# Privacy and security

Version: 1.0.1

This workflow handles personal thoughts. Treat the capture path like a private inbox, even when the public setup guide is open.

## Keep these private

- Airtable tokens
- real base, table, field, and record IDs
- private API URLs that include those IDs
- raw thoughts
- screenshots, photos, documents, and other attachments
- exported private Shortcut files
- account details and internal folder paths

The public placeholders are:

- `YOUR_AIRTABLE_BASE_ID`
- `YOUR_TABLE_ID`
- `YOUR_AIRTABLE_TOKEN`

Never swap in a real value in documentation, screenshots, commits, or issues.

## Use least privilege

The capture Shortcut needs record-write access to one Airtable base. Give it that and nothing broader.

If you add a later process that reads and updates records, give that process its own token with only the extra permissions it needs. Don't reuse a powerful token just because it's already available.

## Store the token carefully

The V1 Shortcut needs the token in its Authorization header. That means anyone who can inspect or export the Shortcut may be able to see it.

Protect the phone with a passcode. Don't share the Shortcut until you've removed the token and private identifiers. Revoke and replace the token if you think it was exposed.

## Check the destination

Before approving iOS network access, confirm the host shown on screen is Airtable's real domain. Don't send the token to a copied URL, a URL shortener, or an unknown webhook.

## Protect the raw thought

Keep `Raw Thought` immutable. Write cleaned text, summaries, or classifications to separate fields.

If a later tool gets something wrong, you can correct the added field while the source stays intact.

## Attachments need context

An attachment can contain names, messages, locations, account details, or other sensitive information. Add only files you want stored in that Airtable base.

Write enough in `Raw Thought` to explain the file. Confirm the upload, then remove any unnecessary local or shared copy according to your own retention rules.

## Public support and GitHub Issues

Use a harmless made-up sentence when asking for help.

Don't post:

- a real request header
- a full Airtable response
- a screenshot with private IDs or thoughts
- a personal attachment
- an exported Shortcut that still contains credentials

When an error contains private values, replace them with the public placeholders before sharing it.

## What this kit doesn't cover

This kit doesn't provide legal, medical, employment, or compliance advice. If your captures include regulated or highly sensitive information, review Airtable's current security terms and your own obligations before using this setup.