This document is the public product commitment toward the user. It is distinct from the internal arbitration engine that judges, according to its technical principles, restructuring proposals for memory. The two must not be confused.
This charter is a central element of the product, not a marketing page. For a personal or organisational memory application installed locally and meant to preserve years of information, the stakes are not only confidentiality: they also concern the power that a persistent memory gives to its owner, its administrators, and the models that exploit it.
This application is designed to help a person, a team, or an organisation find, connect, and understand its own information over time.
It must not become an opaque device of surveillance, social control, manipulation, or confiscation of people's memory.
We consider digital memory a sensitive asset: it can contain facts, hypotheses, relationships, errors, intimate traces, and contextual elements. It must therefore remain governable, explainable, reversible, and under the effective control of those to whom it relates.
The important idea: a personal knowledge base is not "just" a vector database or a search engine. Over time, it can become an operational representation of the life, work, relationships, and decisions of an individual or a collective.
| Value | Concrete commitment |
|---|---|
| Sovereignty | Data, indexes, embeddings, metadata, and backups belong to the user or the organisation that hosts them. |
| Local-first | The product must run locally by default; no content may be transmitted to a third party without an explicit, visible, and traceable action. |
| Consent | Any collection, indexing, import, analysis, or exposure of personal data must rest on a legitimate, understandable, and reversible basis. |
| Minimisation | Collect, retain, and infer only what is useful for an explicitly chosen purpose. |
| Reversibility | The user must be able to export, correct, de-index, purge, delete, and rebuild their memory without depending on the publisher. |
| Transparency | The application must clearly distinguish sources, extracted facts, system inferences, generated summaries, and uncertainties. |
| Non-manipulation | The system must not arrange information to discreetly influence the user's choices, opinions, relationships, or behaviour. |
| Human dignity | A person must not be reduced to a profile, a score, a social graph, or a series of probabilistic inferences. |
| Durable security | Protection must not concern only current access; it must anticipate future risks of leakage, change of administrator, resale, conflict, or compromise. |
| Responsibility | Advanced capabilities must be accompanied by audits, logs, access controls, and limits suited to their power. |
The charter sets out rights that are explicit, understandable, and technically enforceable.
The user retains control over:
The product must not lock these elements into an inaccessible format. A complete, documented, and exploitable export outside the product must exist: original sources, data schema, metadata, provenance links, indexes where technically exportable, and configuration rules.
For each result, the application must be able to answer questions such as:
A search response should ideally display a provenance chain: result → chunk or fact → original source → ingestion date → applied transformation.
For a hypermnesic product, provenance is an ethical requirement as much as an engineering one. Without it, the system easily creates false organisational memories.
An algorithmic memory must be correctable, not only deletable.
The user must be able to:
It is preferable to model correction as a governance layer: the original can be preserved when required for audit, but its status, reliability, and future use must be explicitly controllable.
Deletion must cover more than the source file.
When a user requests the erasure of an indexed element, the system should offer a clear mode covering, depending on the chosen policy:
The charter must be honest about constraints: deletion inside an immutable backup is not instantaneous. It must specify the maximum purge delay, the applied mechanism, and the fact that deleted elements are excluded from any re-indexing or response before full purge.
The application must recognise that not all memories have the same owner or the same sensitivity.
It must allow robust separation between, for example:
This separation must not be only visual. It must affect encryption keys, indexes, access rights, retention policies, export tools, and the agents authorised to consult each space.
The level of risk varies greatly depending on whether it concerns an individual, an association, or a company. The charter recognises this difference instead of pretending a single setting fits everywhere. This difference is integrated in the form of three profiles managed separately: Personal, Professional, Public.
| Context | Main risk | Recommended principle |
|---|---|---|
| Individual | Intimacy, loss of control, data recovery by a relative, an employer, or an attacker | Individual control, encryption, private spaces, simple deletion, and complete export |
| Association | Internal conflicts, exposure of vulnerable members, confusion between collective memory and personal data | Collegial governance, role-based rights, explicit consent, limited retention |
| Company | Surveillance, employer–employee asymmetry, leakage of secrets, diverted proof or traceability | Strict purposes, compartmentalisation, audits, prohibition of automated evaluation of people |
For organisations, the conditions of "constitution of the memory space" are configurable at creation via a YAML file:
An association may legitimately keep minutes and decisions. This does not authorise it to turn volunteers' private exchanges into a commitment-ratings system. A company may index project documentation. This does not justify silently analysing all employee messaging.
A strong charter lives on clear, non-negotiable prohibitions. The fact that these points reduce some possible markets must never be taken into consideration.
We do not develop, promote, or normalise the use of our product for clandestine surveillance, repression, harassment, stalking, spying on a relative, collection of private information without consent, or automated evaluation of people in contexts where they face a strong power asymmetry.
This translates as follows:
The last point is particularly important for a tool that can become a long-term memory repository: ending a subscription must never become informational hostage-taking.
A hypermnesic application must accept that memory changes meaning over time. A note that is trivial today can become sensitive five years later; an old error can keep resurfacing in results; a change of administrator can radically alter the risk.
The following commitments are therefore added:
Our technology strengthens the memory of its users; it must not increase their dependence, their exposure, or their surveillance.
Data remain locally controlled, exportable, correctable, and erasable. Sources, transformations, and inferences remain distinguished and traceable.
We refuse hidden profiling, data sales, behavioural advertising, clandestine surveillance, and automated evaluation of people.
We design for the long term: security, reversibility, portability, the right to be forgotten, and continuity of access take precedence over capture and lock-in.
We consider that the best digital memory is the one that remains at the service of autonomy, discernment, and human dignity.
The key is to translate each principle into verifiable product mechanisms: encryption, provenance log, retention policies, separation of spaces, access control, complete export, derivative deletion, audit, and governance configuration. Without this translation, an ethics charter remains a statement of intent; with it, it becomes an architecture of trust.