A medieval fort is not a metaphor for living in fear. It is a map of who may stand where. The keep is not for guests. The bailey is for people you can name. Outside the walls, you assume copies, rumours, and an audience you will never meet.
Records work the same way. The cheap part of the modern world is computation: storage, inference, ranking, targeting. The scarce part is data that describes you — what you search, who you pay, where you sleep, which keys unlock which doors. If you hand that to a third party, you are not merely “backing up.” You are handing them a model, and a model is a lever.
This journal already has essays about leaving a service and about keeping a cryptographic secret. This one is prior to both. Before you encrypt, export, or self-host, decide which ring of the fort each piece of knowledge belongs in.
Public
Outside the walls. Assume copies forever.
Confidential
The bailey. Named people, named purpose.
Private
The keep. Never leaves your custody.
Three rings, not a feeling
Private is material whose loss or disclosure would let someone impersonate you, injure you, or open the rest of the fort: seed phrases, OpenPGP primary secrets, recovery codes, medical files you have not chosen to share, the password that unlocks the rest. If a helpful company offers to “hold it safely,” the answer is still no. A custodian is a second keep with keys you do not hold.
Confidential is material you choose to show a named person or institution for a named job: a solicitor, a physician, a household member, a host you picked because you can leave. The test is whether you can say who has it, why, and what happens when that relationship ends. Encrypted-at-rest on a disk you control can be confidential. “End-to-end encrypted” inside an account you cannot export is a slogan until you have opened a copy elsewhere.
Public is whatever you publish, or might as well have. A blog post, a git commit on a public forge, a photo with the GPS still in it. The honest rule is: treat it as copied, indexed, and still available after you change your mind. That does not make publishing wrong. It makes the ring assignment honest.
If you cannot place a record in one of the three, it is not unclassified. It is already leaking toward public.
Cheap compute changes the price of a gift
Twenty years ago, giving a company a mailbox was mostly a filing problem. Today the same mailbox is fuel. Models are cheap to run. Logs are cheap to keep. Combining your purchases, your location, your contacts, and your half-written searches is no longer an academic exercise. It is the product.
The gift is not the file. The gift is the inference: what you will click, what you will pay, when you are lonely, which recovery path you will take when the first one fails. Influence does not require a conspiracy. It requires a ranking function and enough of your past.
This is why “I have nothing to hide” misses the geometry. Hiding is the keep. Influence happens in the town square, using a portrait of you built from what left the gate.
A third party with your private ring can reset you. A third party with enough of your confidential ring can steer you. A third party with only your public ring can still quote you — that is the cost of speaking.
Intermediate · Put the rings on disk before you put them in a product
A working classification is a directory, not a policy PDF:
~/keep/private/ # age or OpenPGP; never synced to a vendor
~/keep/confidential/ # named shares; encrypted backups you can restore
~/keep/public/ # the copy you would not mind on a posterIf a file is in private/ it does not ride Syncthing to a friend’s NAS, iCloud, or a “zero-knowledge” host whose recovery still goes through their mailbox. Confidential may, once you have tested an export. Public may go anywhere; strip GPS and the other keep from the same photo first.
age -r and a printed recovery are enough for a small keep. The OpenPGP essays in this journal are for when the keep must certify identities, not merely hide a folder.
Do not let convenience flatten the walls
Most products want one bucket. A notes app that also wants the camera roll, the calendar, and the password manager is asking you to knock the keep into the bailey because the UI is prettier that way.
Refuse the flatten. Use a dumb folder for public drafts. Use a separate identity for the accounts that recover everything else. Use a host you can clone for confidential work. Keep the private ring on media you have opened this year, on a machine that can work in a tunnel.
You will still use third parties. The baker remains a dependency. The difference is that bread is not a model of your next ten years, and a mailbox dump is.
Expert · The lever is aggregation, not a single secret
A password in the wrong place is a break-in. A year of location, mail, and payments in the wrong place is a portrait. Recommendation systems, credit models, ad auctions, and “safety” classifiers all treat that portrait as input. You do not get a vote when the loss function updates.
TLS in transit is not a wall: the host at the other end still reads. Client-side encryption is a wall only if you hold the key and have restored it. A passkey that cannot be exported is a token, not a keep — see the hardware-token essay.
When you evaluate a vendor, ask what they can compute that you did not explicitly hand them. Shadow profiles, lookalike audiences, and training on “anonymised” logs are how public and confidential collapse into one fuel tank. Data minimisation is the only reliable countermeasure a household can actually operate: if it never left the keep, it cannot be joined.
A Saturday test
Write ten lines. For each: the record, the ring, who has a copy, and whether you have opened that copy without the original app. If a line says private and also “in my Google account,” the wall is already a gap. Move one such line this week. Not all ten. One.
The fort is not a lifestyle. It is a refusal to let cheap compute turn your life into someone else’s instrument. The keep is the data. Treat it that way before you need the lock.
