AI Sources & Privacy 🔍🔒

We'll show you what the AI actually looked at before it answered. And the notes you'd rather it never saw? Those stay hidden.

← Home: ObsiKO 101 · Agent basics → AI Agent

---

No matter how convincing an answer sounds, it's hard to trust when you don't know where it came from. And on the flip side, some notes — journals, health records, contracts — you simply never want handed to an AI.

ObsiKO splits this into ① showing the evidence and ② drawing a boundary. Nothing to switch on: both work from the very first run. 😊

---

1️⃣ Where did this sentence come from? — Citations [S1] 📌

When you spot a small number like [S1] or [S2] in an answer, it means "this bit came from that note."

• Click it and the note opens right away. Go check for yourself that it really says that!
• The same note keeps the same number throughout an answer. If [S1] shows up several times, it's all one source.

🛡️ Made-up numbers are marked “unverified”. The numbers are issued by ObsiKO, not by the AI. When a search tool finds a note, ObsiKO stamps the number on it — and if the answer contains a number we never issued, we draw a dashed “unverified” tag in its place. We don't quietly delete it, because then the sentence would look perfectly fine and you'd assume someone checked it. When you see that tag, check that sentence yourself.

And don't worry if your notes contain real code like arr[S1] — anything inside a code block is left completely alone. 😉

💡 Where does this work? On the desktop Claude engine, and on every chat-only engine (Claude, Gemini, OpenAI) — so you get source numbers on iPhone, Android, and web too. The only two that don't have it yet are the CLI-based Gemini and Codex engines (they don't issue the numbers).

2️⃣ The evidence behind this answer 🧾

When a task finishes, the completion card carries one collapsed line:

3 sources · 1 read in full · 2 excluded by protection rules

Expand it and you'll see the notes that were actually handed to the model for this answer. Click a filename to open it.

• read — the note whose full body was read. That's the heaviest kind of evidence, so it sits at the top of the list.
• search — only the title and a short snippet went over. The model didn't read the whole thing, but it did see that much, so we list it honestly.
• N excluded by protection rules — a count of how many notes you blocked in ③ were filtered out (names are never shown).

💡 This is not a log of "how many tools were called" — it's a record of what actually reached the model. Searches that returned nothing aren't counted, and notes that contributed only a snippet are labelled "search" rather than dressed up as sources.

✅ Leaving a note that you checked it — 'Mark as verified'

It's a good idea to check an AI-made note against its originals and sources once. When you're done, keep that note open and run 'Mark as verified (checked against sources)' from the command palette (⌘P).

• A verified: record (who and when) is added to the note's frontmatter. You can see it in the note's properties.
• It marks the note as "a person checked its content and sources" — a different record from simply having looked at it.
• Running it again doesn't pile up entries; it just updates the time you checked.

---

3️⃣ Keep this note away from the AI 🚫

Blocking a single note — frontmatter ai: deny

Add one line to the note's frontmatter and you're done.

---
title: Counselling notes 2026
ai: deny
---

Besides deny, we also understand false, no, off, none, exclude, and private — all the same meaning. → Frontmatter Properties

Blocking whole folders — .obsiko-ai-ignore

Create a file called .obsiko-ai-ignore in your vault's top folder and list one rule per line, just like .gitignore.

# Nothing under these folders goes to the AI
Journal/
Private/
draft-*.md
Material/**/contract*

• folder/ = that entire folder · * = any characters (won't cross a folder boundary) · ** = including subfolders · # = a comment
• Start a line with / to match only at the top of the vault. Without it, the rule matches at any depth.
• Re-allowing with ! is deliberately unsupported. Exception rules end up becoming the hole — if any rule matches, it's blocked, full stop.

How thoroughly is it blocked?

Checking "right before a tool runs" is not enough — a one-line preview in search results leaks content just as effectively. So ObsiKO applies the same rule at every doorway: vault search, document-content search, table (.base) queries, semantic indexing, semantic search, file reads, file moves, and memory recall.

