Where PersonaKit data lives, what a model sees, what assistants see, and what is not claimed.

Trust and data boundaries

What is true in 0.1

• Where data lives: a SQLite file on your machine. PersonaKit uploads nothing.
• What a model sees: only turns you wrote, sent to the model you configure through your own CLI login, under that provider's terms.
• What assistants see: only what the MCP server returns, which excludes restricted and hidden memories. Evidence quotes are shortened to 240 characters and email addresses in them are masked; the store keeps the quote as you wrote it.
• Credentials: a memory whose text has the shape of a common API key or private key is rejected and not stored.
• Read log: each read records the time and two counts (returned, withheld) in the local store. It never records the question or memory text.
• Statistics: personakit stats prints counts to your terminal. It never includes memory text.
• Deletion: personakit forget removes a memory and its evidence.
• Cost control: each sweep has a call budget you set.

What is not claimed

• Extraction is a model's guess. Review is how you correct it.
• Quotes supplied through personakit_propose come from the assistant and cannot be verified; review labels them.
• A memory an assistant already received cannot be recalled from that conversation.
• Detection of pasted content and secrets is heuristic. Review before sharing a store.
• This documentation is not an independent security audit.

Reporting a problem

Use private vulnerability reporting on the PersonaKit open-source repository on GitHub.