THE METHODS · THE STUDIO ROOM · Nº 432 · EDITION 2 · LAUNCHING SOON

LUND CARDS · THE METHODSNº 432

THE CARD AS TEXT · FOR EYES AND FOR MACHINES

THE PRIVACY CARD · The keep-less seat: what personal data the house holds, where, why, how long; and what to drop.

WAKES WHEN Nobody can say what personal data the house actually holds, or in which files. · A retention rule exists on paper and nobody has checked the files against it. · A file must be shared and the personal fields in it must be masked first. · A field is being kept and no one can say what it is for.

THE LOOP

Inventory the files by field and pattern
Plan: keep, drop or shorten, by the rule
Redact into a copy; never in place
Check: OVER RETENTION, NO PURPOSE named

NEVER

Never declares a folder clean
Never redacts a file in place
Never keeps a field with no purpose on file
Never claims a certainty it does not have

IT MAKES inventory — walk the folder; per .csv, .json, .txt and .md file the personal fields found by name and by value pattern, with counts and the file's modified day; other files listed as SKIPPED; the JSON names every pattern searched for and holds no values; plan — per field: KEEP, DROP (the rule keeps it 0 days) or SHORTEN (the rule names the part to keep) with the reason from the rule; a field the rule does not know, or names without a purpose, is NO PURPOSE; redact — a copy of a .csv or .json with the named columns or keys masked: *** for text, the last four digits kept for a digit run; prints what was masked and how many; NEVER IN PLACE when --out is the input and FIELD NOT FOUND when a named field is not in the file (each exit 1); check — per file and field: OVER RETENTION with the age when the modified day plus keep_days is before today, WITHIN RETENTION otherwise, NO PURPOSE for a field the rule does not know; exit 1 if any OVER RETENTION.

THE LAW The house keeps the least it needs, for the shortest time it can name. Every field held has a purpose and a retention written beside it; a field without one is NO PURPOSE and a file past its time is OVER RETENTION. Patterns find most of it, so the inventory says what it searched for and never calls a folder clean.

IN THE BOX SKILL.md · CARD.md · ▣ scripts/privacy.py (machine) · ▣ scripts/evals.py (test runner) · tests/EVALS.json (9 tests) · references/ (schema + fictional demo) · START-HERE.md · system/ doors · MY-LEDGER.md · LICENSE-NOTE.md · card.svg · card.json · card.html · AUDIT.md · MANIFEST.md · WITNESS.md · SELFTEST.md.

PROOF SELFTEST 15/15 · witnessed in Claude 2026-10-14 on fictional fixtures · the test prompts in fresh chat, 9/9 · Edition 2.

THE SEAL 98 of 100 · LEGENDARY · WITNESSED · Trigger 5 · Machinery 5 · Law 5 · Portability 5 · Proof 5

IT CAN BE WRONG an AI reading a text file: it can be wrong and can invent a number, a rule, a name or a date; check what matters against your own records and the source; the risk is yours. LICENSE-NOTE.md rides in the packet and is the licence.

THE PUNCH · SHA-256 OF SKILL.MD · 4F9380AE979E355BC52C58D1

THE FACE, FULL SIZE → · THE MACHINE FACE → · card.json →

THE PRIVACY CARD

The keep-less seat: what personal data the house holds, where, why, how long; and what to drop.

INVENTORY · PLAN · REDACT · CHECK

LEGENDARYWITNESSEDIN CLAUDE IN LUNDR IN CHATGPT

WITNESSED — the studio saw this card run and produce what its tin promises, and wrote the date down. What the marks mean →

THE SPEC SHEET · READ BEFORE YOU BUY · THE STANDARD EVERY CARD MEETS →

SEAL: 98 of 100 · LEGENDARY · WITNESSED
EDITION: E1 · witnessed 2026-10-14
MACHINE: scripts/privacy.py · 4 commands · selftest 15/15
RUNS: On your own computer. Standard library only, offline; no account, no key, no telemetry.
HOSTS: Claude · Claude Code · ChatGPT · Gemini · any AI that reads a file (START-HERE.md and system/ name each door)
LICENCE: One person, any number of their own AIs and computers · editions replace files · nothing renews · freeze, not loss
PUNCH: 4F9380AE979E355BC52C58D1 · sha-256 of SKILL.md · check any file against it →

CITE THIS CARDTHE PRIVACY CARD, Edition 2. Lund Studio LLC, Westminster, Colorado. https://lundr.tech/?view=privacy-card. Punch 4F9380AE979E355BC52C58D1. Retrieved 2026-10-14.

