Privacy, permissions, and AI boundaries
You can limit each ChatGPT or Claude connection to selected Hjarni folders, make it read-only, or both. The client-folder walkthrough below shows how to set that up and check the boundary. Hjarni only grants access after you connect an assistant.
Who does what
Stores notes, containers, tags, links, files, versions, and AI instructions.
Act as clients that read and write through MCP after you connect them.
Choose what gets saved, which assistant gets connected, and when access is revoked.
A connected assistant is not your permanent memory by itself. If you want something to be available later, save it to Hjarni.
Connections and tokens
- Assistants you connect by signing in (OAuth) create a revocable MCP session tied to your Hjarni account. These reach everything the account can reach, unless you limit one when you sign in: to some folders, to reading only, or both. You can change that later under Settings > Connections, and the same rules as agent tokens apply.
- For an agent that should reach less, make an agent token in Settings > Connections. It starts with no folders. Until you give it some, it can read only a few account-wide details, such as your email address and, over MCP, your AI instructions. For each folder, or a whole space, you choose No access, Read, or Write, and that passes down to every folder inside until a folder sets its own. You can also set it from a folder's Permissions tab.
- An agent token works over MCP and the REST API alike, never gets more than you have (where you can only read, it can only read), and signs its own edits in note history. It cannot manage tags, teams, sharing, or your AI instructions. See Agent tokens.
- You can review and revoke tokens or MCP sessions from Settings > Connections.
- Revoking a token immediately breaks access for the app or client using it.
Limit ChatGPT or Claude to one client folder
Each connection has its own access settings, on every Hjarni plan. Give ChatGPT and Claude the same client folder, or different folders. Hjarni enforces these limits when a tool reads or changes notes.
- Prepare two fictional clients. In Hjarni, create sibling folders named Client A and Client B. Add a note called Scope check A in the first and Scope check B in the second. Put a different check phrase of your own in each note. Keep Client B's phrase out of the assistant chat.
- Choose the sign-in session. Open Settings > Connections and expand the ChatGPT or Claude row. Use its Signed in date and Last used activity to identify the session. Choose Limit access, or Change access if it is already limited, then select Only what you choose. Each session has separate grants; repeat the setup for every sign-in session you intend to limit.
- Set the folder grants. Use Expand all to inspect every level. Set Client A to Read and any subfolders inside it to Same as above so they inherit Read. Set Client B, the Personal root, other spaces and every previously granted folder outside Client A to No access. Press Save access. Check that Reaches now lists only read access within Client A. An explicit subfolder grant overrides its parent, so changing the root alone does not clear older grants.
- Check it in a fresh chat. Use the session you just limited. Run the checks below with the fictional notes, inspect the assistant's tool activity, and verify the note in Hjarni afterward. Repeat on the other sessions or devices you intend to limit, and for the other assistant if you connected both. Changing one session leaves other sessions' grants unchanged.
Connecting for the first time? After creating the sample notes, use the ChatGPT or Claude setup guide. On Hjarni's sign-in consent screen, choose Only folders you choose, select Client A only, turn on Read only, then press Allow access. You can also change an existing connection using the steps above.
Every new sign-in creates a separate session, including reconnecting after a disconnect or expired session. Previous limits are not copied: Everything you can reach is selected by default. Choose Only folders you choose and Read only again, then repeat the checks.
If the consent screen shows a first-note or template setup prompt instead of these choices, choose Deny. In Hjarni, add the sample notes and dismiss any pending template setup from Hjarni setup using Continue without this template or Dismiss template setup. Then reconnect and choose the limits before pressing Allow access.
A folder grant includes its subfolders and notes added or moved into it later. Choosing the clients' common parent includes both clients. Keep the grants on the individual client folders; Same as above inherits a parent's access.
Check what the connection can read and change
1. Read the allowed note
Search Hjarni for Scope check A and read the current note. Quote its check phrase and link to the note.
The tool should return Client A's note. Check its phrase against the note in Hjarni.
2. Try the other client's note
Open Scope check B in Hjarni and use Copy link for its private note link. Do not create or use a public sharing link: that grants access separately. Give the assistant the private link, without pasting the note's text:
Use Hjarni to read this note directly: [Client B's note link]. Report the tool result without guessing the contents.
The read should fail with a not-found or no-access result. Client B's note should also be absent from searches and folder lists. An empty search alone does not establish the boundary; check the direct read too.
