When you feed private material (courses, calls, notes) to AI tooling, the usual question is which model sees it. The question that matters here is a different one: which processes can read the place where you store it.
This article walks through how that was handled in the Learning Vault of Jarvis, my local system. What follows comes from a document in the repo that records the vault’s canonical path and from a commit message; it is not a measurement. The document is dated 2026-10-06.
The basic split: code in the repo, data outside
According to the canonical-path document, code lives in the repo and private data (course material, transcripts, distilled records and the FTS index) lives outside Git. The same document says the directory is outside every repo.
The leak channels, one by one
Git. Anything inside a repo can end up versioned. The document places the vault outside every repo.
Docker bind mounts. Docker’s documentation says a bind mount mounts a file or directory from the host into a container, and that bind mounts have write access to the host by default. The vault document names a directory bind-mounted into the voice container and states that anything stored there is readable by the container. The vault sits outside that mount.
Build contexts. The document says the vault is not in any Docker build context, and that builds use git archive of the repo. Git’s documentation describes git archive as creating an archive containing the tree structure of the named tree, that is, of what Git tracks.
Logs. The document says the vault logs ids and counts, not text.
Worktrees. The document also rules out a worktree: it says a worktree is disposable and its inbox is one git clean away from being lost.
Additional hardening
The message of a review commit for the vault lists transcript outputs with 0700/0600 permissions. The path document also describes the vault directory as owner only.
The lesson
List every channel the data could leave through (Git, bind mounts, build contexts, logs, worktrees that get cleaned) and choose a location none of them touches. In my view, privacy architecture is mostly deciding where data is not allowed to be.
Which channels have you checked in your own local setup? Tell me and we can compare notes.
