Only one of them should be yours.
This month the Wall Street Journal published a piece with a title that does most of the work: “AI Knows What You Did Online. Now Your Employer Does, Too.” The reporting is worse than the title. Employers are hiring AI firms to trawl the digital footprints of job candidates. Not a quick search of your name, but a deep sweep of years-old posts, forgotten forum accounts, the comment you left at 2am in 2014. Some firms offer continuous monitoring of existing staff. Some use facial recognition to match the face on an anonymous account to the face on your badge, so that even the opinions you were careful to keep unsigned get filed under your name.
Read it carefully and you notice the story isn’t really about surveillance. Surveillance is watching. This is something else: it’s memory. A permanent record of you, assembled without your knowledge, indexed against your name, and consulted at precisely the moments that matter most to you (a job offer, a promotion, a background check), by people whose interests are not yours.
And the employer screeners are only the newest members of a very old club. The ad platforms have been keeping a memory of you for twenty years; it’s how they know to show you the trainers you looked at once, forever. Every service with a login keeps one. Every “free” product is funded by one. There are, right now, dozens of institutional memories of you in the world. Detailed, durable, machine-readable. And not a single one of them is for you. The law says you can ask for a copy, even ask them to fix it. What lands is an export you can’t read, in a shape you can’t use, frozen the moment it leaves their servers. The right is real. The memory still isn’t yours.
The case from the inside
Earlier this month Mira Murati published an essay at Thinking Machines Lab called “The future worth building is human.” As CTO of OpenAI, she ran the engine room of the most centralised AI project on earth, so it’s worth reading what she argues now. Compressed: AI worth building should extend human will and judgment rather than replace them; the future that deserves to exist is distributed, customisable AI shaped by the people it serves, not centralised models imposing one set of values on everyone; and people should own and cultivate their own knowledge rather than rent access to it.
You can be cynical about conversion narratives. But when someone who helped build the centralised thing writes that the future is distributed and user-owned, it’s worth sitting up. She isn’t describing a nicer chatbot. She’s describing a change of ownership.
A useful memory saves more than it surfaces
A memory that is actually useful has to save far more than it will ever show you.
You never know in June which moment you’ll need in November. The offhand remark that turns out to be the start of a company. The name of the person you met once at a conference who, eighteen months later, is exactly who you need to call. The restaurant your friend mentioned loving, back before she got ill, when you’re trying to choose somewhere for her birthday. None of these looked important at the time. A memory that kept only what seemed significant in the moment would be a diary of the obvious, and useless for the one thing memory is actually for: being surprised by what turns out to matter.
So any real memory over-saves. Radically. And that property, total and indiscriminate retention, is exactly what makes the WSJ story monstrous and a personal memory liberating. Over-saving about you, held by someone else, is a loaded archive: everything you’ve ever done, retrievable by people with power over you, on their schedule, for their purposes. Over-saving by you, held on your own machine, is just remembering. It’s what your own brain does, minus the decay.
Same mechanism. Opposite in every way that matters. The only variable that flips it is who holds it. Sovereignty isn’t a nice-to-have feature of an ethical memory. It is the thing that makes memory ethical at all.
The gold standard already exists
If you want proof that the privacy field already knows this, look at the one category where the stakes stopped being hypothetical. When Mozilla’s Privacy Not Included researchers reviewed period-tracking apps (data that, post-Dobbs, can end up in a courtroom), the only app they would endorse without reservation was Euki. Its distinguishing feature is almost comically simple: everything stays on the device. Nothing to subpoena from a server, nothing to breach, nothing to quietly sell.
The lesson generalises, and it’s blunter than most privacy-policy debates: when data is genuinely intimate, the liability isn’t sharing it. The liability is someone else holding it at all. No policy, no encryption-in-transit, no pinky-promise DPA fixes that. Only architecture does.
A memory of your whole life, built from your conversations, your meetings, your notes and your reading, is the limit case of intimate data. It should be held to the limit-case standard.
Why we built it this way
Ostler didn’t start as a privacy product. It started because taking notes ruins the moment. Sitting across from someone you actually want to listen to, half-present, transcribing instead of thinking. That’s a bad trade, and everyone who’s made it knows it. The original promise of Ostler was small and human: be in the conversation. It will remember for you.
Everything since has been working out what that promise requires. Three things, it turns out.
It has to let you be present. Capture that works without you performing for it, so the remembering happens and you don’t have to.
It has to be grounded in your whole life, not one app’s slice of it. A memory built only from your calendar knows when you met someone; a memory built from your meetings, messages, notes and reading together knows who they are to you. Ostler compiles all of it into a private wiki of your own life, on your own Mac.
And it has to be yours to use. Ostler’s memory is plain markdown files on your machine. Open them in Obsidian. Search them. Correct them. Copy them. Delete them. There is no server-side twin, no export button standing between you and your own past, no terms of service that can change what your memory is allowed to be. It’s not an account. It’s a possession.
The institutional memories of you aren’t going away. The screeners, the platforms, the brokers. They’ll keep their archives, and you will never get to read them. The only response that scales is to have a better memory of your own: fuller, fairer, on your side, and on your machine.
Everyone is building a memory of you.
Only one of them should be yours.