3. Try a write with read-only access
Append “Read-only test” to Scope check A in Hjarni.
The write should be refused. Open the note in Hjarni and confirm its body is unchanged. If the assistant never called a Hjarni tool, its reply does not test the permission.
When you want the assistant to maintain Client A's brief, change that folder from Read to Write and save. It can then create, edit and delete notes there. Client B stays outside the connection's grants. Review saved edits in note history.
These are note-access limits. The connection still receives your name and email, plus applicable AI instructions. These include account (brain) instructions, instructions for any Personal or team space containing a granted folder, and instructions on the folder and its ancestors, even if an ancestor is set to No access. Keep other clients' confidential details out of those instructions.
The Also follow my AI instructions switch in this connection's access settings can hide account (brain) instructions. Space and folder instructions still apply. Changing access cannot retract content already returned to a chat; start fresh for the check. Instructions guide behavior; grants enforce access.
For a reusable brief, start with the Client Project Context template. For clients configured with a manually copied token, see Agent tokens.
What a connected assistant can do
Can do
- Read notes and folders within both your access and the connection's grants.
- Create and update notes and folders where the connection has write access. Available tools depend on its permissions.
- Use team and shared folders within the access granted to that connection.
- Follow instruction inheritance when a container or team has AI rules.
Cannot do
- Access Hjarni before you connect it.
- Bypass Hjarni ownership or sharing rules.
- Read personal or team spaces that your account itself cannot access.
- Keep memory outside what you save in notes or instructions.
Some clients may ask for confirmation before destructive actions, but the real enforcement boundary is still Hjarni's permissions model.
Teams and shared spaces
Personal and team spaces are separate
A team has its own notes, containers, and team instructions. Your personal notes remain separate. Tags belong to each member's account, so a tag on a team note comes from the tag list of the account that owns the note: its creator, or the team owner once the creator's account is deleted.
Shared containers have narrower permissions
Collaborators can work inside shared containers, but some owner-only actions remain restricted, including modifying the shared container itself.
Instructions still apply
If a team or container has AI instructions, connected assistants receive them and are expected to follow them.
Public links
A public link is a different sharing mode. A folder link (/p/…) lets anyone with the URL read the folder and the notes inside; a single-note link (/n/…) shows that one note and nothing else. No login. No Hjarni account.
Visitors only see what the link covers. Your other folders, your account, your edit history, and your AI instructions stay private. Disable a folder link from the Sharing tab of Edit folder, or a note link from the note's Share button, to revoke access. Re-enabling generates a fresh URL, never the old one.
For details, see Share a folder publicly.
Exports, deletion, and portability
You can export your knowledge base as a ZIP of Markdown files with the folder structure preserved. Attachments are included alongside their notes.
Archived notes can be restored. Deleted notes go to Trash and stay recoverable for 30 days; restore one any time before then, after which it is permanently removed. If you revoke a token or disconnect an MCP client, it no longer has access.
For the exact export behavior, see Export and data ownership. For the legal privacy policy, see Privacy Policy.
Account security
Your account can ask for a second factor at sign-in: a six-digit code from an authenticator app such as 1Password, Google Authenticator or Authy, on top of your password or your Google, Apple or GitHub sign-in. It is optional and off by default.
Turn it on under Settings > Security > Two-factor authentication > Enable. Scan the QR code with your app, enter the code it shows, and save the ten recovery codes you are given. Each recovery code signs you in once if you lose your phone; you can generate a new set from Settings > Security at any time, and turning two-factor authentication off deletes them.
For setup, recovery codes and what to do if you lose your phone, see Two-factor authentication.
You can also add a passkey and sign in with Face ID, Touch ID, a fingerprint or your device PIN instead of a password. A passkey only works on hjarni.com and counts as both factors, so it does not ask for a two-factor code. Add or remove one under Settings > Security > Passkeys; Hjarni emails you either way. See Passkeys.
Two-factor authentication protects the sign-in to hjarni.com and the mobile apps. API tokens and MCP connections are separate credentials with their own lifecycle: they keep working while it is on, and you revoke them from Settings > Connections.
Related docs
Questions about privacy or permissions?
Email evert@hjarni.com
Give your AI a memory. Free.
Connect Claude or ChatGPT to notes they can actually read and write.
Give your AI a memory. Free.