that so much American legal thought quietly implies. But Thoreau's stakes were low: six years of unpaid poll tax, about $350 in today's money, and one night in jail. And even at those stakes he picked the wrong courtroom: the principled move was to sue first, seeking a civil injunction defending his right to refuse the tax, where the worst outcome is losing, instead of breaking the law and forcing the government to prosecute him in criminal court, where the worst outcome is a cell. Raise the stakes to something like the right to defend yourself against excessive police force, and the cost-benefit of civil disobedience gets much harder to call noble or necessary, however sincere the person making the call. I still admire the book. I just wish someone had handed it to me with a note about the costs, and about the courthouse across the street, so consider this that note.
    The standing rule still holds: bring three, one you loved, one that changed you, one you quit and why, and I'll match them.
  • Shelf 02 News & long-form journalism First, the one that made me. Growing up I read Scientific American cover to cover, every issue, and it left a permanent imprint: the habit of asking how a thing actually works before deciding what I think of it. I don't read it regularly anymore. I don't need to; it's in the wiring, and most of this site is downstream of it.
    The current diet, which, as the partisanship dealbreaker promised, crosses the aisle on purpose: The Economist, The Atlantic, The Wall Street Journal, The New York Times, NPR, Politico, Le Monde (the French needs the practice), Hacker News, TechCrunch, and Electrek.
  • Shelf 03 Podcasts Hidden Brain, Planet Money, Radiolab, This American Life, Science Vs, The Daily, The Journal, Today, Explained, The Ezra Klein Show, and All-In. Mostly heard mid-exercise, while CtrlAltM⏻ve holds my screens hostage, and yes, the news pairs run left and right here too.
  • Shelf 04 Film & TV The time cluster, in which I apparently have a genre: The Time Traveler's Wife, In Time, About Time, Arrival, and TiMER, a rom-com about a countdown clock to your soulmate, which the grandparent clock considers a documentary.
    The rest of the canon: Casablanca, 12 Angry Men, Mr. Smith Goes to Washington, Schindler's List, 12 Years a Slave, The Believer, Nightcrawler, The Big Sick, Inside Out, and Mulan.
    TV: Babylon 5 and Black Mirror.
    Recommendations accepted under the same three-item rule as books.
  • Shelf 05 Music Genuinely not picky: pop, electronic, dance, country, clever hip-hop, R&B, world top-10 (especially French, Israeli, or Spanish), lo-fi, and the Disney-to-Broadway axis of show tunes. The salsa entry stands. Truthfully, podcasts outrank music in my ears; music takes over for exercise, chores that need motor coordination, and the hours when one more podcast would overload the thinking. Which is all to say: you control the aux, happily, forever.
  • Shelf 06 Role models Not lacking here; if anything I have too many. Grouped by what I borrow from each.
    Fed and healed at scale: Norman Borlaug, whose wheat is credited with saving hundreds of millions of lives; Sanduk Ruit, who made cataract surgery cheap enough for the Himalayas and gave sight back by the tens of thousands; Marie Curie, two Nobels and then mobile X-ray trucks she drove to the front herself; Dean Kamen, the insulin pump, the water purifier, and FIRST Robotics; and Muhammad Yunus, who bet that the poor repay their loans and built Grameen Bank on the winnings.
    Built quietly: Fabrice Bellard, who wrote FFmpeg, QEMU, and a working C compiler more or less alone, so that most of the video on the internet passes through his code, and who has never made a fuss about any of it. The engineer I'd most like to build like.
    Money given away well: Warren Buffett, still in the Omaha house, giving the fortune away with the same patience he made it; Chuck Feeney, who gave away nearly everything anonymously and died renting; and MacKenzie Scott, who writes very large checks with no strings and a blog post instead of a gala.
    Betting on social entrepreneurs: Bill Drayton, who coined the term and built Ashoka to find and fund them before anyone else believed the category existed; and Jeff Skoll, eBay's first president, who put the proceeds into the Skoll Foundation for the same people and into Participant Media to tell their stories. Lifesaver Labs is my attempt at being one of the people they bet on.
    Open by default: Lawrence Lessig, who built Creative Commons so that sharing could be legal by design and then turned the same energy on money in politics; and Aaron Swartz, his student, who helped write RSS and build Reddit and Creative Commons as a teenager, fought SOPA, and was prosecuted to death at 26 for downloading academic articles. He is the reason the Thoreau note above exists: the punishment for civil disobedience lands on the follower, not the author.
    Courage in front of the state: Alexei Navalny, who flew home knowing what waited; Golda Meir, Milwaukee schoolteacher to prime minister; Justice Ruth Bader Ginsburg, who argued sex discrimination out of the law one case at a time; Mitt Romney, who voted his conscience against his own party when it cost him, which is the independent streak the Dealbreakers page describes with a Senate seat attached; and Michael Newdow, emergency physician and civil rights attorney, who took the Pledge of Allegiance case to the Supreme Court and argued it himself, the two-career life of action and mind that Who I Am calls the Erasmian ideal.
    Family made on purpose: Angelina Jolie, specifically for how she adopted, across three countries, and built a blended family in public with evident care. Path one on the Family page has a face.
    Closest to home: my mom and dad; William Clayman, my paternal grandfather; Cathy Katz, my elementary science teacher; and Deborah Reis, my high school chemistry teacher. Two of them made a science teacher out of me, and the other three made the rest.
    The list runs longer than this shelf. Bring yours and I'll tell you what I borrow from them too.

Stable Matching, Not Mr. Right

Why I'm not looking for perfection, and why choosing an imperfect real person on purpose is the more romantic position.

Why I'm not looking for perfection. I'm imperfect: divorced, in my forties, opinionated, living with family, and the author of this website. You're imperfect too, and I don't need you to be otherwise. I'm not holding out for a fictional woman optimized on every dimension. If we make each other's lives substantially better, share the values that matter, want each other, and keep choosing each other, I'm prepared to stop looking, and to call that a vow rather than a settlement.

Game theory has a precise, Nobel-recognized definition of a good marriage market outcome: a stable matching, an arrangement where no two people exist who would both rather be with each other than with their current partners. Notice how modest that bar is: stability, rather than everyone finding their soulmate, is what a real market can deliver. And the mathematicians who proved it (Gale and Shapley, with McVitie and Wilson finishing the thought) showed something bracing: the side that makes the offers gets the best stable outcome available to it, and the side that waits gets the worst, though in real markets the gap is often small and being on the scarce side matters more.

Layer on optimal stopping theory (the famous 37% rule) and the search-cost literature, and the conclusion sharpens: past a reasonable exploration phase, continuing to search for "Mr. Right" has negative expected value. Every additional year of searching costs a year of the thing the search was for. I'd rather be the man who committed at 35 than the one still interviewing candidates at 45; the second is running a worse model, not holding a higher standard.

"I evaluated the market honestly, found a stable match, and closed the search forever, on purpose, with my eyes open" is a far stronger vow than "the universe assigned you to me." That's why I find this romantic rather than cold. Fate takes no credit for effort. Choosing does.

So this whole site is me showing you my preference ordering up front (the family plan, the wedding math, the ring policy, all of it) because a stable match is only as good as the preferences people actually reveal, and dealbreakers discovered in year three were preferences hidden in year one.

THE MATHOptimal stopping, with recall: the realistic versions of the 37% rule, and what they say to daters in their 30s and early 40s

Optimal stopping, with recall

The 37% rule is the version everyone quotes. The versions that describe real dating stop earlier, look back, and account for the other person saying no.

The textbook version. In the classic secretary problem, candidates arrive one at a time in random order. You can rank each only against the ones you've already seen, you must accept or reject on the spot, a rejection is permanent, and only the single best candidate counts as a win. The optimal rule is to look at the first 37% (one over e) without committing, then take the first one who beats everyone before. It finds the best candidate about 37% of the time. The pop-culture translation: if you plan to date from 18 to 40, the sampling phase ends at about 26.

Three ways real dating breaks the model, all in the direction of stopping sooner. First, the goal. Nobody needs the single best person alive; you need a great match, and once you score by expected quality instead of win-or-lose, the sampling phase collapses from a third of the pool to something closer to its square root, and the expected rank of your pick stays in the top handful whatever the pool size. Second, information. The textbook assumes you know nothing about the distribution. After your 20s and 30s you know it well, and with a known distribution the rule changes shape entirely: no sampling phase, just a bar that starts high and falls as candidates run out, take the first who clears it, with a much better hit rate. Third, the horizon. With a deadline, the optimal bar falls as the deadline approaches. For anyone with a family plan, the mortality clock on the Family page is that deadline, and a bar that stays fixed while the horizon shrinks is a strategy for searching forever.

Recall changes everything. The cruelest assumption in the textbook is that a rejected candidate is gone. Real life allows lookback: someone you told "not now" may still be available later, with some probability that decays as time passes and other people's proposals arrive. Mathematically, recall with probability p lifts your odds from the 37% floor toward certainty as p rises toward one; with perfect recall you'd simply meet everyone, then choose. Two consequences follow. Exploration gets cheaper, because a pass becomes a deferral rather than a loss. And the way you pass sets p: a clear, kind no with reasons attached keeps the door open, while a ghost welds it shut. That's the hidden function of the Feedback Clause. It's a recall-preservation device, for both of us. The deferred-acceptance algorithm at the heart of stable matching is itself built on lookback: every acceptance is held tentatively rather than made final, and stability emerges precisely because receivers keep the best offer so far while proposers keep looking.

Mutual choice. Secretaries in the textbook always say yes. People don't. Once each offer is accepted only with some probability, the optimal bar drops again: you should offer earlier and to more candidates, because a refused offer costs you a candidate you'd have lost anyway. Run this on both sides at once and you get two-sided search, where everyone carries a threshold and the equilibrium sorts people into bands who accept one another. The top pairs match fast; everyone else's threshold has to fall as their horizon shortens, or they never match at all. The moral is uncomfortable and useful: the market sets what's attainable, and a bar held above your band is a decision to keep searching indefinitely. The lever you actually control is your own acceptability: reveal preferences early, be legible, and be the one who makes offers, since the side that proposes ends up better off than the side that waits.

What this means in your 30s and early 40s. By 30 the sampling phase is over, whether or not you meant it to be. You're in the threshold regime with a shortening horizon, and the strategy that follows has six parts. Set the bar from the distribution you've actually seen, not from an app's mirage of infinite choice. Let the bar fall a notch each year, on purpose, instead of drifting upward. Use recall: take a second look at the near-misses who are still available, and keep your own rejections kind so that others can still look back at you. Propose rather than wait. Move fast once someone clears the bar, because in mutual search delay lowers your acceptance probability with them too, which is what the Budget page's six months are for. And never confuse a stable match with a perfect one. Stable means neither of us would trade. That is achievable. Perfect isn't, and the search for it has a body count measured in years.

The Dating Budget

I won't waste your time, and I won't rush yours. If we're right for each other I'd love to decide on engagement within six months, and if you need twelve or fifteen, that's fine too.

The promise. I'm dating for marriage, not for indefinite companionship, and I won't keep you in limbo while I avoid a decision. If we're right for each other, I'm not afraid of moving quickly: I'd like us to decide on engagement within six months, and I hold myself to about a year. That's my clock, not yours. If you're a great fit who needs twelve or fifteen months to be sure, I'd much rather spend them with you than lose you to a stopwatch; what I'm unwilling to do is drift for years without either of us naming a decision. This follows from the Matching page: if I believe in closing the search deliberately, I should also believe in deciding on purpose. A courtship without any decision date is a question nobody has agreed to answer.

Why everything here is so upfront. This site, and the way I date, is deliberately front-loaded: the family plan, the money, the ring, the living situation, the dealbreakers, all on the table before the first coffee. That isn't impatience. It's the mechanism that makes a short courtship safe. Most secular couples spend their first year or two dilly-dallying around exactly these questions, discovering one layer per anniversary, and the calendar does the work that a conversation could have done in an afternoon. I'd like us to solidify our compatibility quicker than that, not by deciding faster than we're ready, but by having the hard conversations first, so that the time we do spend is spent confirming rather than discovering.

The cap, for the accountants. There's a dollar figure too, because every number on this site lives in one ledger: from our first date I'm budgeting a maximum of $10,000 on the courtship. It's a budget, not a countdown: it says where the money goes, and it stretches across whichever timeline we land on.

What the cap protects. The cap is on limbo, not generosity. Every dollar and month the budget saves rolls forward into the thing it exists to start: the wedding party, the family plan, the 529. I'd rather under-spend the courtship and over-fund the marriage.

What the cap excludes. Relocation rent. I date multicity, across the whole Travel Reach map, and my default housing cost is no rent because of the family-property arrangement. So if a promising match means renting near you for a while, that rent comes out of the housing line, not the dating budget, and the housing line has its own honest ceiling: the rent I'm not paying at home, about $30,000 a year. Counting it here would drain the cap in a few months and quietly shrink the map back to driving distance from Cleveland and Boca, which would defeat the point of Travel Reach. The $10,000 buys dates, flights, and undivided attention; the roof is accounted for on its own ledger.

The inconvenient study. The same Emory study I cite on the Wedding page found that couples who dated under a year before engagement divorced more than couples who dated one to two years, who in turn divorced more than couples who dated three or more, with the effect mostly among men. I'm not hiding that; it's written into Audit 10. My hypothesis, and it is a hypothesis: those averages describe couples who spend year one slowly discovering each other's dealbreakers. This site front-loads mine (family plan, money philosophy, ring policy) before the first coffee, so a year of dating me should carry more information than a year of dating someone who reveals himself one layer per anniversary. And the timeline runs to a proposal, not a wedding: either of us can still walk before the courthouse date, short as that runway is.

