diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1d9f146..6527336 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,15 @@ Conventional Commits by release-please.
 
 ## Unreleased
 
+- Self-hosted server: other accounts on the same computer can no longer read your words.
+  The database (with the `-wal` and `-shm` files next to it), the model list cache and a
+  new data folder are now readable only by you, like the API token and the backups
+  already were. At start, the server makes these files private again if an older version
+  left them readable, and logs what it changed. It leaves a data folder that also holds
+  other files as it is and warns with the command to fix it. `run.sh` and the service
+  from `install-service.sh` now start the server with umask `077`; run
+  `install-service.sh` again to update the service.
+
 - Self-hosted server: your keys can now live in their own files instead of `.env`. Set
   `LLM_API_KEY_FILE=/path/to/file` in place of `LLM_API_KEY=...`, and the same for
   `API_TOKEN`, `TELEGRAM_BOT_TOKEN` and `TRANSCRIBE_API_KEY`; this is how Docker secrets
diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md
index 966624f..4df295f 100644
--- a/docs/reference/configuration.md
+++ b/docs/reference/configuration.md
@@ -180,7 +180,7 @@ The folder that holds your words and the server's files (see
 
 - Default: `$XDG_DATA_HOME/kotiko`, or `~/.local/share/kotiko` when `XDG_DATA_HOME` isn't
   set (or isn't an absolute path, which the XDG Base Directory spec says to ignore). The
-  server creates it if it's missing.
+  server creates it if it's missing, readable only by you (`0700`).
 - Words already in `~/.local/share/kotiko` stay there: while `$XDG_DATA_HOME/kotiko` has no
   `kotiko.db` and `~/.local/share/kotiko` has one, the server keeps using
   `~/.local/share/kotiko`. To move them, stop the server and move the folder.
@@ -291,11 +291,29 @@ check.
 
 | File | What it is | Permissions |
 |---|---|---|
-| `kotiko.db` (with `kotiko.db-wal` and `kotiko.db-shm` while running) | Your words, kept responses for repeated adds (24 hours), cached lookups (30 days), and the background jobs' state. SQLite | Created with your umask: usually readable by other users of the computer unless your umask is `077`. The default folder is inside your home folder. To keep it private: `chmod 700` the data folder (usually `~/.local/share/kotiko`) |
+| `kotiko.db` (with `kotiko.db-wal` and `kotiko.db-shm` while running) | Your words, kept responses for repeated adds (24 hours), cached lookups (30 days), and the background jobs' state. SQLite | `0600`. The server creates it empty and private before SQLite opens it, and SQLite gives `-wal` and `-shm` the database's permissions |
 | `api-token` | The generated API token, when `API_TOKEN` isn't set | `0600`, written so no other user can read it at any moment |
-| `models-cache.json` | OpenRouter's model list as last read, used when the server starts offline | Your umask |
+| `models-cache.json` | OpenRouter's model list as last read, used when the server starts offline | `0600` |
 | `backups/kotiko-pre-<version>-<time>.db` | A copy of the database made before an update changes it; the newest five are kept | Folder `0700`, files `0600` |
 
+Only your account can open these files. At every start the server checks them before it
+opens the database:
+
+- Any of the files above that other users can open (say, from an install before this
+  check) is made `0600` again, and `backups/` `0700`. The server logs one warning that
+  names what it changed.
+- The data folder is made `0700` when it holds nothing but Kotiko's files. A folder with
+  anything else in it may be shared on purpose (`KOTIKO_DATA_DIR=~`, say), so the server
+  leaves it as it is and warns at every start, with the command that makes it private
+  (`chmod 700 <folder>`). Giving Kotiko a folder of its own stops the warning too.
+- A file it can't change (owned by another account, say) gets a warning with the
+  `chmod` that fixes it. The server starts either way.
+
+`run.sh` and the systemd service from `install-service.sh` also start the server with
+umask `077`, so a file it makes is private from the moment it exists. These are POSIX
+permissions (Linux, macOS, WSL). On Windows, keep the data folder on WSL's own disk, not
+on a Windows drive such as `/mnt/c`, which doesn't keep them; the server warns if it can't.
+
 To go back to a backup, see the README, "Updating". To start over, stop the server and
 delete `kotiko.db`.
 
