AI Sources & Privacy 🔍🔒

We'll show you what the AI actually looked at before it answered. And the notes you'd rather it never saw? Those stay hidden.

← Home: ObsiKO 101 · Agent basics → AI Agent

No matter how convincing an answer sounds, it's hard to trust when you don't know where it came from. And on the flip side, some notes — journals, health records, contracts — you simply never want handed to an AI.

ObsiKO splits this into ① showing the evidence and ② drawing a boundary. Nothing to switch on: both work from the very first run. 😊

1️⃣ Where did this sentence come from? — Citations [S1] 📌

When you spot a small number like [S1] or [S2] in an answer, it means "this bit came from that note."

• Click it and the note opens right away. Go check for yourself that it really says that!
• The same note keeps the same number throughout an answer. If [S1] shows up several times, it's all one source.

🛡️ Made-up footnotes never reach your screen. The numbers are issued by ObsiKO, not by the AI. When a search tool finds a note, ObsiKO stamps the number on it — and if the answer contains a number we never issued, we quietly strip it before drawing. A citation with nothing behind it is worse than none at all: it tricks you into thinking someone checked.

And don't worry if your notes contain real code like arr[S1] — anything inside a code block is left completely alone. 😉

💡 Where does this work? On the desktop Claude engine, and on every chat-only engine (Claude, Gemini, OpenAI) — so you get source numbers on iPhone, Android, and web too. The only two that don't have it yet are the CLI-based Gemini and Codex engines (they don't issue the numbers).

2️⃣ The evidence behind this answer 🧾

When a task finishes, the completion card carries one collapsed line:

3 sources · 1 read in full · 2 excluded by protection rules

Expand it and you'll see the notes that were actually handed to the model for this answer. Click a filename to open it.

• read — the note whose full body was read. That's the heaviest kind of evidence, so it sits at the top of the list.
• search — only the title and a short snippet went over. The model didn't read the whole thing, but it did see that much, so we list it honestly.
• N excluded by protection rules — a count of how many notes you blocked in ③ were filtered out (names are never shown).

💡 This is not a log of "how many tools were called" — it's a record of what actually reached the model. Searches that returned nothing aren't counted, and notes that contributed only a snippet are labelled "search" rather than dressed up as sources.

3️⃣ Keep this note away from the AI 🚫

Blocking a single note — frontmatter ai: deny

Add one line to the note's frontmatter and you're done.

---
title: Counselling notes 2026
ai: deny
---

Besides deny, we also understand false, no, off, none, exclude, and private — all the same meaning. → Frontmatter Properties

Blocking whole folders — .obsiko-ai-ignore

Create a file called .obsiko-ai-ignore in your vault's top folder and list one rule per line, just like .gitignore.

# Nothing under these folders goes to the AI
Journal/
Private/
draft-*.md
Material/**/contract*

• folder/ = that entire folder · * = any characters (won't cross a folder boundary) · ** = including subfolders · # = a comment
• Start a line with / to match only at the top of the vault. Without it, the rule matches at any depth.
• Re-allowing with ! is deliberately unsupported. Exception rules end up becoming the hole — if any rule matches, it's blocked, full stop.

How thoroughly is it blocked?

Checking "right before a tool runs" is not enough — a one-line preview in search results leaks content just as effectively. So ObsiKO applies the same rule at every doorway: vault search, document-content search, table (.base) queries, semantic indexing, semantic search, file reads, file moves, and memory recall.

• Moving files is blocked too — the agent can't even relocate or rename a protected note (the principle is to not touch it at all).
• Memory recall is filtered too — if a memory file you've built up is protected, it never gets pulled into the conversation. → 16-11 Personal Memory
• Topic clusters, connection-graph exploration, and link suggestions (Backlinks & Outline · Dashboard) also compute with protected notes excluded entirely, and the same applies to the doorway opened by External AI apps (Settings & Themes).
• Your conversations with the AI (_ObsiKO/chats/) are left out of regular search, semantic search and topic clusters; the in-app AI finds them only through "find past conversations." External AI apps can't read them at all (agreeing to keep them in your vault isn't the same as handing them to another app). Old AI answers it finds never get a source number ([S#]). → Personal Memory
• 📎 Files you attach to a chat are filtered too — if a protected note or image is in the attachment list, neither its content nor its name is sent to the AI; you just get a note saying how many were left out.
• 📱 Chat-only mode on phone and web is identical — chat AI runs on different code from the desktop agent, but the checks are funnelled through a single gate that covers search, listing, reading, writing, and moving alike. A protected note won't even appear in chat's note listings, and it drops out of backlink results too.

Semantic search in particular is excluded at indexing time — no embedding is ever created, so it can't surface later. And in case the index has gone stale, we filter again at search time. If the rules file itself can't be read, we don't quietly let things through: everything closes.

⚠️ An honest limitation: the Gemini and Codex engines ship their own file tools (file reads, shell) that bypass ObsiKO entirely, so we can't guarantee 100% coverage there. If your vault has protection rules and you pick one of those engines, we'll tell you once — for genuinely sensitive notes, use the Claude engine.

Also, this boundary governs what gets handed to the agent. It won't stop you from opening a note yourself and pasting it into the chat. 😉

One natural side effect

A protected note isn't in the semantic index, so it won't appear under "Found by meaning" in unified search either (that's intended). Keyword search still finds it as usual, and the note is just an ordinary file in your vault. → Search & Navigation

4️⃣ We ask before sending to an external AI 🔐

The first time something goes to Anthropic (Claude), Google (Gemini) or OpenAI with your API key, ObsiKO first asks "Send this to ○○ for processing?"

• It shows what is being sent (the conversation and attached notes, images, audio/video) and, in a line or two, how that company handles it — only facts checked against each company's official documents.
• Nothing is sent unless you press [Allow and send]. "Don't send", Esc and tapping outside all mean "not this time".
• We avoid pop-up windows where we can — in the AI panel the check appears as a card inside the conversation, and for ✨ AI spell check it appears inside the spell check panel.
• Gemini is for people 18 or older under Google's terms, so the check shows that line too.
• Once allowed, the same company and the same kind of content won't be asked about again. Allowing text doesn't cover images or audio — those are asked about separately the first time.
• Things that run automatically (like automatic personal memory) are skipped without asking if you haven't allowed them.
• You can withdraw permission per company under AI Agent ▸ Agent options ▸ External AI sending allowed. After that you'll be asked again next time.
• On-device AI (Apple Intelligence and the like) never leaves your device, so it doesn't ask.

💡 Content sent on Google Gemini's free tier may be used by Google to improve its products and reviewed by people (Google's terms). Protect sensitive notes with ai: deny or use a different AI.

At a glance 📋

← Previous: AI Billing Guide · Home · Next: Personal Memory →