The actuarial part. At our stage, with a family plan on the table, calendar time is the scarcest input we have. If a year or fifteen months of undivided attention still can't get either of us to a confident yes, that's the budget doing its job. It's information, and we'll both have paid a fair price for it.

Race me to one knee

Who proposes is the one part of the timeline tradition still hands to the man. I'd like to hand it back.

The feminist part, stated plainly. I am very seriously a feminist, and this whole site is sensitive to the marriage timeline for a reason. So here is the tradition I find crazy and stupid: a woman who knows she's ready is expected to wait, passively and for as long as it takes, while a man decides whether it's time. Add up the years American women have spent in that waiting room over the past decade alone, ready and unasked while a partner slow-walked a decision, and you get a number nobody has bothered to publish. Audit 10 asks your AI to estimate it.

The system I favor. Women should be able to propose to men as easily and as often as men propose to women. In a well-run world the proposals would split at coin-flip rates; today women make perhaps one in twenty to one in fifty, and I'd like the odd thing to become a woman who wanted to propose and didn't. The Matching page's lesson applies by analogy rather than theorem: the people who make offers, in any market, fare better than the ones who wait to receive them.

So, the standing invitation. When you feel ready to propose to me, or you sense I'm ready to propose to you, let's talk about it, out loud, like the other decisions on this site. And when we reach that point, I encourage you to race me to one knee. You don't need to wait months or years for me to produce a traditional ring; the Ring page has already replaced it with a check you allocate, and the Wedding page has the courthouse date. Whoever gets there first gets the story. Either way, the answer is the same.

Why I Live With Family… and Why You Should Too, if You Can

By choice, with a spreadsheet open. The short version here; the $205,000 landlord problem one click down, for anyone who finds compound interest romantic. Some of us do.

The short version. I live on family property, by choice. It lets me spend time with the people I'll one day want at every birthday our kids have, save aggressively instead of paying a landlord, and, because I work remotely, relocate easily for the right relationship: an Airbnb near you first, a furnished rental as things get serious, and a home base that costs nothing the whole time. If our life together needs a home near you, I can and will make one. Privacy, meanwhile, is a hotel problem rather than a lease problem, and the research doesn't favor moving in before engagement anyway.

The second base. I also have family in Cleveland, and I co-own a condo there, so the map has two home bases with no rent on either. At the moment I'm rarely in Ohio: the pool of potential matches is smaller than South Florida's, and I go where the odds are. But the condo is why the Budget page measures driving distance from Cleveland as well as Boca, and why the footer carries two sets of coordinates, one for each base, rounded to a few miles.

SPREADSHEETSThe long version: the $205,000 landlord problem, the privacy plan, the relocation superpower, and the peacock tax

The choice, in numbers. Living on family property saves roughly $2,000 to $2,500 a month against South Florida market rent for a decent one-bedroom, and I consider it the nonstupid choice: a decision I'd defend in front of any spreadsheet.

The compounding. One year of forgone rent is about $30,000. Invested at 8% for the 25 years until my planned retirement, that single year grows to roughly $205,000 in 2051 dollars, roughly $100,000 to $115,000 in today's purchasing power. From one year. Every additional year I don't pay a landlord is another six-figure future gift: inheritance for our kids, support for grandkids, or fuel for whatever we decide retirement means when we get there together. Handing that to a landlord unnecessarily feels to me like extreme waste, one of the largest voluntary wealth transfers most people never notice they're making.

The non-financial half. Living with family is also the most common household type on Earth, home to about 38% of people, and a growing share of America lives that way again. Shared meals, shared support, someone home when things go wrong, time with the people I'll one day want at every birthday our kids have. I keep my family time high and my cash burn low; I struggle to see the loss.

So how do we get privacy? Two cases. If dating you means relocating: I work remote, and I'm genuinely happy to be the one who moves if one of us has to: the radius is 460 miles, but the willingness is unlimited. If you're local: first, only one of us needs a place of our own for privacy to work, and it doesn't have to be me. Second, hotels and Airbnbs are everywhere; unless we need privacy more than about ten nights a month, booking a room whenever we feel like it costs less than a lease. Third, the relationship research doesn't favor early cohabitation anyway: one well-replicated line of work ties moving in together before a real marriage commitment (engagement) to worse marital outcomes, though other demographers find the effect faded in recent cohorts, so the evidence-leaning plan is hotels now, cohabitation at the ring.

The superpower. No lease holds me anywhere, and that converts into a genuine superpower for multicity dating: I can relocate almost instantly, to anywhere in the country, as an Airbnb first and then a furnished rental through FurnishedFinder as we get to know each other and the commitment ratchets up. Most people who date across cities pay double rent to run the experiment; my home base costs no rent the whole time I'm near you. I fully intend to spend this freedom on purpose, remote job in hand, serving as a mail-order boyfriend, then fiancé, then husband, for the right match.

The peacock tax. The strongest argument for me holding an apartment is as a signal: a $30,000-a-year proof that I'm a financially viable adult. But you can read this site; the finances are auditable without the feathers. Unless you want me to maximize my cash burn and my loneliness to prove a point, I'd rather keep building the premarital portfolio that later, at our discretion, pays for the things a long marriage actually wants: a few years living abroad, semi-retirement, early retirement, the kids' emergencies, the grandkids' tuition, or expensive new hobbies (I hear scuba calls to me).

Date Proposals

Candidate first dates, all well within the radius, none requiring a telescope. One requires a farmers market.

A First Weekend, Concretely

Multicity dating sounds abstract until you see the itinerary. Here's what a first visit to your city actually looks like, including the part where I go to work on Friday.

The welcome packet

Onboarding, for a relationship. Sent within the week, updated as we go, and yours to keep whatever happens. A gift, not homework: read what interests you, ignore the rest, and nothing here is due.

After the first weekend: the relocation ladder

If we start in different cities and it makes more sense for me to become local to you, this is the ladder I'd propose to climb. Illustrative, not strict: every rung moves with your comfort.

The proposal. Second and third dates, flown in for. Then a weekly Airbnb in your city, a week or two at a time, so we find out what Tuesdays are like without anyone signing anything. Then a month-to-month furnished apartment through FurnishedFinder, which is where "I'm in town" becomes "I live here." Then, when you're ready and not before, a one-year lease, which becomes our first home if the story goes the way I hope and gets sublet if it doesn't. Engagement, the courthouse, and the big cheap party sit wherever they land; the Home page's evidence-leaning plan is separate addresses until the ring, so moving in together is the last rung, at the ring or the chuppah, our call together.

The chart is a sketch. The bars below are a picture of one plausible year, not a schedule anyone signs. Drag the slider and the whole ladder stretches or compresses to your pace: nine months if we both already know, eighteen or more if you'd rather be sure, and every rung is reversible until the last one. The only thing that doesn't move is the order, because each step is cheaper than the next and I don't take a step you haven't asked for. My remote job and the no-rent home base are what make the ladder affordable; the housing line pays for the rungs.

One known complication. As of September 2026 there's a four-month stretch coming up in which I expect to need to stay in Florida to finish emergency-medical training, the coursework and shifts the welcome packet's calendar already lists. During those months the ladder pauses on the third rung: I can still fly to you for weekends, and you're welcome in Florida any time, but the Airbnb and the apartment in your city wait until the training is done. After that I expect to be free again to consider or begin relocating, and the ladder resumes wherever your comfort left it.

ORDER FIXED, DATES NOT · EVERY RUNG REVERSIBLE UNTIL THE LAST · SLIDE TO YOUR PACE

The Feedback Clause

Why the string of bad dates keeps happening, and a standing offer to break the loop.

The diagnosis. Ask anyone who dates a lot what it feels like and you'll hear the same phrase: a string of bad dates. I'd argue an under-examined cause is that daters give each other almost no usable feedback. Rejections arrive as a fade, a ghost, or a polite "no spark," with no reasons attached. Someone can get turned down five times in a row for oversharing, or undersharing, and never once be told they're misadjusted on it. That's five runs of the same experiment with the results thrown away.

The default contract. Whether I'm buying dinner, you are, or we go Dutch, sharing more than 30 minutes of each other's time should carry one clause by default: afterward, we each tell the other our first impressions, clearly and kindly. Then everyone gets a chance to adapt the things they have the power to change, if they wish to change them. What you do with the notes stays entirely up to you, and so does whether to write any: silence is a legitimate answer, and this is an offer, not an assignment. Mine will follow two rules: behavior over traits, and nothing about your body or appearance.

The engineering view. I build systems for a living, and they improve where a feedback loop closes, provided the feedback is specific, about behavior, and delivered gently; the learning research says a third of feedback interventions backfire, so the how matters. Dating as commonly practiced is what the researchers call a wicked learning environment: the only signal is a delayed yes or no with no reason attached. One date's notes are one noisy sample, and I'd treat them that way; a pattern across several is the signal worth acting on. Without any of it, people repeat the same fixable mistake for years and file it under bad luck. Dating should be one of the most adaptive systems in anyone's life. Let's make it adaptive together.

The standing offer. Accept me or reject me, either is a legitimate outcome. But if you send me two or three paragraphs of clear feedback on how I came across, I will be genuinely delighted, and I'll return the favor with the same care: specific things first, changeable things first, written the way I'd want to receive them.

The date that taught me nothing. I've flown from Florida to another city for a first date and flown home with no usable feedback at all: not a reason, not a hint, a pleasant evening and then silence. The local version is just as common and nearly as expensive: three or four evenings of getting to know each other, the slow trade of stories that a real acquaintance takes, and then nothing, so that all those hours produced no information either of us could use. I paid for the flights, the dinners, and the time gladly, and I'd do it again; the cost isn't the complaint. The complaint is that a system where you can spend that much and learn nothing is wicked in the technical sense: hard to improve in however hard you try, and slow to get anyone through to the thing they actually want, which for me is a marriage and children. So here is what I do about it now. Before a first date, whether it means booking a flight or crossing town, I ask for one agreement: two paragraphs each, afterward, whichever way we lean. You can say no to that, and I'll still come. Without the agreement, though, the first date is coffee or a walk, short and cheap, so that what I spend matches what I can learn; with it, I'll happily fly in and buy dinner. And if you say yes, please mean it, because it is the only thing I'll ask you to bring.

The Second Date Guarantee

Let's give each other a chance to change. A first date is a sample of one, people are adaptive by nature, and asking you out again is, on principle, almost automatic.

The observation. Every first date I've been on, I've walked away with notes: not only about her, but about me. Where I talked when I should have asked. Where I explained something for fun and she wanted to be flirted with instead. Where I was reserved because I was being careful, and careful read as cool. Humans adapt; it's the one thing we're reliably good at. But the adaptation needs a second data point, and dating as usually practiced ends the experiment after the first.

The silent elimination. Most of the time, when someone I liked decides against me, I never learn why. It's entirely possible she was on the fence about one specific thing, and that if she had said it out loud, "you didn't seem that into me," "you were interesting but not much fun," we could have worked the compatibility problem out together in the first ten minutes of the next date. Instead the fence becomes a wall, and neither of us finds out whether it would have held. The Feedback Clause is my standing answer to that; this page is its cousin.

The guarantee. Unless a dealbreaker walks in the door, I will ask you out again, because I'd like us each to get a chance to change. Not as a courtesy, and not because I'm undiscriminating, but on principle: I don't think a first date carries enough information to pass on someone promising. You might have had an off day. I might have. Our first crack at some topic that matters to both of us might deserve a second bite at the apple, the kind that changes my mind, or yours, as we adapt to each other. So I almost never decide against someone after one evening, and I'd rather have two dates with everyone who seemed promising than one date with everyone who seemed perfect.

The pivot menu. This is the useful part. If something about date one left you on the fence, tell me what, and watch it change. Not funny enough? I'll spend the next evening making you laugh instead of making you think. Not flirty enough? I'll tell you, out loud and in plain words, how attracted I am to you, instead of being reserved about it. Too much of the laboratory and not enough of the man? I'll leave the spreadsheets at home. Talked too much? I'll ask more and answer less. None of this is pretending to be someone else; it's choosing which of my real settings to run, which is what everyone does for the people they like, only usually by guessing. I'd rather be told.

The same slack, in your direction. I cut you exactly the slack I'm asking for. If you were nervous, or tired, or the restaurant was loud, or you led with the story that comes out wrong the first time, I don't score it. Two dates before I pass on anyone who seemed promising, as a rule, and if I do lean away, you'll hear the reason from me, kindly and specifically, the way the Feedback Clause promises.

What it isn't. It isn't a claim on your evening. You don't owe me a second date, and a plain no after one is a complete answer that I'll accept with grace. It isn't pressure either: if anything about the first date felt off to you, in any way, you owe me neither a second date nor an explanation. And it isn't unconditional. Unkindness to a server, contempt, or a dealbreaker ends it at one, as it should. The guarantee is narrower than that and, I think, more useful: if you liked me but something was in the way, say the thing, and let's see whether it moves. And if you'd rather not go again, the two paragraphs we agreed on before the first date are all I'll ask for; the Feedback Clause explains why they matter more to me than the second date does.

Date Locket

An optional way to keep our first date, for the two of us and, someday, for our kids. Easy to say no to; this page exists so that asking isn't awkward.

The wish. I would love to have the first date with my future wife recorded, so that one day we can show our children some of it: the first hello, whatever we laughed at, the moment one of us leaned in. Every couple tells their kids the story of how they met. Ours could have footage. (And since I'm a licensed drone pilot, if we ever want the first kiss itself on film from an angle nobody else's has, that can be arranged too, on the same terms as everything else here: only if you want it.) A growing share of first dates now happen on a video call, where the whole thing passes through a camera anyway and then evaporates. Date Locket is the idea that it doesn't have to.

