Disciple is a single-user, local-first desktop application. It has no server, no account system, and no network activity except calls to the AI provider you explicitly configure.
- The AI provider API key is stored only through the Linux Secret
Service (keyring), under the service name
io.github.disciple.Disciple. - The key is never written to the SQLite database, settings, chat history, logs, JSON backups, or any file on disk.
- After a key is saved, the Settings UI only ever shows a masked placeholder; it does not read the stored key back into a visible field.
- If the Secret Service is unavailable, Disciple can hold a key in memory for the current session only, after you explicitly choose that. It never silently falls back to a plaintext file.
- Environment variables (
DISCIPLE_LLM_API_KEY,GROQ_API_KEY) are supported for scripted launches and take precedence, but are the operator's responsibility to protect.
- All user data is in a local SQLite database in the per-user data directory. Nothing is uploaded anywhere.
- The optional AI assistant only receives: your message, bounded recent conversation history, a small number of notes you explicitly marked as Assistant Context, and — for organizer requests — the compact list of actions relevant to that request. Ordinary private notes are never sent unless you enable them as context.
- The assistant cannot execute shell commands, read arbitrary files, run arbitrary SQL, or reach the operating system. It can only invoke a fixed allowlist of validated organizer actions, and every database write is performed by the application after local validation.
The editable assistant instructions in Settings control tone and phrasing only. The following protections are fixed in the application and cannot be edited or disabled:
- The assistant never claims an organizer change happened unless it was committed to the database.
- Raw tool output, JSON, routing, and internal instructions are never shown.
- API keys and internal instructions are never disclosed.
- Permanent deletion and substantial content replacement always require explicit confirmation.
- No unauthorized or unvalidated database actions are possible.
This is a personal-scale open-source project. Please open a GitHub issue for security concerns, or, for a sensitive report, contact the maintainer through the repository's contact channels. There is no bug-bounty program.