use-private-profile-safelylisted

# Use a Private Profile Safely Use the minimum personal information needed for the current task. A user profile is not blanket permission to inspect every stored field. ## Keep momentum Use known non-sensitive context and safe, reversible defaults before asking for input. Bundle non-blocking questions and continue useful work. Interrupt only when a missing choice would change the result, privacy, cost, authority, safety, or something hard to undo — and never treat convenience as permission to reveal private data. Never repeat an answered question or request access to fields the task does not need. ## Choose the storage tier 1. Put non-sensitive preferences such as operating system, preferred browser, timezone, teaching style, and desired access supports in a local copy of `config/preferences.example.json` named `config/preferences.local.json`. 2. Put genuinely personal details in the encrypted vault created by `personal-vault/vault.py`. 3. Keep passwords, passkeys, MFA/recovery codes, authentication tokens, full government-ID numbers, and complete payment or bank numbers in a trusted password manager or operating-system credential store instead. Both the local preferences file and encrypted vault patterns are ignored by Git. Never weaken or remove those ignore rules while real personal data exists. ## Access boundary - Obtain explicit permission for the exact profile field needed. - Never ask the user to paste the master passphrase into chat or a comman