Cartells · a social network for vehicles
Every car has a reputation. None of them belong to a person.
A camera on the windscreen reads the plate ahead. You say what you saw out loud. It becomes a Note against that vehicle — and the only human who ever reads it is whoever claimed the plate.
A Note is speech. A Defect is a sensor reading. Nothing is ever both.
If a person said it, it is a Note. If a camera computed it, it is a Defect — owner-private, published nowhere. There is no third option and nothing may be both.
How the road sees youThe unit
One camera forward. One microphone in the cabin. Nothing pointed at you.
Every competing product in this category aims a lens at the driver. This one does not have a second lens.
Plate reading and transcription both run on the unit. A drive through a canyon with no signal records exactly as well as a drive through a city — the outbox drains when the connection returns, and every item carries its own identifier so a replay is never a duplicate.
You say it, and that is the whole interaction
“Note that silver pickup — let me merge.” The unit already has the plate in front of it. It matches your sentence to one of ten categories, keeps up to two hundred characters of what you actually said, and stops.
A dead lamp needs nobody to notice it
Brake, tail, centre-mounted stop and turn-signal lamps, and the registration sticker. Read from pixels, not judged by a person, and delivered to the vehicle's owner — never to a feed, never to the public, never to anybody else.
Most of what it sees, it throws away
A sighting that becomes neither a Note nor a Defect is discarded on the device. A fixed camera at a gate keeps a reading only if the plate is already on that site's roster — and it holds that roster as hashes, so it can test membership without holding a list of plates.
For drivers
How the road sees you
Claim your plate and you find out what thousands of other drivers have quietly said about the way that car is driven. Most of it, it turns out, is kind.
The ten categories, and they are permanent
Ten, frozen. Nobody can add an eleventh. There is no category for drunk, none for dangerous, none for criminal — and the reason there is no field for a legal conclusion is that a vocabulary which cannot express an accusation cannot be used to make one.
Four presets. That is the owner's entire vocabulary.
There is no free-text box here, and the absence is the guarantee. A reply that could say anything would need moderating, and a moderated appeal is not an appeal.
Someone let you in on a slip road three weeks ago and thought well of you for it. Until now there was no way on earth for you to find out.
Nothing reaches you until you ask for it
A plate nobody has claimed is a vehicle with no inbox. The Notes exist; there is simply no person on the other end, by design, because the system does not know who that would be.
The vehicle gets a right of reply
Every product that lets people say things about other people has this hole in it. Here the reply ships in the same release as the Note.
Defects
Your brake light is out. You are the only person we told.
A Defect is what a camera computed about a vehicle's condition. It is owner-private, always. There is no feed of cars with broken lights, and there is no route that would return one.
| Kind | Reads | Goes to | Floor |
|---|---|---|---|
| Brake lamp out | exterior luminance | owner | 0.95 |
| Tail lamp out | exterior luminance | owner | 0.95 |
| Turn signal lamp out | exterior luminance | owner | 0.95 |
| Centre high-mounted stop lamp out | exterior luminance | owner | 0.95 |
| Registration sticker expired | plate-surface OCR | owner | 0.98 |
| Road hazard | road surface | aggregate | 0.80 |
The sticker floor is higher than the lamps' on purpose. A false “your registration has expired” is a far more alarming thing to receive than a false “check your brake light”, so it has to clear a higher bar before anyone hears about it.
Six cameras saw the brake light out — that is a fact. One person says you cut them off — that is a claim. The difference between those two sentences is the entire trust model.
The same van with the same dead lamp every morning is one fact, not forty. Re-observation deduplicates; it never stacks up into a pile of complaints.
A Defect persists while it is true and resolves when the lamp is fixed. It is a state, not an accusation, so it has an end state that is simply solved.
A favour, not an accusation.
Everything about how Defects are handled follows from one decision: the beneficiary is the person who owns the vehicle. That is why they are never published, why re-sightings collapse into a single fact, why there is no free-text field anywhere on one — a sensor has no human author, so there is nothing to quote — and why the registry can be open while the Note categories stay frozen forever. A registry that only ever tells you something useful about your own car can safely grow. A vocabulary for describing other people cannot.
For fleets
Find it at the gate, not at the side of the road
A lamp that fails on Monday is a two-minute job in your own yard. The same lamp discovered on Thursday is a vehicle stopped somewhere it cannot be fixed, a driver waiting, and a load that is not moving.
One camera at the gate sees every vehicle that leaves. You do not need a unit in each cab to know the condition of the fleet — you need to watch the one place they all pass through.
Fourteen vehicles drove past this camera today that were not yours. Nothing about them was written down anywhere.
Against a road-side failure, which costs a vehicle, a driver and a delivery window.
It only keeps what is yours
Your gate camera holds your plate list as one-way hashes, not as text. It can answer “is this one of ours?” and it cannot answer anything else. Every plate that is not yours is discarded where it was read and never reaches a server.
Your drivers are not the subject
There is no cab-facing lens and no driver score, because there is no object anywhere in this system whose subject is a person. That is a fact about the schema, not a promise in a policy. Drivers work out very quickly which kind of camera they are sitting behind.
One list, and it empties
A Defect arrives in your private queue, it names one vehicle and one condition, and it goes away when the condition does. No severity theatre, no rolling score, no dashboard that only ever goes up.
Open the dashboardTwo hundred in-cab units and two cameras at the gate produce very nearly the same picture of your own fleet's condition. One of those costs about as much as a mid-size vehicle, and the other costs about as much as a decent laptop. The reason the in-cab fleet is not obviously better is geometry: a camera sees the vehicle in front of it, and your vehicles are rarely in front of each other. They are, however, all in front of your gate.
