Privacy

Who this covers

This notice covers the public Cognithamus website, XI accounts, and the XI operator console. They are one deployment with three audiences: anyone may read the public pages; anyone may create an account and reach a private workspace; and the operator console admits only registered operators.

What the public site collects

No cookies. No analytics. No trackers. Every public page — the home page, About, Careers, Documentation, the Institute, Research, Partners, Security and these legal pages — sets no cookies of any kind, runs no analytics or tag manager, and loads no third-party scripts, fonts, embeds or images. Typefaces are compiled into the site at build time and served from the same domain, so visiting a page makes no request to any other company.

There is no newsletter, no contact form and no comment system on the public site, and no field on any of those pages in which you could submit personal data to us. Creating an account is a separate, deliberate act on a separate page — see below for exactly what it stores.

Server logs

Cognithamus is hosted on Vercel. In the ordinary course of delivering a web page, it records connection metadata — IP address, user agent, requested URL and timestamp — in short-lived server logs. This is technically necessary to serve the site and to protect it from abuse. We do not combine this data with anything else, use it to build a profile, or sell it.

These logs are the hosting platform’s, kept on its own retention schedule and deleted by it — typically within days. We cannot extend that period, and we cannot selectively remove a single entry from it, so a deletion request cannot reach them. Nothing in those logs is joined to an account: there is no field anywhere that links an IP address to an account identifier.

What an account stores

XI is passkey-only. There is no password and no password reset flow, because a registered credential is the identity. Creating an account writes exactly five things, and this is the complete list:

• Your passkey. Its identifier and public key, a signature counter used to detect replayed sign-ins, the transports your authenticator supports, the label you typed when registering, and the times it was created and last used.
• An account record. A randomly generated identifier and the moment it was created. It contains nothing else — there is no name, email or profile field for it to contain.
• A workspace. Its name, which starts as “Personal workspace” and is whatever you rename it to, and the moment it was created.
• A membership record linking your account to that workspace, and the moment it was created.
• Dated lines in an event log recording that an account was created, that a workspace was created, and that a passkey was registered — each stamped with the time and with your account’s random identifier. These lines hold nothing else: not your workspace name, not your passkey’s label or identifier, not your IP address, and not which browser you used. The log exists so that we can answer what happened with evidence rather than from memory, and it can be added to but never edited or erased.

The same log records the acts that follow, if you ever perform them: connecting a repository, each measurement of it — started, completed or failed — and disconnecting it. Those lines record the shape of the act and not its subject: which method was used to reach the repository, how many buildings and refusals the measurement produced, and why a failure failed. The repository’s name, owner and address are never written into the log, and neither is any file, diff or line of your code.

No password is stored, no email address is collected, and you are never asked for your name. A passkey private key never leaves your device and is never transmitted to us. The only field that could identify you is the workspace name, because you type it — if you would rather it did not, call it something else.

We do not know where you are, what you clicked, or when you visited. There is no analytics table because there is no analytics.

What connecting a repository stores

Nothing, until you connect one. When you do, Cognithamus takes a temporary copy of the repository, measures it, and destroys the copy before the measurement is saved. The copy is never checked out to a working tree and is removed even when the measurement fails. What is kept is two things:

• The connection. The repository’s address as you gave it, its owner and name, how it was reached, and when it was connected.
• The measurement. Derived facts only: file paths and their sizes, the directory structure, commit identifiers and dates, which paths each commit touched, how the files relate to one another, and a record of what the measurement could not read.

No file contents. No diffs. No source text. These are not filtered out afterwards — they are never read, so there is no stage of this system at which they exist to be stored.

Contributors are pseudonymous

A repository’s history names the people who wrote it, and those people are not our users. They did not choose Cognithamus, and most will never know a measurement was taken.

So a contributor’s name is replaced with an opaque handle during measurement and never written to our database. The handle is specific to one repository, so the same person appearing in two repositories produces two unrelated handles and cannot be tracked between them. It is computed with a secret key held by the deployment, so nobody holding a copy of the data can work backwards from a handle to a name.

What this preserves is the only thing the measurement needed: how many distinct people touch a file, and which files tend to be changed by the same people. What it gives up is the ability to name anyone, which was never something Cognithamus should have been able to do.

