# Privacy and trust boundaries

> Legacy 0.3.1 is supported and retains RPC workers and SQLite memory. Requires Pi 0.99.2 or newer. These docs follow legacy maintenance, not the unchanged v0.3.0 tag. References to master describe the former branch name.

Web page: https://igorwarzocha.github.io/pi-clawa/legacy/docs/reference/privacy/

Clawa's privacy posture is a behavioral contract carried in the home, not an operating-system
sandbox. The extension runs with the same user permissions as Pi. Installed extensions can execute
code and read files available to that user.

## Provider boundary

Every model call can include:

- the active conversation and relevant Pi context;
- hydrated `CLAW.md`, `HUMAN.md`, `CLAWAS.md`, `CURIOUS.md`, and `TOOLS.md`;
- an optional root `CLAWA` image;
- nested instructions reached during work;
- recalled material when the model explicitly uses `recall`.

Therefore “stored locally” does not mean “never sent to a provider.” Choose a provider appropriate
for the home's material. Never put credentials, tokens, recovery codes, or private account IDs in
living documents or visual identity assets.

SQLite memory is not injected automatically, but matching rows can be returned by `recall` and then
enter conversation context.

## Home isolation

Clawa excludes global and outside-parent instruction files from its prompt while preserving
instructions physically inside the home. This isolates persona and operating posture; it does not
block file tools from reading outside the home when normal Pi permissions and instructions allow it.

`.pi/SYSTEM.md` is ignored to avoid conflicting identity prompts. `.pi/APPEND_SYSTEM.md` remains the
supported Pi-level addition point.

## External action

Onboarding calibrates local notes, private chat, and external action in ordinary conversation. The
result guides model judgment. It is not a separate permission engine that technically prevents every
send or command.

A Pulse may perform external work when its own `PULSE.md` explicitly authorizes that work. Public
Discord output requires explicit route blocks, which is a stronger delivery guard on that adapter,
but the Discord worker and gateway still operate with local process permissions.

## Secrets and git

Keep these out of public repositories and bug reports:

- `.pi/clawa-memory.sqlite`;
- `.pi/claw.jsonc` when worker paths or names are private;
- `.pi/clawa-discord/`, especially `config.env`;
- private living documents, worker notes, vault pages, and sessions;
- gateway logs containing room or delivery context.

When reporting a problem, reduce it to the behavior, redacted config shape, and relevant log lines.
Do not attach the whole home.