What it is.

Use when a folder of exports, forms or records must be inventoried for personal data, checked against a retention rule and redacted into clean copies. Not for legal compliance opinions.

It carries a machine that shows its working: inventory — walk the folder; per .csv, .json, .txt and .md file the personal fields found by name and by value pattern, with counts and the file's modified day; other files listed as SKIPPED; the JSON names every pattern searched for and holds no values; plan — per field: KEEP, DROP (the rule keeps it 0 days) or SHORTEN (the rule names the part to keep) with the reason from the rule; a field the rule does not know, or names without a purpose, is NO PURPOSE; redact — a copy of a .csv or .json with the named columns or keys masked: *** for text, the last four digits kept for a digit run; prints what was masked and how many; NEVER IN PLACE when --out is the input and FIELD NOT FOUND when a named field is not in the file (each exit 1); check — per file and field: OVER RETENTION with the age when the modified day plus keep_days is before today, WITHIN RETENTION otherwise, NO PURPOSE for a field the rule does not know; exit 1 if any OVER RETENTION — 15 checks in its selftest. It never declares a folder clean; never redacts a file in place; never keeps a field with no purpose on file; never claims a certainty it does not have.

The law, written into the card.

It is in the card itself, so the AI follows it.

THE LAWThe house keeps the least it needs, for the shortest time it can name. Every field held has a purpose and a retention written beside it; a field without one is NO PURPOSE and a file past its time is OVER RETENTION. Patterns find most of it, so the inventory says what it searched for and never calls a folder clean.

The method.

Inventory: walk the folder, open each text, CSV and JSON file, and list every field that looks personal by name or by pattern (addresses, phones, dates of birth, identifying numbers), file by file, with counts.
Plan against the retention rule the house wrote: for every field, keep, drop or shorten, and the reason; a field the rule does not know is NO PURPOSE until a person writes one.
Redact into a new copy with the personal fields masked; the original is never changed, and the copy says what was masked.
Check the inventory against the rule by date: a file older than its retention is OVER RETENTION, named with its age.
Repeat on a schedule the house sets; the inventory keeps its dates so the next one can be compared with the last.

What you bring.

The folder, or the exports, to inventory.
The retention rule: each kind of field, its purpose and how long it is kept.
The fields the house considers personal beyond the patterns.

Planned as a separate seat, not in this box and not yet on sale: the studio's own retention rule and its inventories.

What it does once your AI has it.

inventory Walk the folder; per .csv, .json, .txt and .md file the personal fields found by name and by value pattern, with counts and the file's modified day; other files listed as SKIPPED; the JSON names every pattern searched for and holds no values
plan Per field: KEEP, DROP (the rule keeps it 0 days) or SHORTEN (the rule names the part to keep) with the reason from the rule; a field the rule does not know, or names without a purpose, is NO PURPOSE
redact A copy of a .csv or .json with the named columns or keys masked: *** for text, the last four digits kept for a digit run; prints what was masked and how many; NEVER IN PLACE when --out is the input and FIELD NOT FOUND when a named field is not in the file (each exit 1)
check Per file and field: OVER RETENTION with the age when the modified day plus keep_days is before today, WITHIN RETENTION otherwise, NO PURPOSE for a field the rule does not know; exit 1 if any OVER RETENTION

What it will never do.

It never declares a folder clean; never redacts a file in place; never keeps a field with no purpose on file; never claims a certainty it does not have.