Removing a repository

You can disconnect a repository from your workspace at any time. Disconnecting deletes the connection record and every measurement ever taken of it, not just the most recent one. You do not have to delete your account to remove a repository, and you do not have to ask us.

What the operator console stores

The operator console additionally stores operational records — tasks, meeting notes and institutional memory created by an operator — which may contain whatever text that operator typed. These are records of running Cognithamus itself and are not about the people who hold accounts.

Cookies used by the console

Two cookies exist, both strictly necessary, both first-party:

• xi_hq_session — a signed session cookie issued after a successful passkey authentication. It carries only the identifier of the credential that authenticated and an expiry time. It lasts 12 hours.
• xi_hq_challenge — a short-lived cookie holding a single-use cryptographic challenge during sign-in. It lasts 5 minutes.

Neither cookie is used for advertising, analytics or profiling, and neither is set for visitors who do not attempt to sign in. Because they are strictly necessary for a service you explicitly requested, no consent banner is shown — there is nothing optional to consent to.

Where data is processed, and by whom

Everything is stored and processed in the United States. Cognithamus is operated from Illinois, and these are the only three companies that handle any part of it:

• Neon — the PostgreSQL database holding accounts, workspaces, repository connections, measurements and the event log. Hosted on AWS in us-east-2 (Ohio).
• Vercel — hosting. It serves every page and runs the server code, and its logs are the server logs described above.
• Cloudflare — DNS for this domain. It resolves the address your browser asks for and holds no account data.

There is no analytics vendor, no advertising network, no email marketing platform, no customer-support tool and no data broker in that list, because none is used. If a fourth company is ever added, it is named here in the same change that adds it.

If you are outside the United States, your data is handled there — see If you are outside the United States below for what that means and what we have and have not put in place.

We do not sell your data, and there is no version of us that could

Cognithamus does not sell personal information, does not share it for cross-context behavioural advertising, and does not use it for profiling or automated decisions about you. That is a commitment, and it is also a description of the system: there is no advertising identifier, no tracking pixel and no analytics table, and an account holds no email address, name or password to sell.

Your passkey’s fingerprint or face never reaches us

Signing in asks your device to verify you — a fingerprint, a face scan, or a PIN. That check happens entirely on your own device. The biometric never leaves it, is never transmitted to Cognithamus, and is never stored, collected or possessed by us in any form. What reaches us is only the result — a cryptographic signature proving your device verified you — and that signature is not a biometric and cannot be turned back into one.

This is stated explicitly because Cognithamus is operated from Illinois, whose Biometric Information Privacy Act sets strict rules for anyone who collects or stores biometric identifiers. We do not collect or store any, and the design is what makes that true rather than a promise: there is no field in the database for one, and no request in which one could arrive.

How long it is kept, and how to delete it

Your account is kept until you delete it. Deleting it is one step from your workspace and needs no request to us. It removes the first four records listed above — every passkey registered to your account, the account row, the workspace and its name, and the membership — and signs you out. There is no archive copy, no soft-delete flag and no recycle bin, so once it is done nobody can restore it, including us.

The event log is the exception, and it is deliberate. The dated lines described above are not deleted, and a further line is added recording that the account was deleted. This is what lets us show that a deletion happened at all — a record that disappears along with the thing it records cannot evidence anything.

What remains is a timestamp and a random identifier. That identifier was generated when the account was made, was never derived from anything about you, and after deletion refers to no row in any table — nothing can be looked up with it, and it cannot be used to reconstruct your workspace, your passkey or its label, because none of those were ever written into the log. It records that an account existed and ended. It cannot show that it was yours.

Session cookies expire after 12 hours; challenge cookies after 5 minutes. Server logs are retained by the hosting provider for their standard, short period, and we cannot selectively delete an entry from them.

Email you send us

Writing to us is the one place you hand over ordinary personal data — your name, your email address, and whatever you put in the message. This applies in particular to job applications, which the careers page asks you to send by email along with a piece of your own writing.

That correspondence is held in the mailbox it arrived in, at Proton, and is used only to answer you or to consider your application. It is not added to any list, not used for marketing, and not shared. Application material is kept for up to twelve months in case a similar role opens, and deleted after that. Ask us to delete it sooner and we will.