How it would work. Both of us say yes, on the record, at the start. The recording is encrypted the moment it's captured, and the key is split in two: one half lives on your phone, one on mine. Nothing can be watched unless we both unlock it together, at the same time, each of us saying yes again. No company, no server, no me alone can open it. Either of us can delete it at will, any time, without asking the other, and deletion is permanent. And there's a cooling-off period built into the key itself: for the first thirty days after the date, nothing can be opened by anyone, not even by both of us together. After that, it opens only with both of us, and only ever with both of us. Audio-only is a choice, and either of us can switch the camera off mid-date while the other keeps talking. It's a locket: two people, two halves, nothing inside without both.

What recording does to a date. People behave differently when they know they're being recorded. They stay a little more composed, get a little less vulnerable, and save some things for when the camera's off. If that's what you'd fear, I understand completely and we go without. But if you're comfortable archiving our first date warts and all, the awkward pauses included, I think it would make an incredible time capsule if we go the distance to engagement, let alone to marriage and kids. The version of us that hadn't met yet, kept.

It doesn't exist yet. I designed it and never built it. If you want to try it, tell me, and I'll build it before we meet; the design is done. If you'd rather not, say so or say nothing, and our first date or two get lost to the imprecision of recalled memory, the way it's been done for millennia before us. That's a perfectly good outcome. Honestly, nothing about this page is a test, and a no here costs you nothing with me.

Released to the commons. I drafted a patent application for this design and decided not to file it. The claims aren't broad enough to be worth defending, and I'm not sure it would ever be profitable. So instead of a patent, the full provisional application is published below, on this page, dated 2026-09-02 and timestamped in this site's public commit log, as a disclosure of prior art. Nobody can patent this exact thing now, and as much of the conception as the law allows becomes part of the commons. To the extent I hold any copyright in the text below, I dedicate it to the public domain under CC0 1.0. Build it, improve it, use it for your own first date. One caution if you do: don't rely on me alone for your freedom to operate. These claims and this prior-art research never went through examination, and I'm not a lawyer, just a former patent attorney clerk and a curious, experienced inventor. Publishing here stops anyone from patenting this exact design after today; it doesn't clear whatever was patented before. Check the patent literature yourself, or hire a patent attorney, before you build what's described.

One embodiment I'll never build. The filing includes an intimate-encounter embodiment, a version of the same locket for adult partners recording something private, with age assurance on both sides and destruction rules that neither party can waive. I have no interest in building it or ever using it. It's in the disclosure because the architecture happens to fit, and because some couples could genuinely benefit from a recording that neither of them, and no company, can ever open alone. That's for someone else to build, and in fact someone nearly has: Rumuki, a side project from about 2017, paired two phones so that an intimate recording could be played only when each partner's device granted it, with either partner able to delete it alone. It is architecturally a cousin of Date Locket in a far more sensitive domain, it never found paying users, and it's cited as prior art in the filing below. What I'd build, and the only thing I'd ever ask you to try, is the first-date version above.

FILINGThe provisional application, in full: System and Method for Mutual-Consent Conditional Access to an Encrypted Recording of an Interpersonal Encounter

PROVISIONAL PATENT APPLICATION

Under 35 U.S.C. § 111(b)

Title of the Invention

SYSTEM AND METHOD FOR MUTUAL-CONSENT CONDITIONAL ACCESS TO AN ENCRYPTED RECORDING OF AN INTERPERSONAL ENCOUNTER, WITH TIME-LOCKED RELEASE, JOINT REDACTION, AND UNILATERAL CRYPTOGRAPHIC DESTRUCTION

Inventor: David Clayman, Boca Raton, Florida, United States

Filing note: This specification is intended to be accompanied by USPTO form SB/16 (Provisional Application for Patent Cover Sheet) and the applicable filing fee. Claims are not required in a provisional application; the claims herein are included as part of the disclosure to support the full scope of a later nonprovisional application.

Statement Regarding Federally Sponsored Research or Development

[0001] Not applicable.

Field of the Invention

[0002] The present disclosure relates generally to cryptographic access control for recorded media, and more particularly to systems and methods in which a recording of an interpersonal encounter between two or more participants is encrypted at capture and rendered accessible only upon the contemporaneous, verified, mutual consent of the participants, subject to a time-lock condition, with provision for jointly authorized redaction by cryptographic erasure and for unilateral, irreversible destruction of the recording by any single participant.

Background

[0003] Interpersonal encounters conducted over video communication platforms, and interpersonal encounters recorded by personal devices generally, may be recorded for later sentimental, evidentiary, or commemorative use. Conventional recording systems place the resulting media file under the control of a single party — typically the meeting host, the platform operator, or the device owner. Such unilateral control is poorly suited to intimate or sensitive encounters, in which each participant has a legitimate and continuing interest in whether, when, and by whom the recording may ever be viewed.

[0004] Known access-control approaches for recorded content, including conventional digital rights management and conventional server-side permission systems, share a common deficiency: a single custodian (the platform, the host, or a rights holder) retains the technical ability to decrypt or disclose the content without the concurrence of all recorded participants. Such systems also generally lack any mechanism by which the recorded participants may jointly and permanently excise portions of the recording, or by which any single participant may permanently and verifiably destroy the recording notwithstanding the objection of the other participant or of the custodian. A need therefore exists for a recording architecture in which access is technically impossible — not merely administratively prohibited — absent the verified mutual consent of the recorded participants, and in which destruction rights are asymmetric to access rights: access requires unanimity, while destruction may be effected unilaterally.

Summary of the Invention

[0005] In one aspect, a system captures a recording of an encounter between a first participant and a second participant, the recording comprising audio, video, or both, each participant providing recorded affirmative consent at the commencement of capture. The recording is encrypted substantially at capture under an ephemeral content key. The content key is divided under a threshold secret-sharing scheme into a plurality of key shares, including at least a first share delivered to and held exclusively in a protected keystore of the first participant's device, a second share delivered to and held exclusively in a protected keystore of the second participant's device, and a third share retained by a policy server subject to a release policy. The assembled content key is then destroyed, such that no single entity — including the operator of the system — possesses sufficient key material to decrypt the recording.

[0006] In another aspect, the release policy of the policy server conditions release of the server-held share upon at least: (a) expiration of a predetermined time-lock interval measured from the time of capture; (b) receipt of fresh, cryptographically signed mutual attestations from both participants, generated within a validity window, affirming each participant's present consent to decryption; and (c) verification of the contemporaneous co-presence and liveness of both participants at the time of the unlock request. Decryption occurs within a session-bound protected environment, and playback may be forensically watermarked with session identifiers.

[0007] In another aspect, during a joint decryption session, the participants may jointly designate one or more segments of the recording for redaction. The system generates a redacted copy omitting the designated segments, encrypts the redacted copy under a new content key that is re-split and re-distributed as above, and thereafter effects cryptographic erasure of the original recording by destroying all shares of the original content key, rendering the original ciphertext permanently unrecoverable.

[0008] In another aspect, either participant may at any time, unilaterally and without the concurrence of the other participant or of the system operator, direct the verified destruction of that participant's own key share, thereby rendering the recording permanently undecryptable by all parties. This asymmetry — unanimous consent required for access, unilateral action sufficient for destruction — is a defining property of the disclosed architecture.

[0009] Further aspects include: capture embodiments for both platform-hosted virtual encounters and co-located in-person encounters recorded by a participant device; client-side encryption embodiments in which plaintext media never transits operator infrastructure; participant-selectable storage modes in which the ciphertext resides exclusively on the participant devices under an additional device-bound storage wrapping, or on operator infrastructure under an additional participant-derived envelope encryption that the operator cannot decrypt, or both, with identical access-control guarantees in every mode; generalization to N participants under a T-of-N threshold in which T includes all recorded participants plus a policy share; hardware-protected embodiments in which shares are sealed in secure enclaves, trusted execution environments, or hardware security modules; and audit-log embodiments in which every consent event, attestation, unlock, redaction, and destruction is recorded in an append-only, tamper-evident log available to both participants.

Brief Description of the Drawings

[0010] FIG. 1 is a block diagram of a system architecture (100) according to an embodiment, showing participant devices (110, 120), a session service and media capture component (130), an encryption engine (140), an encrypted recording store (150) which, as described below, may reside on operator infrastructure, on the participant devices, or both, a policy server (160), and an audit log (170).

[0011] FIG. 2 is a block diagram of key generation and threshold distribution (200) according to an embodiment, showing generation of an ephemeral content key (210), a two-of-three threshold split (220), distribution of shares to a first participant device keystore (230), a second participant device keystore (240), and a policy server (250), and destruction of the assembled key (260).

[0012] FIG. 3 is a flow diagram of a conditional joint unlock ceremony (300) according to an embodiment, showing an unlock request (310), a time-lock check (320), fresh mutual attestation (330), co-presence and liveness verification (340), conditional release of the server share (350), reconstruction of the content key in a protected session (360), and session-bound decryption with watermarked playback (370).

[0013] FIG. 4 is a flow diagram of joint redaction and cryptographic erasure (400) according to an embodiment, showing a joint decryption session (410), joint designation of segments for redaction (420), production of a re-encrypted redacted copy (430), re-splitting of the new key (440), destruction of all shares of the original key (450), resulting unrecoverability of the original ciphertext (460), and the unilateral destruction pathway (470).

Detailed Description

1. Overview and Definitions

[0014] The following description sets forth specific embodiments to provide a thorough understanding of the invention. The invention may be practiced without one or more of the specific details described, and features of different embodiments may be combined. As used herein, an “encounter” includes without limitation a first romantic date, a subsequent date, a conversation, a ceremony (such as an exchange of vows), a mediation, an intimate or private encounter between adult partners, or any other interpersonal interaction the participants elect to record; a “participant” is a natural person recorded during the encounter; “cryptographic erasure” means rendering ciphertext permanently unrecoverable by verified destruction of all key material necessary for its decryption; and a “protected keystore” includes an operating-system keystore, a secure enclave, a trusted execution environment (TEE), a hardware security module (HSM), or functionally equivalent hardware- or software-protected storage. “Media” and “recording” mean audio alone, video alone, audio and video together, or any of the foregoing together with derived artifacts such as a transcript, and nothing herein requires the capture of video; every capture, encryption, key-management, storage, unlock, redaction, and destruction operation described herein applies identically to audio-only recordings.

2. System Architecture (FIG. 1)

[0015] Referring to FIG. 1, system 100 comprises a first participant device 110 and a second participant device 120, each running a client application; a session service 130 that hosts or joins the encounter and captures the media streams; an encryption engine 140 that encrypts captured media substantially at capture; an encrypted recording store 150 that persists only ciphertext; a policy server 160 that holds a policy-controlled key share and evaluates a release policy; and an append-only audit log 170. In a preferred embodiment the session service 130 is a real-time communication service operated by the system (for example, a WebRTC selective forwarding unit or an embeddable video SDK), so that raw media never transits a third-party recording pipeline. In alternative embodiments the session service 130 receives media streams from a third-party conferencing platform through that platform's real-time media interface, subject to the platform's participant-consent mechanisms, or receives media from a camera and microphone of a participant device recording a co-located, in-person encounter.

[0016] At the commencement of capture, each participant provides an affirmative, on-the-record consent to recording, which is captured both as recorded media and as a cryptographically signed consent artifact bound to the participant's enrolled identity key. Capture does not proceed absent both consent artifacts. In embodiments directed to intimate encounters between adult partners, enrollment further comprises verification that each participant is an adult, performed by one or more of: verification against a government-issued identity document, a device- or platform-attested age signal, or a third-party age-assurance service; the verification result, but not the underlying identity document or biometric data, is bound to the participant's identity key as a signed age-assurance artifact, and capture of an encounter designated as intimate does not proceed absent a valid age-assurance artifact for every participant. Each consent artifact, each age-assurance artifact, and every subsequent lifecycle event described herein, is written to audit log 170 in an append-only, hash-chained structure such that neither participant nor the operator can retroactively alter the event history without detection.

3. Encryption at Capture and Segmentation

[0017] Encryption engine 140 encrypts the media stream substantially contemporaneously with capture using an authenticated encryption scheme. In a preferred embodiment, the stream is divided into time-indexed segments (for example, segments of between one and thirty seconds), and each segment i is encrypted under a per-segment key K_i derived from an ephemeral master content key K by a key-derivation function (for example, HKDF with the segment index and a per-recording salt as context). Per-segment keying supports the segment-level redaction described below, because destruction of the key material for a designated segment renders that segment alone unrecoverable. In a preferred embodiment the authenticated cipher is AES-256-GCM or XChaCha20-Poly1305; associated data for each segment binds the segment to the recording identifier, segment index, and participant identity keys, so that segments cannot be reordered, substituted, or transplanted between recordings without detection.

[0018] Plaintext media is held only transiently in volatile memory of the capture path and is never written to durable storage. In server-side capture embodiments, encryption engine 140 operates on the capture server, preferably within a trusted execution environment. In client-side capture embodiments, the encryption engine operates within the client application of each participant device, media is exchanged peer-to-peer or captured locally (as in the in-person embodiment), and plaintext media never transits or resides on operator infrastructure in any form.