• Moving files is blocked too — the agent can't even relocate or rename a protected note (the principle is to not touch it at all).
• Memory recall is filtered too — if a memory file you've built up is protected, it never gets pulled into the conversation. → 16-11 Personal Memory
• Topic clusters, connection-graph exploration, and link suggestions (Backlinks & Outline · Dashboard) also compute with protected notes excluded entirely, and the same applies to the doorway opened by External AI apps (Settings & Themes).
• Your conversations with the AI (_ObsiKO/chats/) are left out of regular search, semantic search and topic clusters; the in-app AI finds them only through "find past conversations." External AI apps can't read them at all (agreeing to keep them in your vault isn't the same as handing them to another app). Old AI answers it finds never get a source number ([S#]). → Personal Memory
• 📎 Files you attach to a chat are filtered too — if a protected note or image is in the attachment list, neither its content nor its name is sent to the AI; you just get a note saying how many were left out.
• 📱 Chat-only mode on phone and web is identical — chat AI runs on different code from the desktop agent, but the checks are funnelled through a single gate that covers search, listing, reading, writing, and moving alike. A protected note won't even appear in chat's note listings, and it drops out of backlink results too.

Semantic search in particular is excluded at indexing time — no embedding is ever created, so it can't surface later. And in case the index has gone stale, we filter again at search time. If the rules file itself can't be read, we don't quietly let things through: everything closes.

⚠️ An honest limitation: the Gemini and Codex engines ship their own file tools (file reads, shell) that bypass ObsiKO.

• When 'When AI changes notes' is set to 'Ask for big changes' (default) or 'Answer only', protected notes are never put in the working copy, so they simply aren't where those engines work. → 16 AI Agent
• But if you set it to 'Change right away', or in automatic runs such as routines, they work directly in the vault, so we can't guarantee 100% coverage. In that case, if your vault has protection rules, we'll tell you once — and turning on 'Block bypassing engines in protected vaults' (off by default) in the AI panel's Options (≡) stops Gemini and Codex from running at all. For genuinely sensitive notes, use the Claude engine.

Also, this boundary governs what gets handed to the agent. It won't stop you from opening a note yourself and pasting it into the chat. 😉

One natural side effect

A protected note isn't in the semantic index, so it won't appear under "Found by meaning" in unified search either (that's intended). Keyword search still finds it as usual, and the note is just an ordinary file in your vault. → Search & Navigation

---

4️⃣ We ask before sending to an external AI 🔐

The first time something goes to Anthropic (Claude), Google (Gemini) or OpenAI with your API key, ObsiKO first asks "Send this to ○○ for processing?"

• It shows what is being sent (the conversation and attached notes, images, audio/video) and, in a line or two, how that company handles it — only facts checked against each company's official documents.
• Nothing is sent unless you press [Allow and send]. "Don't send", Esc and tapping outside all mean "not this time".
• We avoid pop-up windows where we can — in the AI panel the check appears as a card inside the conversation, and for ✨ AI spell check it appears inside the spell check panel.
• Gemini is for people 18 or older under Google's terms, so the check shows that line too.
• Once allowed, the same company and the same kind of content won't be asked about again. Allowing text doesn't cover images or audio — those are asked about separately the first time.
• Things that run automatically (like automatic personal memory) are skipped without asking if you haven't allowed them.
• You can withdraw permission per company under the AI panel's Options (≡) ▸ External AI sending allowed (next to 'Auto-build personal memory' and 'Save chat transcripts to vault'). After that you'll be asked again next time.
• On-device AI (Apple Intelligence and the like) never leaves your device, so it doesn't ask.

💡 Content sent on Google Gemini's free tier may be used by Google to improve its products and reviewed by people (Gemini API terms ↗). The paid tier isn't used to improve products (pricing ↗). Protect sensitive notes with ai: deny or use a different AI.

---

At a glance 📋

---

← Previous: AI Billing Guide · Home · Next: Personal Memory →