How a home stays yours
"Yours, not theirs" means ownership, not invisibility. Yours: you can read all of it, take it as a file, hand it to a different assistant, or delete it, and no assistant vendor holds it. It does not mean nobody could ever see it. Here is exactly who can.
The link is the account. A home's link carries a 256-bit secret. The server keeps a hash of it (to find your home) and your entries encrypted under a key that only that secret unwraps. At rest — in the database, in a backup, in a copy someone steals — every home is ciphertext with no key beside it. Nobody, including the operator, can read a home back without its link.
The secret rides in the #fragment. Browsers never send it to the server in the URL, never put it in a Referer, and it does not land in server logs. The page sends it in a header when it reads or writes; the server uses it for that one request and does not keep it. In that moment the operator's code has your key in memory — so what you are trusting is that the code does what it says, and the code is open.
Each assistant gets its own door. A door is a separate secret that unwraps the same key. The assistant's vendor holds the door, not your link. A door can read, and add, and take back only what it itself wrote. Close a door and that assistant is out; your link is untouched. Because Claude's connector setup takes only a URL, the door secret is part of the door URL — which is why doors are separate and disposable.
Leaks are handled by a new link, not by recovery. "New link" re-keys the home; the old link goes dead everywhere at once.
What an assistant writes is visible and undoable. Every entry shows who wrote it and when. Remove anything. Only you can remove a rule — a door that could delete a rule is a door that can delete the point.
Rules are capped at twelve and facts are not. They are separate stores, and that is not tidiness. If rules and facts share one budget, then one day a fact you did not think mattered pushes out a rule you were relying on, silently. A system where a rule can be evicted by a fact is built wrong. So the cap is on the rules, it is small, and when it is full you are asked which one this replaces.
The score under each rule is a count, not a judgement. The server records, per rule: how many times it was put in front of an assistant, and — for rules that name the forbidden words in quotes — how many times the very next thing that assistant tried to write obeyed it. That is a narrow measure and it is the honest one; it is what a server can see without a grader model reading your conversation. The log holds rule ids, door ids and counts. It never holds your text, because it is written outside the encryption and your text is inside it.
What a server cannot do. It cannot stop an assistant from ignoring your rule in the conversation itself — nobody's server can; there is no hook and no gate on the other side. What it can do is put the rule where the model is most likely to act on it, refuse to write something that breaks it, and show you the count. Anyone claiming to enforce your rules inside someone else's assistant is lying to you.
What this costs you: lose the link, lose the home — there is no "forgot password". Download your home any time. Anyone holding your link is you.