[0019] The storage location of the ciphertext is selectable by the joint election of the participants at capture, and is orthogonal to the access-control architecture described herein: in every storage mode, decryption requires reconstruction of the content key from the jointly necessary participant shares together with the policy-governed server share, so that the mutual-consent, time-lock, redaction, and unilateral-destruction guarantees are identical regardless of where the ciphertext resides. In a device-resident storage mode, the ciphertext is stored exclusively on the participant devices, preferably as a replica on each participant device for redundancy against device loss, and each local replica is additionally wrapped under a storage key bound to the respective device's protected keystore, such that the recording is protected by at least two independently held protections (the split content key and the device-bound storage wrapping) and the operator at no time possesses the ciphertext. In an operator-hosted storage mode, the ciphertext is stored in encrypted recording store 150, which may be commodity object storage, protected by at least three independently held protections: (i) the content encryption under the split content key; (ii) an outer envelope encryption of the stored object under a storage envelope key derived jointly from key material of both participant devices and not held by the operator, such that the operator cannot decrypt even the outer envelope of the object it stores; and (iii) sealing of the server share within the hardware security module or trusted execution environment of the policy server. In a hybrid storage mode, replicas are maintained both on the participant devices and in the operator-hosted store, with the operator-hosted replica protected as in the operator-hosted mode. The participants' storage-mode election, and any subsequent jointly authorized migration between storage modes, is recorded in audit log 170; migration to or from the operator-hosted store transfers only ciphertext and never requires or effects reconstruction of the content key.

4. Key Splitting and Distribution (FIG. 2)

[0020] Referring to FIG. 2, upon completion of capture (or progressively during capture), master content key K (210) is divided (220) under a threshold secret-sharing scheme into shares such that a defined quorum is necessary and sufficient to reconstruct K. In a preferred two-participant embodiment, a two-of-three arrangement is used in a specific configuration: share S1 (230) is encrypted to a device public key of the first participant and stored in the first participant's protected keystore; share S2 (240) is likewise held by the second participant; and share S3 (250) is held by policy server 160, preferably sealed within an HSM or TEE. Critically, the reconstruction policy is configured so that the participant shares S1 and S2 are jointly necessary: reconstruction requires S1 and S2 together with S3, or, in an alternative embodiment tolerating device loss, requires both participants' authenticated approval before S3 may substitute for a lost participant share through an escrowed recovery share released only upon both participants' fresh attestations. In all embodiments, no single entity — participant or operator — holds material sufficient to reconstruct K. After distribution, every assembled or intermediate copy of K is destroyed (260) by overwriting in memory.

[0021] Suitable secret-sharing constructions include Shamir secret sharing over a finite field, additive (XOR) splitting for the strictly-unanimous case, and verifiable secret sharing in which each share carries a commitment enabling any party to verify share integrity without revealing the share. Participant identity keys are asymmetric key pairs (for example, Ed25519 for signatures and X25519 for key agreement) generated on-device at enrollment, with private keys non-exportable from the protected keystore where the platform so permits.

5. Release Policy and Time-Lock

[0022] Policy server 160 associates share S3 with a machine-evaluable release policy established at capture and signed by both participants. The release policy comprises at least: (a) a time-lock condition prohibiting release of S3 before a time t₀ + Δ, where t₀ is the capture time and Δ is a predetermined interval (in one embodiment, thirty days; in another, one year, such that the first permissible viewing coincides with an anniversary of the encounter); (b) a mutual-attestation condition requiring fresh, signed attestations from both participants, each generated within a bounded validity window (for example, ten minutes) preceding the unlock request, affirming present consent to decryption; and (c) a co-presence condition as described below. In an embodiment, the policy further comprises a relationship-status condition in which each attestation includes an affirmation that the participants remain in a continuing relationship, the truthfulness of which is committed to by signature of each participant. The policy is immutable after capture except by a jointly signed amendment, and every evaluation of the policy is written to audit log 170.

[0023] In a hardened embodiment, S3 is sealed such that the policy evaluation itself occurs inside a TEE or HSM whose attested code enforces the time-lock, so that even the operator cannot release S3 early. In a further embodiment, the time-lock is additionally or alternatively enforced by timed-release cryptography, including encryption of S3 to a time-lock encryption service or construction whose decryption capability does not exist before the release time, thereby removing the operator's early-release capability entirely.

6. Joint Unlock Ceremony, Co-Presence, and Liveness (FIG. 3)

[0024] Referring to FIG. 3, decryption is initiated only by a joint unlock request (310) originating from both participants. The policy server verifies the time-lock (320) and the fresh mutual attestations (330). Co-presence and liveness verification (340) then establishes that both participants are contemporaneously present and are live human beings rather than recorded or synthetic imagery. In a preferred embodiment, verification is performed on-device: each participant device performs a biometric liveness check using the device's native biometric framework (for example, a platform face-authentication service backed by a secure enclave), such that no biometric template or image is transmitted to or retained by the operator; the device then emits a signed presence assertion. In a co-located embodiment, co-presence is additionally corroborated by proximity signals between the two participant devices, including Bluetooth Low Energy ranging, ultra-wideband ranging, or exchange of an acoustic or visual nonce (for example, one device displaying a short-lived code captured by the other device's camera). In a remote embodiment, both participants join a live verification video session and each device attests to the liveness of its own enrolled participant.

[0025] Upon satisfaction of all conditions, policy server 160 releases S3 into the unlock session (350). Key reconstruction (360) occurs within a protected environment — in one embodiment within a TEE of one participant device; in another, within a server-side confidential-computing enclave whose attested code performs decryption and streaming without exposing K or plaintext to the operator's general infrastructure. Playback (370) is session-bound: reconstructed key material exists only for the duration of the session, is destroyed at session end, and each subsequent viewing requires a new ceremony. Playback may be marked with a forensic watermark encoding the session identifier, viewing time, and participant identities, so that any out-of-band capture of the displayed content is attributable. The system does not represent that display-layer capture (for example, photographing a screen) is preventable; the security objective enforced cryptographically is that the ciphertext is undecryptable absent the ceremony.

7. Joint Redaction by Cryptographic Erasure (FIG. 4)

[0026] Referring to FIG. 4, during an active joint decryption session (410) the participants may review the recording and jointly designate segments for redaction (420), each designation requiring confirmation input from both participants. The system then produces a redacted copy omitting the designated segments (430), encrypts the redacted copy under a new master key K′ with fresh per-segment keys, and re-splits and redistributes K′ as new shares S1′, S2′, S3′ (440) in the same configuration as at capture. Thereafter the system effects cryptographic erasure of the original: each participant device destroys its original share and returns a signed destruction receipt, and the policy server destroys S3 within its HSM or TEE and emits an attested destruction receipt (450), rendering the original ciphertext permanently unrecoverable (460). In a per-segment variant, redaction is effected without producing a full copy, by destroying only the per-segment key material of the designated segments in all shares, which is more efficient for long recordings. All redaction events, including the identity of the designated time ranges but not their content, are written to audit log 170.

8. Unilateral Cryptographic Destruction

[0027] At any time, before or after the time-lock has expired, either participant may unilaterally direct destruction of the recording (470) by destroying that participant's own key share and issuing a signed destruction directive. Because the participant shares are jointly necessary under the reconstruction policy described above with reference to FIG. 2, destruction of either share alone renders K permanently unreconstructable by every party, including the other participant and the operator. Upon receiving a destruction directive, the system additionally destroys S3 and instructs the counterpart device to destroy its share, and deletes the ciphertext from store 150; however, the security guarantee does not depend on these additional deletions, because the directive-issuer's share destruction is alone sufficient. The operator is technically incapable of overriding, delaying, or reversing a unilateral destruction. This property is intended, among other purposes, to eliminate the possibility of the recording's use as an instrument of coercion following the end of the participants' relationship.

9. Alternative Embodiments and Variations

[0028] The following variations are within the scope of this disclosure, alone and in combination. (a) N-party embodiments: the encounter includes N participants and K is split such that all N participant shares plus the policy share are required, supporting group encounters, ceremonies with witnesses, or family events. (b) In-person capture: the encounter is co-located and recorded by a camera of one or both participant devices or a dedicated capture device, with both-party consent artifacts collected at commencement exactly as in the virtual embodiment. (c) Capture-mode embodiments: the participants jointly elect the capture mode at the consent phase — audio-only, video-only, or audio and video — and the elected mode is recorded in the signed consent artifacts and the audit log; audio-only capture may be elected by participants who consent to an audio record but not a visual record of the encounter. In a further embodiment, during capture either participant may unilaterally downgrade the capture mode (for example, terminating video capture while audio capture continues) or terminate capture entirely, without the concurrence of the other participant; a downgrade or termination takes effect immediately, is recorded in the audit log, and does not affect the encryption or key management of media already captured. (d) Third-party-platform embodiments in which media is obtained through a conferencing platform's real-time media interface with in-platform consent, then encrypted and key-split by the system as described. (e) Escrowed-recovery embodiments in which a recovery share is held encrypted such that it can be activated only by fresh joint attestation of both participants, tolerating loss of a participant device without weakening the unanimity requirement. (f) Anniversary-scheduling embodiments in which the release policy exposes to the participants a countdown but not the content. (g) Estate embodiments in which the participants may jointly pre-authorize, by signed policy amendment, release of the recording to a named beneficiary upon proof of death of both participants. (h) Embodiments in which the encounter is a commitment ceremony, an exchange of wedding vows, a proposal, or a message recorded jointly for the participants' future children, with the same lifecycle. (i) Deployment of the policy server function across multiple independent operators each holding a sub-share of S3, so that no single operator can collude with one participant. (j) Intimate-encounter embodiments: the encounter is an intimate or private encounter between adult partners, designated as such by both participants at capture; in such embodiments, capture is conditioned on a valid age-assurance artifact for every participant as described above, the release policy defaults to requiring co-presence verification for every playback, and the unilateral destruction capability of any participant is non-waivable and may not be disabled by policy amendment. These embodiments are directed to the technical problem that recordings of intimate encounters, consensually created, are conventionally protected only by the continuing goodwill of each custodian, and to providing a technical architecture under which such a recording cannot be viewed, copied, or disclosed by either participant acting alone or by the operator, and can be permanently extinguished by either participant acting alone.

10. Implementation Details of a Preferred Embodiment

[0029] In a preferred embodiment: participant client applications run on iOS, Android, macOS, and the web; identity keys are generated in the platform secure enclave or strongest available keystore; real-time capture uses a WebRTC media server operated by the system with end-to-end-encrypted transport; segments are 10 seconds; per-segment keys are derived by HKDF-SHA-256 from K; segment encryption is XChaCha20-Poly1305; K is 256 bits generated by a cryptographically secure random number generator on the capture server within a TEE; splitting uses Shamir secret sharing over GF(2⁸) with verifiable commitments; shares to participants are encrypted with X25519-based hybrid public-key encryption to each device key; S3 is sealed in a cloud HSM with a policy document evaluated inside an attested confidential-computing enclave; attestations are Ed25519 signatures over a canonical structure containing recording identifier, purpose, timestamp, and nonce; liveness uses the device-native biometric framework with no biometric data leaving the device; co-presence for co-located unlock uses BLE ranging plus a camera-captured visual nonce; the audit log is a hash chain anchored periodically to an external transparency log; and forensic watermarking is applied in the playback path within the enclave.

[0030] The disclosed architecture improves the functioning of the underlying computing system and does not merely implement an agreement between the parties on generic hardware: it provides a specific technical mechanism — jointly necessary key shares, hardware-sealed policy shares, attestation-gated reconstruction inside protected execution environments, per-segment keying enabling selective cryptographic erasure, and receipt-verified share destruction — by which confidentiality and destruction guarantees are enforced against every party to the system, including its own operator, a property that conventional access-control and rights-management architectures do not provide.

Claims

(Included as disclosure; not required in a provisional application.) What is claimed is:

1. A computer-implemented method for controlling access to a recording of an encounter between at least a first participant and a second participant, the method comprising: receiving, from each of the first participant and the second participant, a recorded affirmative consent to recording and a cryptographically signed consent artifact; capturing media of the encounter; encrypting the media substantially at capture under a content key to produce a ciphertext; dividing the content key under a threshold secret-sharing scheme into a plurality of shares comprising at least a first share, a second share, and a third share, wherein the threshold secret-sharing scheme is configured such that the first share and the second share are jointly necessary for reconstruction of the content key; delivering the first share exclusively to a protected keystore of a first device associated with the first participant; delivering the second share exclusively to a protected keystore of a second device associated with the second participant; retaining the third share at a policy server subject to a release policy; destroying all assembled copies of the content key such that no single entity possesses key material sufficient to decrypt the ciphertext; and releasing the third share for reconstruction of the content key only upon determining that the release policy is satisfied, wherein the release policy requires at least: expiration of a predetermined time interval measured from capture of the media, and receipt of a first cryptographically signed attestation of present consent from the first participant and a second cryptographically signed attestation of present consent from the second participant, each attestation generated within a predetermined validity window preceding an unlock request.

2. The method of claim 1, wherein the release policy further requires verification, at a time of the unlock request, of contemporaneous co-presence and liveness of the first participant and the second participant.

3. The method of claim 2, wherein the verification of liveness comprises an on-device biometric liveness determination performed at each of the first device and the second device, and wherein biometric data of the determination is not transmitted from the respective device.

4. The method of claim 2, wherein the verification of co-presence comprises at least one of: wireless proximity ranging between the first device and the second device, and capture by one of the first device and the second device of a short-lived nonce presented by the other of the first device and the second device.

