Privacy
Privacy here is load-bearing, not a settings page.
This page says, in plain language, what Cartographer does with what it learns — and what it is built to be unable to do. It applies the same standard to itself as to the product: this site runs no trackers, no analytics, and sets no cookies.
Consent
Per source. And refusal is terminal.
Nothing is read without an explicit grant, source by source — consent to one source is never stretched to cover another. Consent is a state machine in the code, and its states are not symmetric: refused is terminal. There is no code path from "no" back to "ask again." A collector pointed at a refused source doesn't retry quietly; it refuses to run.
For sources where you want structure without content, a headers-only mode exists: who wrote to whom and when, without reading a single body.
Deletion
Forgetting that actually forgets.
You can forget a person, by name. Because everything derived in the map is indexed to the episodes it came from, deletion walks the derivations too: the person's episodes go, and every summary or observation that leaned on them is rebuilt without them — not merely hidden, rebuilt. A deletion index records that the forgetting happened without keeping what was forgotten.
Portability
Your map is yours. You can leave.
The map is built from your correspondence and it belongs to you. A full export — episodes, profiles, receipts, in open formats — is a launch requirement currently in development, and it will not be a loyalty test: leaving with everything is the intended use of it, not the discouraged one.
Local-first
It runs on your machine.
The reference deployment today is local: the graph lives in a database on your hardware, state in local files. Local is not the afterthought edition — it is where the system was built and tested first. One honest caveat: the deeper reading pass sends text to a language model to do its coding, and which model — including where it runs — is your configuration choice, not ours. Hosted conveniences beyond that are optional additions, never requirements.
Never collected
What it will not take, at any setting.
- Anything from a source you haven't granted. No grant, no read — and a refusal ends the question permanently.
- Content from a headers-only source. Structure only means structure only.
- Judgments on the never-scored list. Your raw mail stays your raw mail — but no judgment on the banned list is ever derived from it: no discretion or trustworthiness scores, no clinical labels, nothing computed on protected attributes. The ban is enforced in code, not in policy.
- Anything at all from this website. No trackers, no analytics, no cookies. The waitlist form stores exactly the fields you can see, only when you submit them — and a reply to any note we send you, asking to be deleted, deletes it.