Where it hands off: Whether the law requires a notice or consent → a lawyer; The customer tickets themselves → THE SUPPORT CARD; Packing the clean files for sending → THE ONE UPLOAD CARD.

It is not a legal compliance opinion. It is an AI reading a text file: it can be wrong, so check what matters against your own records and the source. The holder brings their own AI; no endorsement by Anthropic or any other AI company is claimed.

What’s in the buy.

SKILL.md — the card your AI reads: when it wakes, the loop, the never-lines, the hand-offs.
CARD.md — the whole card in ten sections: face, law, method, machine, what you bring, never, tests, seal, term.
scripts/privacy.py — the machine, Python standard library only; `selftest` proves it on its own fixtures.
tests/EVALS.json and scripts/evals.py — 9 test prompts and the offline runner that scores your AI's answers.
references/ — the data schema and FICTIONAL demo files, invented to show the machine, not real.
MY-LEDGER.md — your own record of what you asked and what you decided.
START-HERE.md, system/short-prompt.md, system/rules.md — the doors, for any AI with or without skills.
card.svg, card.json, card.html, AUDIT.md, MANIFEST.md, WITNESS.md, SELFTEST.md — the faces and the proof.
NOT IN THE BOX — any studio edition (planned, not yet on sale: the studio's own retention rule and its inventories). Also not in the box: any data you must bring, and advice of any kind (not a legal compliance opinion).

PROOF · SELFTEST 15/15 · WITNESSED IN CLAUDE 2026-10-14 ON FICTIONAL FIXTURES · THE 9 TEST PROMPTS ASKED IN A FRESH CHAT HOLDING ONLY THE CARD · 9/9 · EDITION 2 · PUNCH 4F9380AE979E355BC52C58D1

ON EVERY DOOR · A CARD FOR YOUR AI, A FILE FOR YOUR COMPUTER

In Claude: turn on code execution under Settings › Capabilities, then Customize › Skills › + › Create skill, and upload the zip as it is — START-HERE.md in the box walks you through it, and tells you how to keep the ledger. In ChatGPT, Gemini and the rest: a Project, a GPT or a Gem with the card’s files attached and the short door in the box pasted as its instructions. The words run anywhere an AI reads Markdown; the machines run wherever the host runs Python. Witnessed in Claude only. The host marks →

Take it.

Nº 432 — LAUNCHING SOON

Sold as is under the term printed. A card instructs an AI you operate; results depend on your model, your files and your judgement. Not medical, legal, tax or financial advice, never the person’s boss, and not a licence to practise. The terms →

ONE PAYMENT · NOTHING RENEWS ITSELF

OFFLINE · ONE LICENCE · PUNCH-CHECKABLE · THE STANDARD

One payment. The file is yours to keep and keeps working at its edition; new editions issued in the year after you buy reach you by email as replacement files. Tax is added at checkout where it applies. Nothing auto-renews.

A TERM, NOT A SUBSCRIPTION: NOTHING RENEWS ITSELF AND NOBODY IS CHARGED AGAIN. WHEN A TERM ENDS THE FILES STAY ON YOUR COMPUTER AND STAY READABLE — FREEZE, NOT LOSS.

THE MACHINE · IN THE OPEN · FROM THE CARD’S OWN SELFTEST.MD

privacy.py, every command showing its working.

A small Python program, standard library only. Your AI runs it; you can too. The block below is pasted from the card’s own SELFTEST.md, as printed when it was run from inside the packet.