5. The method of claim 1, further comprising, during a joint decryption session authorized under the release policy: receiving, from both the first participant and the second participant, a joint designation of at least one segment of the recording for redaction; producing a redacted copy of the recording omitting the at least one designated segment; encrypting the redacted copy under a new content key; dividing and distributing the new content key in accordance with the dividing, delivering, and retaining steps of claim 1; and thereafter effecting cryptographic erasure of the recording by verified destruction of all shares of the content key.

6. The method of claim 1, wherein encrypting the media comprises encrypting the media as a plurality of time-indexed segments under respective per-segment keys derived from the content key, and further comprising redacting a designated segment by destruction of key material of the designated segment without re-encryption of undesignated segments.

7. The method of claim 1, further comprising: receiving, from either one of the first participant and the second participant, unilaterally and without concurrence of the other participant or of an operator of the policy server, a signed destruction directive; and destroying, responsive to the destruction directive, the key share held for the directing participant, whereby the content key is rendered permanently unreconstructable by all parties including the operator of the policy server.

8. The method of claim 1, wherein reconstruction of the content key and decryption of the ciphertext occur only within an attested trusted execution environment, wherein reconstructed key material is destroyed upon termination of each playback session, and wherein each playback session requires a separate satisfaction of the release policy.

9. The method of claim 8, further comprising applying to decrypted media, during playback, a forensic watermark encoding at least a session identifier of the playback session.

10. The method of claim 1, wherein each attestation further comprises an affirmation that a relationship between the first participant and the second participant is continuing.

11. The method of claim 1, further comprising recording each consent artifact, each evaluation of the release policy, each release of the third share, each redaction designation, and each destruction receipt in an append-only, hash-chained audit log accessible to the first participant and the second participant.

12. The method of claim 1, wherein the encounter comprises a romantic date conducted over a video communication session, and wherein the predetermined time interval is at least thirty days.

13. The method of claim 1, wherein the encounter is co-located and the media is captured by a camera and a microphone of at least one of the first device and the second device.

14. The method of claim 1, wherein the encounter comprises N participants, N being greater than two, wherein the content key is divided such that a respective participant share delivered to each of the N participants is jointly necessary with every other participant share for reconstruction of the content key.

15. The method of claim 1, further comprising retaining an escrowed recovery share activatable, upon loss of the first share or the second share, only upon receipt of fresh cryptographically signed attestations from both the first participant and the second participant.

16. A system for controlling access to a recording of an encounter between at least a first participant and a second participant, the system comprising: a session capture service configured to capture media of the encounter following receipt from each participant of a recorded affirmative consent and a cryptographically signed consent artifact; an encryption engine configured to encrypt the media substantially at capture under a content key and to divide the content key under a threshold secret-sharing scheme into at least a first share and a second share that are jointly necessary for reconstruction of the content key and a third share, and to destroy all assembled copies of the content key; a media store configured to persist only ciphertext of the recording; client applications configured to hold the first share exclusively in a protected keystore of a first device of the first participant and the second share exclusively in a protected keystore of a second device of the second participant; and a policy server configured to retain the third share subject to a release policy and to release the third share only upon at least expiration of a predetermined time interval measured from capture and receipt of cryptographically signed attestations of present consent from both the first participant and the second participant, each attestation generated within a predetermined validity window.

17. The system of claim 16, wherein the policy server comprises a hardware security module or an attested trusted execution environment within which the third share is sealed and within which the release policy is evaluated, such that an operator of the system is incapable of releasing the third share in violation of the release policy.

18. The system of claim 16, wherein the system is configured to receive from either participant, unilaterally, a signed destruction directive and to destroy the directing participant's share responsive thereto, whereby the content key is rendered permanently unreconstructable by all parties including an operator of the system, and to issue a cryptographically verifiable destruction receipt.

19. The system of claim 16, wherein the client applications and the policy server are further configured to conduct a joint redaction session in which segments jointly designated by both participants are omitted from a re-encrypted redacted copy and the content key of the original recording is destroyed by verified destruction of all of its shares.

20. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a computing system, cause the computing system to perform operations comprising: receiving, from each of a first participant and a second participant to an encounter, a recorded affirmative consent to recording and a cryptographically signed consent artifact; encrypting media of the encounter substantially at capture under a content key; dividing the content key under a threshold secret-sharing scheme into at least a first share and a second share that are jointly necessary for reconstruction of the content key and a third share; causing the first share to be held exclusively in a protected keystore of a device of the first participant and the second share to be held exclusively in a protected keystore of a device of the second participant; retaining the third share subject to a release policy; destroying all assembled copies of the content key; and releasing the third share only upon at least expiration of a predetermined time interval measured from capture and receipt of cryptographically signed attestations of present consent from both participants, each attestation generated within a predetermined validity window.

Abstract

A recording of an interpersonal encounter is encrypted at capture under an ephemeral content key that is split into shares held separately by each participant's device and by a policy server, with all participant shares jointly necessary for reconstruction. The server share is released only after a time-lock interval and upon fresh signed mutual attestations and verified co-presence and liveness of both participants, with decryption confined to session-bound protected environments and watermarked playback. Participants may jointly redact segments, whereupon a re-encrypted redacted copy replaces the original and the original is destroyed by cryptographic erasure. Either participant may unilaterally and irreversibly destroy the recording by destroying that participant's own share, a capability no operator can override. Access thus requires unanimity while destruction requires only one party, providing technically enforced privacy for sensitive recordings.

Drawings

Four figures (system architecture, key splitting, the joint unlock ceremony, and joint redaction) accompanied the filing draft and are omitted here; the text references to FIG. 1 through FIG. 4 are retained.

Safeword

The intimacy chapter, and the app I built for it: everything after a first kiss and before anything more.

What it is. I built a mobile app called Safeword (patented, US 12,347,301): consent technology for the conversation most couples improvise or skip. It walks two people through everything worth covering after a first kiss and before more intimacy: birth control at the five-nines level (99.999% preventative), STI testing and sharing the results, the carrier-screening results the Family page offers, personalized ground rules, and literal safewords, backed by check-ins, end-to-end encryption, and an optional private bystander feature that honors and sometimes amplifies signals, enthusiastic or the opposite, the moment they're spoken.

The offer. If we kiss, I'll share the app with you, and we run through it together before we get any further than first base. Think of it as the Feedback Clause's more intimate sibling: the conversation happens early, on purpose, with structure, instead of awkwardly or never.

No timeline on the rest. To be clear about what "early" means: the setup comes soon after a first kiss, and that is the only clock here. There is none on going further. Six dates, six months, engagement, or marriage before anything past first base are all fine with me, honestly and without a preference. I'm not in a rush. The principle is that couples should get their ducks in a row before they go high-voltage, not that they should hurry to it: ground rules, genetic screening, and STI results are the steps most couples skip, and running them right after the first kiss means they're never the thing standing between us, whenever we decide the rest.

The honesty. No partner has run it with me yet; I built it after the patent and after the marriage, so whoever comes next is the first. I count that as a feature. We'd be figuring out the protocol together, which is what the protocol is for. Why I think a script is needed at all, with the two conversations that went wrong without one, is on The Case Against Me.

The future. Someday I'll probably build a dating app around Safeword. I don't think it succeeds without living directly inside one, so the hand-off to protected intimacy is as smooth as the first message. If that ships, you'll have watched the founding story from the inside.

Skip the Big Wedding (Keep the Big Party)

Two independent arguments, one about time and one about data, point the same direction: the courthouse, then the biggest cheap party you've ever been to.

The time argument. The average American engagement runs about fourteen to fifteen months, and longer once you add saving up. Those are prime years: of marriage, of fertility, of the finite window in which we could someday overlap with our grandchildren. A courthouse date can be booked in weeks. If the goal is to maximize married-years, parent-years, and grandparent-years out of the decades we have left, a 14-month planning cycle for a single evening is a spectacularly bad trade.

The data argument. The best-known economics study on this (out of Emory) found that higher spending on weddings is associated with higher divorce hazard: the couples who spent the least on the ceremony had the best survival curves, and the effect is sharpest for $20,000-plus weddings. (Rings are different, and I say so on the Ring page: modest beat both cheapest and priciest.) One wrinkle, which I'll flag before your AI does: the same study found that more guests is associated with lower divorce risk. So the wedding the evidence favors is cheap and crowded: a courthouse ceremony followed by the biggest, warmest, least expensive party we can throw. Everyone we love, nobody's life savings.

Correlation isn't causation and the audit prompt says so explicitly. But when the correlational evidence and the time-arithmetic both point at the same answer, and the answer also happens to cost less, I'm comfortable calling it.

The Ring Policy

I don't want to buy a diamond. Here's the reasoning, and here's the counter-offer, which is a check with your name on it.

The diamond norm is an ad campaign. "A diamond is forever," the two-months-salary rule, the idea that the stone measures the love — all of it traces to one company's marketing in the twentieth century, not to any tradition older than our grandparents. Diamonds lose most of their value the moment they leave the store, and lab-grown stones have collapsed the pretense of rarity. I build things for a living; I have a hard time buying manufactured scarcity.

The ketubah already carries a real obligation. A Jewish wedding includes a ketubah: a marriage contract with a real, ancient settlement obligation, 200 zuz for a first marriage and 100 for a widow, divorcée, or convert, enforceable in a Jewish court and predating De Beers by roughly two millennia. Stacking a several-thousand-dollar diamond (the US average is about $4,600) on top of an existing contractual settlement is paying twice for the same symbol, once to tradition and once to an advertising agency.

The counter-offer. If a ring matters to you, here's my proposal: I write you a check for the last reported median price of a diamond engagement ring in whatever state we live in. Call it the dowry check. It's yours, unconditionally. Keep it all as a wedding gift, spend part of it on exactly the ring you want chosen by you rather than guessed at by me, or put it toward the house, the kids' fund, anything. Same money, but you hold the allocation decision.

The real filter. The woman I'm looking for reads this and wants to keep the ring modest, not max out the check. (Modest, not zero: the same Emory data that favors cheap weddings found the lowest divorce hazard for rings between $500 and $2,000, with both the cheapest and the priciest doing worse.) There's a strange accounting illusion where ring money feels like it comes from some external budget: the man's problem, someone else's wallet. But there is no external budget. Every dollar comes out of the one joint family budget that has to carry our home, our kids, and our grandkids for the next fifty years. A partner who sees the ring and the 529 as line items in the same ledger is worth more to me than any stone.

The Money Merger

One narrow prenup, one shared pot, and a ketubah's head start on the ring.

The prenup. We have to have one, and its scope is narrow: property from before the marriage and inheritances stay separate. Everything we build from the wedding forward is ours. Like the ketubah, it's an old idea with a modern point: write the terms down while everyone is in love, so nobody negotiates during an emergency. The drafting itself is collaborative: I'm very open to your ideas about how the prenup should be written, and it has to settle the things default law leaves messy, such as what happens to growth in my company after the wedding, how inheritances stay unmixed with the joint pot, and when the ring check counts as yours. You get your own lawyer, full disclosure, and a signature well before the courthouse date, so nobody can ever say it was rushed. On some things I'm quite flexible; on others I have to make sure marriage can't turn into a mugging, for you or for me.

The merger. After marriage, I'd like to combine our finances into one pot, with an agreed allowance below which neither of us asks. The research points that way: couples who fully pool report higher satisfaction than those who keep money separate or half-merged, and a randomized experiment with newlyweds found joint accounts held relationship quality steady where separate ones declined. One pot, one ledger, the triple bottom line measured across the whole thing.

How it connects. The dating budget, the dowry check, the housing line, the 529: every number on this site previews the same accounting style. Explicit, shared, and debated in the open.

The Family Plan: Two or Three

The preference everything else on this site depends on, stated without hedging.

I want a family size of two or three children, and I'm at an age where the fair way to say that is with arithmetic. That means I'm looking for one of two women:

Path one: you already have children. Two or more, or one plus a real appetite for adoption, which is the same line the Age Range page draws. This is a path I'd choose on purpose, not one I'd settle into. I want to be a real stepparent, the kind who shows up, and a blended family gets us there with more birthdays already on the calendar and fewer biological coin-flips ahead of us. Widows and single mothers get priority here, for reasons the Age Range page spells out.

Path two: you're ready to pull out all the stops with me. Two or three children from scratch is still a project you commit to like a mission, not something you drift into. And if you're over 35, the fertility math makes the IVF conversation a first-few-months topic. Ovarian reserve testing, egg or embryo freezing, per-cycle success rates by age: I'd rather we look at the actual numbers together on date five than discover them in a clinic at 39. I mean that as respect for the project, not pessimism about your body.

The underlying logic is the same one behind skipping the big wedding: I'm optimizing for total years: years married, years parenting, years as grandparents, overlapping years all the kids know each other. Every year of delay comes off the end of the best part.

The clock is mine too. None of this arithmetic is aimed only at you. The stem cells that make sperm keep dividing for life, so every year I wait adds about two new mutations to any child I father, and the population studies tie paternal age to autism, schizophrenia, and a list of rarer disorders. Waiting is a shared problem, not an equal one: your curve is far steeper than mine, and mine is not zero, and the prompt in Audit 06 copies with my exact age at that second so your AI can price my side of the delay, not just yours.

