Privacy Rules

Privacy Rules

Fine-grained control over what data gets sent to AI. Privacy rules run before any data leaves your device — AI never sees excluded or redacted content.

---

How It Works

Every time Vaultend sends note content to AI (Organize Note, Organize Folder, Vault Maintenance with AI features), the privacy filter runs first:

Your note → Privacy filter → Only allowed content → AI provider

1. Exclusion rules (folder, tag, properties) block entire notes from being sent
2. Redaction rules mask specific text patterns within notes that are allowed
3. Your original notes are never modified — filtering only affects the copy sent to AI

---

How to Configure

Go to Settings → Community Plugins → Vaultend → Privacy

Click Add Rule to create a new privacy rule. Each rule has:

• Name — a descriptive label (e.g., "Personal journal")
• Type — the kind of rule (see below)
• Pattern — the folder path, tag, property key, or regex pattern
• Enabled toggle — turn individual rules on/off without deleting them

---

Rule Types

Folder Exclude

Notes in the specified folder (and all subfolders) are never sent to AI.

Pattern: The folder path from vault root. Case-sensitive, prefix-matched.

Pattern	What gets excluded
Journal/Personal	All notes under Journal/Personal/ and its subfolders
Finance	All notes under Finance/
Work/Clients	All notes under Work/Clients/

Tag Exclude

Notes with the specified tag are completely excluded from AI context.

Pattern: The exact tag to match (without #).

Pattern	Effect
private	Notes tagged #private are excluded
confidential	Notes tagged #confidential are excluded

Properties Exclude

Notes with the specified frontmatter property key are excluded from AI context.

Pattern: The frontmatter key name. The value doesn't matter — if the key exists, the note is excluded.

Pattern	Frontmatter that triggers exclusion
confidential	confidential: true (or any value)
draft	draft: true
no-ai	no-ai: true

Content Redact

Regex patterns in note content are replaced with [REDACTED] before sending to AI. The note itself remains in the AI context — only matching text is masked.

Pattern: A regular expression (case-insensitive). For simple word masking, just type the word — no regex knowledge needed.

Pattern	Before	After (sent to AI)
password:\S+	password:abc123	[REDACTED]
SSN-\d{3}-\d{2}-\d{4}	SSN-123-45-6789	[REDACTED]
vaultend	My vaultend plugin	My [REDACTED] plugin

If a regex pattern is invalid, Vaultend logs a warning and skips that rule (other rules still apply).

---

Where Privacy Rules Apply

Feature	Exclusion rules	Content redaction
Organize Note	Excluded notes can't be organized	Redacted content sent to AI
Organize Folder	Excluded notes are skipped in batch	Redacted content sent to AI
Vault Maintenance (AI features)	Excluded notes skipped for AI analysis	Redacted content sent to AI
Vault Maintenance (local analysis)	Not affected — orphan/broken link/empty detection is local, no AI	N/A
Link suggestions	Excluded notes are not suggested as link targets	N/A

Important: Local analysis features (orphan detection, broken links, empty notes, duplicates) do NOT use AI and are NOT affected by privacy rules. These features only read your local vault structure.

---

Rule Processing Order

Rules are processed in order from top to bottom. The first matching exclusion rule blocks the note entirely — subsequent rules don't run for that note.

For content redaction, all enabled redaction rules apply sequentially to the remaining text.

---

Common Setups

Personal vault with sensitive areas

Rule 1: Folder exclude → "Journal/Personal"
Rule 2: Folder exclude → "Finance"
Rule 3: Tag exclude → "private"

Work vault with client confidentiality

Rule 1: Folder exclude → "Clients/Contracts"
Rule 2: Properties exclude → "confidential"
Rule 3: Content redact → "client-[A-Z]+-\d+"  (client IDs)

Selective AI access

Use the no-ai frontmatter property on individual notes:

---
no-ai: true
---

Then add a single rule:

Rule: Properties exclude → "no-ai"

---

Key Guarantees

1. Pre-send filtering — privacy rules execute before ANY data leaves your device
2. Original notes untouched — content redaction only affects the copy sent to AI
3. Plugin-scoped — these rules control Vaultend only. Your AI provider's own data policies apply separately (review them at your provider's website)
4. No telemetry — Vaultend does not collect or send any usage data, analytics, or note content to Vaultend servers. All AI communication is direct between your device and your configured AI provider.

---

Tips

• Use folder exclude for entire sections of your vault (journals, finance, medical records)
• Use tag exclude for individual sensitive notes (#private, #confidential, #medical)
• Use properties exclude for a per-note opt-out pattern (no-ai: true in frontmatter)
• Use content redact for specific patterns (API keys, passwords, personal identifiers, client codes)
• Multiple rules can be combined — exclusion rules block notes, redaction rules mask content within allowed notes
• Disabled rules are preserved but inactive — toggle them back on when needed