Children

Cognithamus is not directed at children, and an account may not be created by anyone under 13. We do not knowingly collect personal information from a child under 13; if we learn that we have, the account and everything attached to it is deleted. If you are between 13 and 18, use it only with a parent or guardian’s permission.

Your rights

Wherever you live, you get the same rights here. Many US states now grant privacy rights — California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and a growing list of others — and they differ in the detail of who qualifies and who must comply. Rather than work out which apply to you, we extend all of the following to everyone:

• Know and access. Ask what we hold about you and get a copy of it.
• Delete. Erase your account and everything attached to it. You do not have to ask — it is one step from your workspace.
• Correct. Change anything inaccurate. In practice the only field you could correct is your workspace name, which you can already rename yourself.
• Portability. Receive a copy in a machine-readable format.
• Opt out of sale, sharing, targeted advertising and profiling. There is nothing to opt out of: none of those happen, which is why no opt-out link appears on this site.
• No retaliation. Exercising any of this changes nothing about the service you get. There is no paid tier to be moved off.

You may also appeal a refusal, as several state laws require: reply to our answer saying so, and a person will reconsider it and explain the outcome. If you are outside the United States you may in addition have rights under your own country’s law, including the right to complain to your local data protection authority.

In practice, the public site holds no personal data that could identify you, so such a request concerns an account if you hold one. Erasure you can perform yourself, from your workspace, without asking — with the single, stated exception of the event log above, which is retained because it is the evidence that the erasure happened. For access or portability, sign in and ask by email: the request has to come from someone holding the passkey, because that is the only way we can tell whose records are whose — we hold no email address or name to match you against, which is the same reason we cannot look you up on request.

If you are outside the United States

Cognithamus is operated from Illinois and runs entirely on United States infrastructure. Nothing about it is regional: there is no European instance, no data-residency option, and no way to hold an account whose data stays in your country. Creating one means your data is stored and processed in the United States, under United States law, which may protect it differently from the law where you live.

This site is not aimed at any particular country. It is published in English, prices are in US dollars where any appear, and there is no marketing, no local presence and no service directed at readers elsewhere. It is also not blocked anywhere, so people outside the US can and do read it — which is why this section exists rather than a claim that the question does not arise.

What is deliberately not claimed

Small operators often publish a paragraph implying legal machinery they have not put in place. Stating the absences plainly is more useful:

• No Standard Contractual Clauses have been signed with you, and no adequacy decision or transfer framework is being relied on. Where your data crosses a border, it is because you chose to use a service that is openly and only American, and the transfer is necessary to provide the account you asked for.
• No EU or UK representative has been appointed under Article 27. That obligation attaches to organisations offering services to people in those territories, and Cognithamus does not target them. If that changes, one will be appointed and named here before it does.
• No certification, seal or compliance scheme is held in any jurisdiction. The security page lists the same absences for security.

If your country’s law applies anyway

Some laws, including the UK and EU GDPR, can reach an operator abroad. If yours does, the controller is the individual operating Cognithamus, reachable at Cognithamus@proton.me, and the grounds we would rely on are these: performing the agreement you entered when you created an account and connected anything to it; and our legitimate interests in keeping the service secure, preventing abuse, and measuring the repositories people connect — an interest we have tried to make proportionate by collecting no name, no email address and no password, and by replacing every contributor’s name with a pseudonymous handle before it is stored.

The rights listed above are extended to everyone regardless of where they live, so there is no separate process to follow. You may also complain to your national data protection authority, and you do not have to raise it with us first.

If you would rather your data were not handled in the United States, the honest answer is not to create an account. Reading the public pages sets no cookie, sends nothing to any other company, and leaves nothing behind but a short-lived server log entry.

Contacting us

For any privacy question or request — including access, correction, erasure or objection — write to Cognithamus@proton.me. This is the only published contact route, and it is monitored.

Cognithamus is operated by an individual rather than a registered company, and no postal address is published. If you need one in order to exercise a legal right, ask by email and it will be provided to you directly.

Changes

If this notice changes, the date at the top of this page changes with it. There is no mailing list on which to notify you, because we do not hold your address.