The genetic homework. I've already done JScreen carrier screening, and my results are available in seconds on request. The summary: I'm a carrier for CYP21A2-related Congenital Adrenal Hyperplasia, specifically the V281L variant, which is the nonclassic, late-onset form: a child of mine can't inherit classic CAH from my allele, since even paired with a classic variant the milder allele sets the outcome. My report quotes a reproductive risk of about 1 in 250, which matches the arithmetic for a partner carrying a classic variant; because nonclassic carriers are common, roughly 1 in 10 generally and about 1 in 7 among Ashkenazi Jews by direct genotyping, the chance of a child with the mild nonclassic form is higher than that, roughly 1 in 40, and Audit 06 asks your AI to price it. I'm also a carrier for Biotinidase Deficiency, the mild D444H variant (my report quotes about 1 in 1,700; published carrier rates imply closer to 1 in 500): it can't produce the profound form, and paired with a severe allele it yields partial deficiency, which newborn screening catches and a daily biotin tablet treats. And I carry H63D, the minor variant for HFE-associated Hereditary Hemochromatosis, which on its own causes no iron overload and even paired with a partner's C282Y rarely amounts to more than an adult-onset, blood-donation-treatable condition. If you want me to father kids with you, it's important to me that you complete carrier screening too, early, before we're too deep to back out cleanly if the results surprise us: a match on any of my conditions, or anything autosomal dominant with poor quality of life, Huntington's being the textbook case, changes the plan, and we'd want to know while it's still a plan.

The mortality clock. Our lifespans are finite, fixed by our choices and by fate, and every month we delay getting married and having children is a month taken from watching our kids and grandkids grow up. I'm already 40.42 years old. If our first child were born today, married at 30, and had their own two or three kids by 32, our grandkids would graduate high school when I'm about 90, college near 94, graduate school past 96. And realistically, with a courtship, a wedding, and a pregnancy in between, the earliest our first child can arrive is about a year and a half out, which is where the clock's slider starts. A typical American man my age makes it to about 78. Will we both be alive to see our grandkids graduate high school? College? Graduate school? Hesitation answers that question for us, one month at a time. The clock below is adjustable: drag the assumptions and watch the overlap move.

36.1 yrs with our children
4.1 yrs with our grandkids
overlaps if I live to exactly 78, the typical US male figure. The honest expectation is higher, because living longer counts and dying earlier stops at zero: on current life tables, about 8 years with the grandkids, with a two-in-three chance of meeting them. Audit 16 runs it.
MY AGE 40.4 · FIRST CHILD ≈ 41.9 · LAST GRANDKID ≈ 73.9 · THEIR HS GRADUATION ≈ 91.9 · COLLEGE ≈ 95.9 · GRAD SCHOOL ≈ 97.9
Every month we delay moves every number here one month against us. Surviving to meet the grandkids buys some overlap back; Audit 16 runs the honest conditional math.

Maintenance

The Grandparent Clock makes my lifespan this site's central variable. Here is the maintenance schedule. Yes, I'll still buy your drink.

The forcing function. I engineered an app called CtrlAltM⏻ve that locks every screen I own, work laptop included, until I've exercised that day. So I exercise every day, religiously, because I've made skipping impossible. Of everything in my life, it's the thing I'm most religious about.

Fitness data, shared. It matters to me to be able to share my progress toward my health goals, and my fitness itself, with my partner, and I'm hoping you'll feel the same and want to share yours with me. I can join you on whatever platform you already use: I wear an Oura ring and a Fitbit Inspire 3 and keep an old Samsung Galaxy Watch in a drawer, and I wouldn't hesitate to buy different hardware if it makes syncing our data with each other smoother. CtrlAltM⏻ve is growing a feature I call Spotter, which will let you see my planned weekly workout schedule and whether I actually completed it, and I'm looking forward to handing you that view. If you help motivate me to stay more and more fit, that's one of the qualities I'm looking for in a spouse and lifetime partner, and I'll appreciate it forever. The offer runs both ways, at whatever depth you're comfortable with: a shared step count is plenty, and a shared training plan is a joy.

Sleep. I sleep on a schedule, nearly the same time every day of the year. No erratic hours, no partying through weekends and recovering through the week; my schedule is usually flexible enough that the only alarms I set are for red-eye flights.

The poisons. I don't smoke. I don't drink alcohol, which I consider what it is: a poison, with the honest footnote that at one drink a day the cost is measured in months of life, not years, and I still don't want them. I'll happily buy yours, though, under one small and lifelong condition: soft protest. Every few rounds, expect me to note, with a straight face and no sermon, that you are asking me to pay to have you poisoned against my better judgment, and then to pay. Your glass, your call, my joke. My abstaining is a health choice for me, not a rule for you, and I'd rather be honest about it on a website than awkward about it at a bar.

The screenings. I'm consistent about the screenings that have evidence behind them, blood pressure, lipids, diabetes, colorectal at 45, and skeptical of the ones that don't, since the general annual checkup has never been shown to extend a life and over-screening has its own harms. The mortality clock only bends one way on its own; the right tests are how you argue with it. The one number on this site the schedule doesn't address is my weight: 190 pounds at 5'10" is a body-mass index near 27, which is on the list. I want to stay alive and healthy as long as the effort and the math allow.

Dual Careers and the Dishes

Dual-career by default, stay-at-home by reason rather than convention, and half of everything domestic. Religiously. Including the drawer nobody claims.

The default. I'd prefer a dual-career household: two incomes, two professional identities, two people bringing outside wins home to each other.

If someone stays home. If any phase of our kids' lives calls for a stay-at-home parent, we make that call on reason instead of sexist convention. Run the numbers, which means childcare costs against the second income after taxes and the long-run career penalty for whoever steps out, a penalty the research says is real for fathers too, and it may make more financial and economic sense for me to be the one at home than for you to be. Outside the nursing years, don't assume that being female makes you the better stay-at-home parent, or gives you more natural desire or capability for the extra hours with the kids. I'm super-interested in parenthood and have no hangups about being a hard-working work-at-home parent who cares for young kids the way moms traditionally have.

The filter. If you're looking for a man who takes it as a given that women stay home and care for the kids, that's not me. I'm feminist enough to question traditional male and traditional female roles and to balance them equitably.

The domestic split. I intend to split the labor at home with you religiously: half of everything domestic, measured rather than declared, since husbands famously overestimate their share and the research says perceived fairness, not the exact hours, is what predicts a happy marriage. You will not be doing all the cooking or all the cleaning; I'll be doing half of each, and half of the categories nobody lists. And I know where equal splits usually die: the first baby, when studies show women pick up two extra hours a day and men forty minutes. We'll keep a time diary through that year, and I'll be the one who reads it.

Childcare. Grandparents, nanny, daycare, a parent at home, or a mix: that's a decision we make together, driven by our joint and separate income patterns at the time, and by nobody's defaults.

The Work

Semi-retirement math, chosen labor, and a just-ask policy on the numbers. The numbers are fine. Ask anyway.

The position. My retirement is mostly fully funded already, and I have enough passive income to be semi-retired today under FIRE-community math. I keep working because I want to keep building and growing as much as possible, not because the rent depends on it. There is no rent.

The plan. Keep building the public-health technology projects at Lifesaver Labs, CtrlAltM⏻ve and Neighbor 911, plus Safeword, for entrepreneurial income, while qualifying and working as an EMT and eventually part-time as a paramedic-firefighter.

The fallback. I can always return to full-time software engineering, but only for a position that closely matches my values, building software that directly advances them, someplace I'd feel proud to serve. I have maybe 20 or 30 working years left in me, and I intend to recall every one of them proudly. Working for myself at Lifesaver Labs is just about my ideal way of serving life while building income.

The just-ask policy. The Home page claims my finances are auditable without the peacock feathers. Here's the mechanism: if you want a rundown of my finances, just ask. My politics need no asking at all: the policy platform at lifesaverlabs.us documents them position by position.

Where We'd Settle

The multicity phase ends somewhere. Three candidate answers, one principle, and a method for choosing.

The principle. Kids should grow up near their grandparents. Grandparent involvement is one of the few free multipliers a family gets: childcare from someone who loves the child, culture passed down first-hand, and a longevity effect for the grandparents themselves: in the Berlin Aging Study, grandparents who helped with occasional childcare had about a 37% lower mortality risk than those who didn't. I'll flag the honest part before your AI does: the years are the grandparents', the help has to stay moderate to show the effect, and how solid the number is remains exactly what Audit 14 exists to check.

Option one: near your parents. If your parents are alive and want to be close, I'd be happy to move to them and live near my in-laws. Grandparents on your side count just as much as grandparents on mine.

Option two: near mine. My parents would be thrilled if we chose anywhere within driving distance of Boca. South Florida comes with sun, family, and the economics you've already read on the Home page. Cleveland, where the rest of my family and a co-owned condo sit, is the quieter version of the same option.

Option three: the spreadsheet city. If neither set of grandparents anchors us, or the tradeoffs don't clear, we pick a city the way this site picks everything: cost of living, employment prospects, schools, and community, weighed in the open.

The method. I'm genuinely flexible on the destination as long as we handle the tradeoffs together, rationally, with the weights on the table. You bring your criteria, I bring mine, and the decision matrix determines where the kids' grandparents live relative to their bedrooms.

Israel, Europe, or Elsewhere

The Geography page picks a city. This page says the city doesn't have to be in the United States, and what has kept me here so far.

The willingness. I'd be happy to spend years building a life in Israel or in Europe. The one thing that has kept me from doing it is not money or work or nerve. It's that I've never had a spouse who was motivated to move, and it isn't a life I want to build alone. If you are that person, this page stops being hypothetical the day we decide.

Israel. Living there would bring us closer to my brother's family and further from my sisters. It's the country whose passport I already carry, where my beginner Hebrew would finally have to grow up, and where Jewish life needs no explaining. The Travel page lists a stretch there as a bucket-list item; this page says it could be more than a stretch.

Europe. Living there would put an ocean between us and both sides of my family, which is the honest cost. It could also be an amazing adventure to take together for a few years. Two obvious bases: Portugal, whose citizenship I hold and whose language I'm still a beginner in, and France, where, for better or worse, my French is a lot better than my Portuguese, since I studied it through high school and college and it's had years to settle. Either one puts the rest of the continent an easy train away.

Retirement, too. I'm also happy to consider retiring for a few years in Israel or Europe, or somewhere else entirely, if we can work out the affordability of the move. The Home page's premarital savings were reserved for exactly this kind of thing.

What the passports buy. I'm not dead set on one US city and state for the rest of our lives. With three citizenships, at least two of which I can share with you directly through marriage, on their own timelines, we have an unusual amount of freedom in where we live, work, and travel, and our kids inherit all three. The Geography page's method still applies: your criteria, mine, the weights on the table. This page just widens the map the method runs on.

Travel

Three passports, one bucket list, and a stamp collection four continents deep. South America has been notified.

The bucket list, already on the ledger. The Home page reserves premarital savings for "a few years living abroad," and the passports make two candidates obvious: a stretch in Portugal, where my citizenship and my beginner Portuguese both want finishing, and a stretch in Israel, at whatever depth of Jewish life we choose together. Add scuba certification, which the Home page has been threatening for a while, and the Pacific Northwest, which Travel Reach can't quite reach from Florida and marriage can.

The rules of travel with me. Kosher-style survives any country. Exercise happens daily wherever we are, since my screens won't unlock otherwise. And I'd rather go fewer places for longer than many places at a sprint: the multicity dating phase is enough airports for one lifetime.

The stamp collection. I've held jobs on three continents (Montreal, France, China), and the leisure stamps filled in around them. North America: almost every US state, plus Puerto Rico, Mexico, and Canada. Europe: France, England, the south of Ireland, Portugal, Spain, Switzerland, Italy, Germany, Austria, and Czechia. Africa: Morocco, where my mother was born. Asia: China, Japan, Vietnam, and Israel, many times over. South America: not one footprint yet.

The honeymoon. My instincts run toward new corners of Asia or Europe, sub-Saharan Africa, Portugal, the countries where my language studies make me halfway useful (France, Israel), or all the way across the world to Australia and New Zealand. But hold those loosely: I'm pretty flexible, we'd figure it out together, and I want to go to your first choice far more than to mine.

The Education Fund

Already funded, already growing, plus a proposal for how it pays out that puts welding school on equal footing with Harvard, if the data says so.

The fund exists today. I've already super-funded a Florida 529 educational savings account, front-loading five years of gift-tax-free contributions at once so it compounds for the maximum runway. I own the account and my niece is its current beneficiary; the rules let me switch it to her first cousins, our future children, directly, and to a child I come to stepparent in two steps with a gift-tax filing, which a professional would handle. One superfund seeds the fund rather than fills it, so it keeps growing. The goal: our kids graduate debt-free at least to the level of in-state public tuition, whether college, grad school, or trade school, with the proposal below deciding how much more.

The payout proposal — a parental financial aid function. A proposal, with your full veto attached and every parameter negotiable; the last paragraph says so at length. Debt-free at the public-tuition floor is the guarantee; above it, I'd like our family aid to scale with the expected return of the path chosen: majors and trades with strong odds of repaying the years invested get full support; majors with reliably poor financial outcomes get a minimal family floor, with the student covering the rest through loans, aid, or scholarships. That's the same price signal the rest of the world will send them, just delivered earlier and with love.

Objectivity over parental taste. The crucial design feature: the function is tied to published, regularly updated earnings data: the New York Fed's early-career medians by college major, and the Bureau of Labor Statistics' medians by occupation for the trades, with no term in it for what mom and dad happen to respect. If the data someday says welding out-earns computer science, the function pays for welding school and I update my priors in public. This is a gain function, not a taste function.

The school question. My default preference is a competitive, high-performing public school for most of their years. I'm happy to send them to a Jewish day school for some or all of elementary if we agree it will deepen Jewish values, ethics, and culture in ways we can't replicate at home. But the price is real: $15,000–30,000 per child per year, a small fortune once you compound it across two or three kids, so both the wanting and the needing have to survive the spreadsheet.