`inventory`	walk the folder; per .csv, .json, .txt and .md file the personal fields found by name and by value pattern, with counts and the file's modified day; other files listed as SKIPPED; the JSON names every pattern searched for and holds no values
`plan`	per field: KEEP, DROP (the rule keeps it 0 days) or SHORTEN (the rule names the part to keep) with the reason from the rule; a field the rule does not know, or names without a purpose, is NO PURPOSE
`redact`	a copy of a .csv or .json with the named columns or keys masked: *** for text, the last four digits kept for a digit run; prints what was masked and how many; NEVER IN PLACE when --out is the input and FIELD NOT FOUND when a named field is not in the file (each exit 1)
`check`	per file and field: OVER RETENTION with the age when the modified day plus keep_days is before today, WITHIN RETENTION otherwise, NO PURPOSE for a field the rule does not know; exit 1 if any OVER RETENTION
`selftest`	15 checks that prove the machine; it must print selftest 15/15

THE SELFTEST, AS PRINTED

ok   1  inventory's first line is the pattern warning; the JSON carries searched_for, each file's modified day and the inventory day
ok   2  inventory finds CSV columns by name (email, phone, dob) and by value with counts; a date is dob only in a dob-named field; plain columns are not listed
ok   3  inventory walks nested JSON keys (email, shipping_address, card_last4) and names a key shaped like an email by its shape, not its value
ok   4  inventory searches free text by value alone: one email, one phone, one long digit run; the timestamp is not a phone
ok   5  inventory never writes a value: no email, phone, date of birth or digit run from the files reaches the output or the JSON
ok   6  inventory lists the .png as SKIPPED (not read) and says NOTHING FOUND BY PATTERN for the plain .md, never CLEAN
ok   7  --retention's personal_names extends the name patterns: notes is found by name only when the rule names it
ok   8  plan: KEEP from the rule's purpose and days, SHORTEN when the rule names a part, DROP at 0 days, NO PURPOSE for a field no rule names and for a rule with no purpose; --out writes PLAN.csv, one row per field, no values
ok   9  redact CSV: text becomes ***, a digit run keeps its last four, a date of birth is *** whole (never its month and day), blanks and other columns stay, the # line is kept, the counts are printed, the input is byte for byte as it was
ok   10  redact JSON masks nested keys by name, renames a key that is itself an email to ***, and leaves the rest
ok   11  redact refuses NEVER IN PLACE when --out is the input, however spelled (exit 1), and the file is untouched
ok   12  redact refuses FIELD NOT FOUND for a named field the file lacks (exit 1) and writes nothing
ok   13  check: OVER RETENTION with the age for a field past its days, WITHIN RETENTION with the age otherwise, NO PURPOSE for an unknown field; exit 1
ok   14  check exits 0 on a day when nothing is over its time, says AHEAD OF TODAY for a file modified after --today, and still never says CLEAN
ok   15  a malformed --today, a root that is not a folder, a rule file without fields and redact on a text file (columns and keys only) are bad input (exit 2)
selftest 15/15

THE RUN IS PASTED FROM THE CARD’S OWN SELFTEST.MD AS PRINTED. ITS FIXTURES ARE FICTIONAL, INVENTED FOR THE TEST; NO PRIVATE PERSON IS NAMED.

QUESTIONS AT THE TABLE

Asked before the wire.

What does it need from me?

The folder, or the exports, to inventory. The retention rule: each kind of field, its purpose and how long it is kept. The fields the house considers personal beyond the patterns. If something it needs is missing, it says what is missing and stops there.

Does it send anything anywhere?

No. The machine is a standard-library Python program that runs on your own computer and sends nothing anywhere; the words run wherever an AI reads Markdown. No server, no account, no key.

What is on the record?

The machine's selftest (15/15), run from inside the packet in Claude on 2026-10-14 on fictional fixtures and pasted into SELFTEST.md as printed; the twelve-check audit (AUDIT.md). Owed, and said so in WITNESS.md: Any run on real data. Every demo file is fictional. The punch on the face is the SHA-256 of SKILL.md, so a downloaded copy can be checked against this room.

Can it be wrong?

Yes — it is an AI reading a text file: it can be wrong and can invent a number, a rule, a name or a date; check what matters against your own records and the source; the risk is yours. LICENSE-NOTE.md rides in the packet and is the licence. It is not a legal compliance opinion.

What will it never do?

It never declares a folder clean; never redacts a file in place; never keeps a field with no purpose on file; never claims a certainty it does not have.

← THE METHODS · THE FLOOR →