So the honest recommendation is the cheap one. Put a camera where the fleet converges. Add in-cab units when what you want is not your own condition but the road's — the hazards, the corridors, the intersections your routes actually run through, which is the surface the next page is about.
For insurers
A signal the insured cannot game, about a vehicle rather than a person
Telematics asks the policyholder's own phone how the policyholder drives. Everything here is observed from outside the vehicle, by strangers, and corroborated across independent cameras before it counts as anything at all.
Verified maintenance state
A timestamped, corroborated record that a vehicle's lamps and registration were sound on a given date — sourced from independent observers on the road rather than from the owner's own declaration. The thing self-reported inspection can never be.
Road-risk surfaces
Hazard aggregates rolled up by geography: which corridors, which intersections, which hours. Hazards carry no plate — the field does not exist on them — so this is an underwriting input with no targeting surface anywhere in it.
Defect-to-repair interval
How long between an owner being told a lamp is out and that lamp coming back on. Maintenance behaviour, measured rather than asserted, and measured on the vehicle.
Corroborated conditions
What the road was actually like around a given place and time — debris, obstruction, surface — assembled from every unit that passed through it. Context for a claim, derived entirely from Hazards, and never from anybody's account of anybody else.
Plate-free. There is no field on a Hazard that could carry one.
This system cannot tell you who was driving. It has no field for it, on any object, and it never will — a plate resolves to a vehicle, and a vehicle does not resolve to a person. Stolen plates, cloned plates, rentals and shared cars are why: plate is not driver is a fact about the world, not a caveat about our data.
That sounds like a limit and prices like an advantage. What you are buying is a condition signal about an asset, observed externally and confirmed by strangers, that carries no person-level record to hold, to breach, to disclose, or to have to explain. The narrower product is the one that survives the decade.
For developers
Any camera can join. None of them get to ask where a plate has been.
The public API is the same one our own hardware speaks. Three write endpoints, a handful of reads, bearer tokens for devices and cookies for people — and a short list of questions it will not answer for anyone, at any price.
// up to 50 per batch; the id is yours and is the idempotency key { "device_id": "9eea7676-59a3-4ec9-a301-d47ad7fdd42b", "notes": [{ "id": "01KZK69SG0QW4M7T2XBVHN8RDA", "plate_id": "FL-7HJ260", "category": "let-me-in", "source": "voice", "text": "waved me in on the ramp", "observed_at": "2026-08-09T18:42:11Z" }] } // every item comes back, in order, with its own verdict { "results": [{ "id": "01KZK…", "status": "accepted" }] }
accepted, duplicate or rejected, per item.
A duplicate counts as success — replay the same batch as often as you like. A rejection is
final and carries its reason; never retry one.
No offsets anywhere. A cursor is the last id you saw, so a page never shifts under you while new rows arrive above it.
| Device class | Contributes | Consumes |
|---|---|---|
| Aftermarket dashcams | Notes, Defects | owner alerts |
| Factory-fitted cameras | Defects | owner alerts |
| Fleet head units | Notes, Hazards | roster, defects |
| Depot gate cameras | Defects | roster |
| Charging stalls | Defects | owner alerts |
| Parking structures | Defects | roster |
| Roadside weather stations | Hazards | — |
| Maintenance vehicles | Hazards | hazard aggregates |
| Navigation apps | — | hazard aggregates |
A partner that only ever contributes Hazards never touches a plate at all — there is no plate field on a Hazard to touch.
These are the load-bearing part of the contract. A partner can build on a capability that was never granted to anyone, in a way they can never build on a policy.
Prove the unit
A unit ships with a factory secret. It presents that and receives an eight-character code to put on its screen. A device identity costs what the hardware costs, which is the entire point of the step.
A human authorises
Somebody signed in reads the code off the screen and types it. The bearer token is minted afterwards and delivered to the device — it never passes through a person's hands.
It syncs
From then on the unit posts batches and holds its outbox through any outage. An unauthorised token does nothing at all, which is what makes the first two steps worth having.
The architecture
The system knows plates. It infers vehicles. It never knows people.
Most products in this space make promises about what they will not do. The interesting parts of this one are the fields that were never added, so the promise is not something anybody has to keep.
A Plate is not a Vehicle. A Vehicle is not a Person.
Stolen plates, cloned plates, rentals, shared cars. Plate is not driver is a fact about the world before it is a policy about our data — which is why building on the opposite assumption fails on its own terms, not just on ethical ones.
Ten categories, permanently
The Note vocabulary cannot grow. New machine-detected conditions go into the Defect registry, which is open — and that openness is precisely what lets the Note vocabulary stay shut forever.
Three Notes per vehicle per day
One device, one plate, a hard daily ceiling. Following one car around and narrating it is not a feature that was left out; it is a thing the counter stops.
Nothing arrives unclaimed
You cannot notify an owner who has not claimed their plate, because by design the system does not know who that would be.
Off-roster reads are dropped
A fixed camera keeps only what is already on its own site's roster. It cannot accumulate a record of everyone who drove past it, because those reads are never written down.
Each of these was considered properly and closed. Vehicle state is machine-read; how a vehicle was driven stays a human judgement, said out loud by a person who was there.
A Note publishes, gets contested, gets answered, and can be taken down. It never merges with another Note, because two people saying the same thing is two people. A Defect never publishes, deduplicates on every re-sighting, and resolves when somebody fixes the lamp.
They behave differently because they are different: one is a claim and the other is a state. Every attempt to unify them collapses the distinction that makes the product defensible, which is why the vocabulary decides the architecture rather than the other way round.
Back to the road