Partner veto, explicitly reserved. To be clear: this is a preference, not a dealbreaker. The function is a proposal, the parameters are negotiable, and you hold a full veto. But I'll admit the selection effect: I'd love to be married to someone whose reaction to "let's write down our parental aid policy as an equation tied to an objective index" is that it's responsible and kind of cool, rather than cold. It's the least subjective, least favoritism-prone way I know to be generous to two or three different kids.

Before the Chuppah

The things couples assume they agree on and discover in year two that they don't. Settled where I have a position, and marked "together" where I don't.

Selection Effects

Every instrument shapes its own sample. Here is how this one does, said out loud so you can correct for it.

The Age Range

Not a preference. A function of the family plan, and the least fun arithmetic on the site.

If lifespans were the only variable. I'd date from about three years younger than me to about five years older, and I'd bias toward marrying a slightly older woman. American women outlive American men by roughly five years, so an older wife is the closest thing to a matched pair of lifespans: fewer years of either of us alone at the end. That is the range I'd publish if pregnancy weren't part of the plan.

The ceiling. The one absolute bound on every path is five years older than me, which today is 45.42. Above that I don't think we'd be a stable match: different life stages, and experiences too different to co-adapt around. The ceiling ticks upward with me, one second at a time.

Path one: children in hand, or adoption in heart. If you already have two or more children, or you're genuinely excited to adopt, your marital history is beside the point (divorced, widowed, never married) and the range is wide: roughly 30 up to the ceiling below. The family plan is already feasible, so biology stops setting the lower bound. The Dealbreakers page asks only that you be flexible on adoption; that's the floor. Excitement about it is what widens the age range.

Priority, stated plainly. Within path one, widows have top-tier priority, widows with children most of all, and single mothers are right there with them. Your kids, and all kids, deserve a father figure as soon as one can be found, and you deserve a coparent to share the load with as soon as possible. That is no demotion of single or divorced women without children; nobody here is second-tier. It's that children who don't yet have four eyes watching them and helping them, all the time, obligate me to try even harder to make a match with their mother work. And if your case sits between the paths, one child and no adoption plans, for instance, don't rule yourself out; get in touch and let's talk it through.

Path two: building from scratch. If you don't have children, aren't excited about adopting, and didn't freeze eggs when you were younger, my honest estimate is that two biological kids stop being realistic past about 37 or 38, and three past about 34 or 35, even on the fastest marriage track this site can offer. I hate that sentence. But the Family page already makes the IVF conversation a first-few-months topic at 35 and up, and this is the same arithmetic run against a calendar: a courtship, a wedding, and two or three pregnancies take years the fertility curve doesn't give back. Audit 17 has the curve, and I'd rather you check it than take my word.

The pattern I keep meeting. Many women I meet in their late 30s and early 40s sincerely want children of their own. What I see less often is the plan catching up with the biology: immediate IVF, donor eggs, adoption, fostering, or surrogacy, instead of another year of hoping the ordinary route holds. The same women are often still filtering hard, and I understand every filter: party, exactly the right amount of religious, my mostly vegetarian plate (I was vegetarian for years and still lean that way), my refusal to negotiate on pediatric vaccines, income, humor. Each is legitimate. The clock doesn't care, and every month spent applying them comes off the same overlap the Family page counts.

The genetics, both directions. I built a site for this too: Five Nines Fertility, and its Birth Pacing & Mutagenesis tab runs the numbers on what waiting into the mid-30s and 40s does to a child's genome. The uncomfortable summary for you: obstetrics files any birth at 35 or older under advanced maternal age, and on this site's fastest track a woman past about 32 will be carrying at least one of our children on that side of the line. The uncomfortable summary for me: I am 40.42 years old, sperm accumulates about two new mutations for every year a man waits, and the large population studies put autism risk for children of fathers in their early 40s at roughly 1.3 to 1.5× that of a 25-year-old father, climbing every year. In absolute terms that is about 4 to 5% against a population average near 3%, and Audit 17 has both numbers. But I consider it irresponsible to let mine keep growing, and I'd be a hypocrite to run a clock on your biology without publishing my own.

Where I stand on pickiness. I'm trying hard to be the opposite of picky: to satisfice, in Herbert Simon's word, with any reasonable, non-chaotic match, and to stop dating as soon as is responsible. I'm racing to become a father and a grandfather, not holding out for a Ms. Right who doesn't exist. My working theory is that two people courting for marriage co-adapt: dates two through five and beyond change both people toward each other, and you can't see that process from date one. Apps train us to grade a first coffee against a mirage of infinite choice, and the usual result is years of drift and indecision. I'm told the honest version of this costs me: that women need to believe a man is selective before they take him seriously as a suitor. Fair enough. The Dealbreakers page is my selectivity, kept short on purpose, and everything outside it is a yes.

The ask. None of this is a requirement, and none of it should disqualify me; it's arithmetic offered to whoever is doing the same math. If you're over about 32 and reading this, think hard about whether you truly need more than six months of dating your future husband before getting engaged, or more than three months to plan and hold a small wedding. The Budget page hopes for a decision inside six months and the Wedding page books a courthouse date in weeks, so the sum lands around nine months from today, nine months from the day you first read this, and a date my mother would circle if I let her. Every month added to the dating, the engagement, or a complicated wedding is a month subtracted from the time you spend with your grandchildren. Gestating a marriage shouldn't take longer than gestating a baby.

What I Don't Care About

The filters most profiles run silently, switched off and said out loud. Then the one thing I do care about, and an honest paragraph on health.

Dealbreakers

Everything else on this site is a preference with a veto. These eleven are structural, and the list is kept short on purpose.

What shouldn't be a dealbreaker

Symmetry demands the reverse list: common filters that shouldn't survive scrutiny.

Anticipated Objections

Frequently asked questions, answered the way the rest of this site would answer them.

FAQ 01Isn't a dating site with an audit ledger itself a red flag?

Compare it to the alternative: discovering the family plan in month eight, the finances at engagement, and the dealbreakers in year three. Everything here is what daters learn slowly and expensively, published early and for free. If transparency this thorough reads as danger, we disagree about where the danger in dating actually lives, and learning that costs one coffee instead of one year.

FAQ 02Is this a contract?

No. It's preference revelation, the raw material the Matching page says stable matching runs on. The dealbreakers bind me as much as you, the offers with numbers in them are real, and everything labeled a preference carries your veto. Nothing here is a term sheet; all of it is me going first.

FAQ 03You've optimized the romance out of this.

The Matching page argues the opposite: "I evaluated the market honestly, found a stable match, and closed the search forever, on purpose" is the strongest vow I know how to make. The spreadsheets exist to protect what the feelings choose, and to prove the yes was informed.

FAQ 04What if I want the big wedding, or the diamond?

Both pages end in offers rather than ultimatums. The dowry check is yours to allocate, ring included, and the wedding I want is big in everything but the invoice, with the guest-count evidence on your side. Persuade me: the Feedback Clause cuts both ways.

FAQ 05Do I really have to run the audits?

No, and most people won't. They exist so you never have to take my word for anything, and for the reader who feels better double-checking a stranger from the internet. Skipping them all is a perfectly good way to read this site.

FAQ 06What's the catch?

The backstory. I graduated from the school of very hard knocks, and you'll hear it early and in person, on the schedule the Dealbreakers page sets out: the facts up front, the deeper chapters as trust builds, a few pages sealed for good. If a complicated history is disqualifying, the kindest thing this site can do is say so before the first coffee.

FAQ 07Has this site changed over time?

Constantly, and in public. The source and its full revision history are open at github.com/davidclayman/marrydavid.com: every edit, every position I revised, timestamped. Year Ten promises I'll update in public when I'm proven wrong. The commit log is the receipts, running since before we met, and Revisions keeps the readable version.

FAQ 08Will the drone be at the wedding?

Only if you want footage. It will not be officiating. It will not be at the first date either, unless you've read the Date Locket page and asked, which you can do without agreeing to anything else.

FAQ 09What if I hate spreadsheets?

Then we'll manage: I'll do them, you'll never be asked to open one, and you'll occasionally be told what one says, briefly, before we go for the walk. But I'll be honest about the hope underneath. I would really love to be with someone who likes or even loves spreadsheets, who sees a budget with color-coded tabs and feels calmer rather than cornered. It isn't a filter. It is the thing that would make me grin on a first date, so if it's you, say so in the first message.

FAQ 10Is the matchmaker prize taxable?

Probably, and that's between you and your accountant. I'll pay it in full and let you and the IRS settle the rest. If you'd rather it never touch your return, the Referrals page has the pay-it-forward option.

The Case Against Me

The FAQ rebuts objections. This page concedes them. A fair critic would say most of the following, and most of it is true.

Life Didn't Go As Planned

The site reads like a plan because it is one. Here is what happened to the last plan, and why this one is written down.

The first spreadsheet. On August 31, 2019, I built a spreadsheet for a wedding, down to a line-item budget. It modeled the wedding I dreamed about: small, at one of North America's two natural wonders, Niagara Falls (like The Office) or the Grand Canyon. That was seven years ago, and the counter is live because the point is the length. The spreadsheet did get used, just not by me: it prepared me to help plan and coordinate a friend's wedding, one I later officiated. It took another four years before I got into the weeds of wedding planning for myself, and the wedding the spreadsheet planned never happened.

The marriage that did. I married in the late summer of 2023. It didn't last more than a year. The Dealbreakers page explains what I will and won't say about that, and when; the fact belongs here because it's the plainest evidence on the site that plans are not outcomes. I would have preferred to be married since 2019, to the same person, with the kids already in school. I'm not.

The dozens of ways. In between, I've watched two people eliminate each other in more ways than I could have invented. Some were hers: she was against vaccines, or carried a Las Vegas gambling habit, or needed a man who'd watch tackle football with her, which I won't, because I can't unsee what it does to brains. Some were mine, from her side of the table: I like animals but don't fall head over heels for them, I don't drink, and I say all of this out loud on a first date. Each of those is a legitimate reason. Together they're a long list of good people who were right for someone and not for each other, discovered one dinner at a time.

The honest part. It's painful to keep going through it. Not the individual no, which is fair, but the cumulative arithmetic: every elimination costs weeks, and the Family page counts what weeks cost. I'm not writing that to be pitied. I'm writing it because a site this thorough can look like confidence, and some of it is the opposite. It's what a person builds after learning, expensively, that the dealbreakers show up eventually no matter what, so they might as well show up first.

The wedding is one example. A lot of things in my life didn't go as planned, and the wedding is only the one with a spreadsheet. The rest has more twists and turns than I can share in one sitting. I've tried; it can't be done with any precision or accuracy in a single evening, and attempting it is exhausting for both people at the table. So the story comes out slowly, over a couple of months, one chapter at a time, in roughly the order it happened and at whatever pace trust allows. That isn't evasion, and it isn't a test. It's the only way I know to tell it accurately, and you deserve the accurate version.

Why this plan is public. That's the whole design. Every way two people could eliminate each other in month eight is on a page you can read in an hour, so the elimination costs a coffee instead of a season, and the match, if it's there, has nothing left to trip on. The spreadsheet from 2019 is still in a folder. I'd like to finally use it, and I'd like the line items to be ours.

Verify Me

Safety logistics, stated up front, because you shouldn't have to ask. Yes, that's my real name. Yes, you can search it. Yes, the patent is boring.

The premise. Meeting a stranger from the internet is an asymmetric risk, and you carry more of it than I do. I'd rather engineer that risk down than ask you to accept charm as evidence, so the following is standing policy, no negotiation required.

Before we meet. As many video calls as you want, and you can request the first one right now. My name is David Clayman; search it, read the LinkedIn profile, look up the rest of the professional footprint, run a background check if it would put you at ease. I'll consider that diligence rather than distrust.

When we meet. First dates in public places, your pick of venue and time, daytime welcome. Tell a friend where you are, share my details, share your live location with someone who loves you, schedule a check-in call. I will never be offended by safety logistics, and my feelings would be beside the point anyway, because the logistics aren't for me.

The asymmetry runs one way. I don't need your address, your workplace, or even your last name until you feel like volunteering them. I go first everywhere else on this site, and I go first here. Nothing about meeting me should require more than the ordinary courage dating already takes.

References

Social proof, available if you want it, invisible if you don't. My mother is not on the list, on grounds of bias.

The people. I live close to my family on purpose, and the people who know me longest are a phone call away. Character references are available the same way my finances and my JScreen results are: just ask. Yes, it's unusual to offer references for a boyfriend. It's also unusual to publish an audit ledger, and you're still reading.

What they'd tell you. I could write flattering quotes here, but unverifiable praise is exactly what this site exists to replace. So instead: ask my references the questions you'd never ask me. How I debate. What I'm like when I'm wrong. What happened when things got hard. The Verify Me protocol covers the author; the references cover the years before you arrived.

The community. The triple bottom line isn't hypothetical: Lifesaver Labs builds public-health tools, the EMT path is chosen service, and the family I keep close keeps me close back. The community column of the ledger has entries, and I'm glad to share them.

The Audit Ledger

Every claim on this site, numbered and checkable, for whenever curiosity strikes; none of it is required reading. Expand one, copy its prompt, hand it to any AI assistant. Audit 00 covers the whole site at once. Audits 01–04 cover the physics, 05–11 the life philosophy, 12 travel reach, 13 the feedback clause, 14 the grandparent effect, 15 the money merger, 16 the mortality clock, 17 the age range, 18 the maintenance schedule, 19 the prayer arithmetic, 20 Safeword, 21 the domestic split, 22 circumcision, and 23 whether a name shapes a life.

AUDIT 00The meta-audit: run the whole site past your AI

One prompt to audit everything at once: hand your AI this entire site and ask for the read a sharp, protective best friend would give. Entirely optional, like every card in this ledger; it's here for the thorough and the curious.

Trust, or verify, or both. Dealer's choice.

Every prompt on this ledger was last run in full on 2026-09-03; the corrections are logged on Revisions. Next full recheck due 2026-12-03, since flight schedules, prices, and life tables all drift.

The Year-Ten Forecast

Every model needs a target state. This is the one I'm steering toward, published now so you can hold me to it, and so our kids can laugh at it later.

By year ten the odometer reads about 73 billion miles: the distance we'll have hurtled through the cosmos together while doing school runs. The universe will have kept leaving, too: on the order of a few to twenty galaxies a year cross the cosmic event horizon and stop sending us new light, and over a hundred billion years everything beyond our Local Group fades from view, leaving roughly 1.5 trillion stars as the permanent endowment. It's enough. All of it watched from a modest address, the Local Arm of the Milky Way, about 26,000 light-years from the galactic center and a little north of the plane, suburban by galactic standards. Down here, the forecast looks like this.

Two or three kids who know both sets of grandparents by the sound of their footsteps, growing up in a city we chose with the weights on the table. A house full of books and long-form debates, kosher to whatever standard we set together, Jewish at whatever depth we chose on purpose. Everything domestic still split by the same open spreadsheet, rebalanced whichever career was sprinting that year.

A marriage that debates at the negotiating table and never on the battlefield, with the feedback loop so practiced it has become shorthand: what began as two paragraphs after a first date is now a raised eyebrow across a dinner table, correctly interpreted. The 529 compounding quietly. The dowry check long since allocated, by you. The wedding still the party people bring up, because everyone we love was in the room and nobody's savings paid for it.

And a ledger showing a decade of the triple bottom line: what we earned, what we built for the kids, and what we did for the community around us. Somewhere in there, at least one audit on this site will have been proven wrong, and I'll have updated in public. That's the target state: year ten of a marriage that course-corrects beats year ten of one that coasts.

Verify it with me in person, a decade in.

Revisions

Year Ten promises I'll update in public when I'm wrong. This is the ledger of doing it, positions only; the full history is in the commit log.

Acknowledgments

Nothing here was built alone. The positions are mine; the shoulders are other people's.

The giants. This site stands on the available research and scholarly literature, and the Audit Ledger is mostly a list of the people whose work it borrows: Gale and Shapley on stable matching and the optimal-stopping mathematicians who followed them; the economists behind the wedding-spending study and the courtship-length data; the reproductive-medicine societies whose fertility tables set the Family page's clock; the actuaries at the Social Security Administration whose life tables run the grandparent clock; the geneticists who measured how paternal age writes itself into a child's genome; the psychologists who studied pooled finances, housework, feedback, and the transition to parenthood; and the cosmologists who measured our motion against the microwave background and gave the whole thing its radius. Where I've summarized them fairly, the credit is theirs. Where I haven't, the audits exist so you'll catch it.

The people. My parents and grandparents, who showed me what a lifelong marriage looks like from the inside. The teachers named on The Shelf, who made a science teacher out of me. And the role models listed there, most of whom will never know they're on it.

The editor. This site benefited enormously from production and editorial assistance from Anthropic's Claude, in its Fable 5.0 and 5.1 versions: drafting and tightening prose from my positions, building the live widgets, the map, the integrity tests, and the audit prompts, checking the numbers against one another, and telling me, more than once, which sentence a protective best friend would quote back at me. Every position, preference, dealbreaker, and number is mine and was decided by me. The AI helped me say it clearly and check it honestly. It seemed only fair to disclose that on a site that asks you to hand its claims to an AI of your own.

The bill. Since a site this transparent should also disclose what it cost to make: about $13.50. The build took roughly two days' worth of loving labor on a $200-a-month Claude Max plan, and two days of a month is $13.50. For the curious, the session transcripts add up to about 3,800 model replies, 3.7 million tokens written, 29 million tokens stored in the prompt cache, and 1.05 billion tokens read back from it, across the two build sessions and the two dozen independent agents that ran the Audit Ledger. At Anthropic's published API list prices for Fable 5 and 5.1 as of September 2026 ($10 per million tokens in, $50 per million out, $0.25 to $1 per million cache reads, $12.50 to $20 per million cache writes), the same work would have billed somewhere between $1,000 and $1,250, most of it cache. I am emphatically not paying API prices, and I mention the number only so the $13.50 lands. The best deal on this site remains the referral prize. The line the bill leaves out is my own time: the chat record's timestamps put it at about 22 hours of hands-on work across 313 messages, most of it in three long days, on top of the years of thinking the positions themselves took. That time is expensive and, at the moment, unquantifiable; getting this as close to exactly right as I could is what I chose to spend it on.

The tools. Fraunces, Space Grotesk, and IBM Plex Mono, self-hosted so nobody's browser has to phone Google to read this. GitHub Pages, which hosts a single file for free. And the open commit log, which does the remembering so I don't have to.

Glossary

The site leans on words it never defines. Here they are, briefly, for the reader who didn't grow up with them and the friend a yente forwarded this to.

Privacy

What this site collects, which is very little, and your rights over it, which are complete. Even the fonts don't phone home.

Who is responsible. David Clayman, the author of this site, is the data controller. Contact for anything on this page: the address on the Transmission page.

What the site collects, and why. Three things, and nothing else. First, if you agree, Google Analytics counts which sections are read and which buttons are clicked, in aggregate, so I can tell whether the site works. This runs only after you say yes on the banner, is remembered either way in your browser, honors the Global Privacy Control signal as a no, uses IP anonymization, and has advertising features switched off. The legal basis is your consent, and you can withdraw it below. Second, anything you choose to email me goes to my inbox so that I can reply, and a request that I call you travels through a Google Form into the same inbox; the legal basis is that you asked me to. Third, the host records ordinary server logs, as every website's host does. The site sets no cookies of its own. The fonts are served from this site, not from Google.

Who else touches it. Google LLC processes the analytics data and the call-request form on my behalf under its standard terms, and GitHub, Inc. hosts the site and its server logs. Both are in the United States and operate under the EU-US Data Privacy Framework. Nobody else. Nothing is sold, and nothing is used for advertising.

How long. Analytics data is kept for fourteen months and then deleted by Google. Emails and call requests are kept as long as our conversation lasts and deleted the moment you ask. Your consent choice lives in your own browser until you clear it.

Your rights. Under the GDPR and equivalent laws you can ask what I hold about you, have it corrected or deleted, restrict or object to its use, take a copy with you, and withdraw consent at any time without affecting anything that happened before. Email me and I'll do it within a month, usually the same day. If you're in the EU or UK and think I've handled your data badly, you can complain to your national supervisory authority. The site makes no automated decisions about anyone.

US readers. California's CCPA and CPRA, and the similar laws in Virginia, Colorado, Connecticut, Texas, Florida, and a growing list of states, apply to businesses above revenue or data-volume thresholds that a one-person dating page doesn't approach, so none of them technically reaches this site. I follow their core rules anyway: you can ask what I have, have it deleted, and opt out of any sale or sharing, of which there is none, and the site honors the Global Privacy Control signal that California treats as a legal opt-out. Two federal points do apply. This site is for adults; it isn't directed at anyone under 18, and I don't knowingly collect anything from a minor. And if you use the call-me form, the call comes from me personally, by hand, at the time you asked for; there are no autodialed calls, no marketing texts, and a "please stop" ends it, which is what the Telephone Consumer Protection Act requires and what courtesy requires anyway.

Change your answer.

Questions for You

Forty-five sections about me is a monologue. This is the interview I'm hoping for. You may bring notes.

Notes Received

The Feedback Clause asks every reader for two paragraphs. This is where they go, the unflattering ones included, so the loop this site keeps talking about actually closes in public.

The rule. Any note sent under the Feedback Clause may be posted here, anonymized: no names, no cities, no details that could identify the writer, and nothing at all if she asks. I'll post what I heard, what I changed because of it, and what I heard and chose not to change, with the reason. Praise gets no special treatment; the notes I most want on this page are the ones that stung.

Why publish them. The Selection Effects page admits that everyone who writes back has already survived every filter on the site, so my private inbox will flatter the design. Publishing the notes is the correction: it lets a reader see what people like her actually said, not just what I decided to keep.

So far. None yet. The site went live in September 2026, and this page will fill as the notes arrive. If you'd like to be first, the price is two or three honest paragraphs, and you'll get the same care back.

Referrals

Most good marriages start with an introduction. Mine will start with a $2,000 finder's fee and a yente. If you know someone, this page is for you.

The ask. If you have a friend, coworker, sister, or daughter you think I should meet, please reach out. Send her this site, or, with her permission, send me her name and contact information, or just tell me why you thought of her. The Matching page argues that the people who do best in a matching market are the ones who propose rather than wait; a referral is a proposal on someone else's behalf, and I'll treat it with the care that deserves.

The matchmaker prize. I will pay $2,000 USD, in September 2026 dollars and adjusted for inflation by the consumer price index at the time of payout, to whoever connects me with my future spouse. The national index, to be clear, not the South Florida one; if I pegged it to Boca rents and HOA fees, the prize would be a down payment by the time the kid could walk. It pays out after we have or adopt our first child together, not at the wedding, because a child is the real test of whether the marriage is real. Weddings are easy to throw. If the introduction took two of you, it splits. If you're family, it still counts. And you don't have to be a professional matchmaker to collect: amateur yentes are very welcome.

Please take it. I'll encourage you as strongly and as emphatically as I can to accept the prize; you'll have done the most valuable thing anyone ever did for our family. If you're close to my future spouse and keeping it feels awkward, let me pay it to you anyway, so the recognition is real and on the record. Then, if you truly wish and insist, and my bride doesn't refuse it, you can always turn it into a wedding gift to her personally. Or pay it forward: use it to seed a matchmaker prize of your own, for yourself if you're single, or for another single person you're connected to, so the introduction that found us goes on to find someone else. That's your call to make once it's yours. Mine is only to make sure it becomes yours.

Why the fee is a no-brainer. The Budget page caps the whole courtship at ten thousand dollars. A fifth of that, paid only on the outcome that the entire site exists for, and only after that outcome has survived a pregnancy or an adoption, is the best-structured expense I will ever make. Every other line in our family ledger will be a cost. This one is the reason the ledger exists.

How to refer. Send a referral, or write to the address on the Transmission page with "Referral" in the subject. Tell me how you know her, what made you think of us, and whether she knows you're writing. She never has to; I'll wait for her to reach out herself if you'd rather stay in the background.

Copy the pitch

The hardest part of a referral is finding the words. Here are some; edit freely.

Hi! I know someone I think you should meet. His name is David, he's 40, a former science teacher who now builds public-health software in South Florida, and he wrote the most unusual dating page I've ever read: https://marrydavid.com He's clear about what he wants, which is to marry and raise two or three kids soon, and he'd fly to wherever you are on a week's notice. Read it and tell me if I'm wrong about you two. If you want, I'll make the introduction. If not, he never has to know I asked.

Is she a fit?

Five questions from the Age Range and Dealbreakers pages. There is no "no" at the bottom; there is only how much to let her decide.

Tick what you know. Anything you don't know counts as a question for her, not a mark against her.

$2,000 in 2028 dollars
$2,000 in September 2026 dollars, indexed to the consumer price index at payout; this is an illustration at an assumed rate
The real figure uses the national index on the day it pays out, whatever it says. Move the sliders to see why indexing matters over a wait this long.

Send a Transmission

Signal acquisition is active. Response latency: much better than Proxima Centauri's 4.2 years.

The price of a first message is an hour of curiosity. You don't need to know whether you'd marry me, agree with me, or finish this site. You only need to wonder whether we'd enjoy a coffee. One line is a fine first message. So is a guarded one.

If something here resonated, reach out. Include whatever you like: a favorite line, your strongest objection, or a counterproposal for any of the functions. Bonus points if your AI disagreed with me and you took its side. If meeting an internet stranger calls for de-risking first, Verify Me is the standing protocol. And the Feedback Clause starts after our first call or coffee: two or three paragraphs of honest first impressions, whichever way you decide, and you’ll get the same care back.

[ decoding transmission address… ]

What happens next. I read every message myself, and I reply to every one, usually within two days and never later than a week. Whatever you send goes to my inbox and nowhere else: it isn't stored by any service of mine, shared with anyone, or used for anything but replying to you, and I'll delete it the moment you ask. The one thing the site itself records, and only if you said yes to the banner, is Google Analytics: which sections get read and which buttons get clicked, in aggregate, with no names, no messages, and no advertising profile attached. The Privacy page has the rest.

Request a video call. Verify Me offers as many as you want, so here is how to ask for the first: send three times that work for you and I'll confirm the one that works for me too, usually within a day. I can't take calls at any hour, but I can nearly always find one that fits us both inside a week. Any platform you like; I default to whichever you name.

Or ask me to call you. If a phone call is easier than writing, leave a name, a number, and a good time. Submitting sends the request to me through a Google Form, which emails it to my inbox; the site itself stores nothing, and if the send fails you'll get the request as an email to copy instead.

By sending, you're giving me your name and number so I can call you back, via Google Forms. I keep them only for that, share them with nobody, and delete them the moment you ask.

If you don't fit a category. This site draws a lot of lines: two paths on the Family page, an age range, eleven dealbreakers. If your situation lands between them, one child and no adoption plans, say, or any other condition that reads as a maybe, don't self-reject. Get in touch and let's talk. The lines are there to save us both time, not to make the decision for me.