diff --git a/docs/security/assurance-case.md b/docs/security/assurance-case.md
index 1f1e6ed..7dea3e9 100644
--- a/docs/security/assurance-case.md
+++ b/docs/security/assurance-case.md
@@ -26,6 +26,7 @@ its argument and evidence.
 | Only `/health` answers without the token | One plug runs before routing and allows exactly `GET` and `HEAD` `/health`; everything else needs `Bearer <token>`, compared in constant time. It matches on the raw path, so encoded spellings can't slip past | [`router.ex`](../../server/lib/kotiko/router.ex) `authorize/2`; [`router_auth_test.exs`](../../server/test/kotiko/router_auth_test.exs) "every method and path spelling is 401", "only GET and HEAD /health are open"; [`router_socket_test.exs`](../../server/test/kotiko/router_socket_test.exs) "encoded and dotted paths need the token" (through a real socket) |
 | `/health` says nothing else | It returns name, version, API versions and database state only | [`health.ex`](../../server/lib/kotiko/health.ex) `report/1` |
 | A strong token, kept private | 32 bytes from `:crypto.strong_rand_bytes`, written to a file made 0600 before the token goes in, then renamed into place; a chosen `API_TOKEN` under 24 characters stops the boot | [`token.ex`](../../server/lib/kotiko/token.ex) `generate/1`, `save/2`, `check/3`; [`token_test.exs`](../../server/test/kotiko/token_test.exs) "first boot makes a 43-character token in a 0600 file", "short or whitespace-only tokens are refused"; [`config.ex`](../../server/lib/kotiko/config.ex) `api_token/1` |
+| Other accounts on the computer can't read the words | The BEAM can't set a mode on create, so files are created empty, made 0600, then filled: the database before SQLite opens it (SQLite gives `-wal`, `-shm` and `-journal` the database's mode, checked by a test), each backup before `VACUUM INTO`, the token and model cache through a private temporary file. A data folder the server makes is 0700. At every boot, before the Repo opens, `make_private/1` tightens any of Kotiko's files others can open and the folder when it holds only Kotiko's files, and warns otherwise. `run.sh` sets umask 077 and the unit `UMask=0077` | [`private.ex`](../../server/lib/kotiko/private.ex); [`data_dir.ex`](../../server/lib/kotiko/data_dir.ex) `make_private/1`; [`private_test.exs`](../../server/test/kotiko/private_test.exs); [`data_dir_test.exs`](../../server/test/kotiko/data_dir_test.exs); [`boot_test.exs`](../../server/test/kotiko/boot_test.exs) (boots with umask 022 and checks the modes); [`scripts_test.exs`](../../server/test/kotiko/scripts_test.exs) |
 | Listens on this computer unless told otherwise; warns when it doesn't | `BIND` defaults to `127.0.0.1`; at boot the address is classified (loopback, Tailscale, LAN, all interfaces, public) and the last three log a warning; a public address repeats it daily | [`config.ex`](../../server/lib/kotiko/config.ex) `@default_bind`; [`exposure.ex`](../../server/lib/kotiko/exposure.ex) `classify/2`; [`application.ex`](../../server/lib/kotiko/application.ex) `repeat_public_warning/2`; [`exposure_test.exs`](../../server/test/kotiko/exposure_test.exs) |
 | Answers only to names it knows | A plug before routing allows `localhost`, IP literals, this machine's own name and `ALLOWED_HOSTS`; others get 421, with or without a token | [`host_check.ex`](../../server/lib/kotiko/plug/host_check.ex); [`host_check_test.exs`](../../server/test/kotiko/plug/host_check_test.exs); [`router_auth_test.exs`](../../server/test/kotiko/router_auth_test.exs) "an unknown name gets 421 with or without a token, on every route" |
 | Strangers can't make it do work | Body parsing is a plug after `authorize`; 64 KB cap, 1 MB for the batch route | [`router.ex`](../../server/lib/kotiko/router.ex) `parse_body/2`; [`router_auth_test.exs`](../../server/test/kotiko/router_auth_test.exs) "are parsed only after auth", "over 64 KB are refused with 413"; [`router_v1_test.exs`](../../server/test/kotiko/router_v1_test.exs) "takes at most 500 words, and bodies up to 1 MB" |
@@ -61,7 +62,7 @@ its argument and evidence.
 | Someone on the same network | Plain-HTTP traffic when the server listens beyond loopback | Loopback by default; startup warnings; Tailscale or HTTPS advice |
 | A malicious or broken model answer | The word pipeline on the server or in the extension | Schema and rule checks, length caps, script checks, text-only rendering |
 | A Telegram user who isn't allowed | The bot's chat | Sender allowlist |
-| Another user on the server machine | Files in the data folder, depending on permissions | `api-token` and backups are 0600; the database follows the umask (residual risk, section 7) |
+| Another user on the server machine | Files in the data folder, depending on permissions | Every file the server keeps there is 0600 (the database is created private before SQLite opens it, so `-wal` and `-shm` are too) and a folder it makes 0700; each start re-checks them; `run.sh` and the systemd unit use umask 077 |
 | A compromised dependency or GitHub Action | The build, CI, and later the release | Lockfiles, actions pinned by commit SHA, Dependabot, OSV-Scanner over every lockfile in CI and before each release, `mix hex.audit` and `mix deps.audit` in CI, no runtime npm code in the extension |
 | A malicious pull request | The code base | Review by a maintainer; CI with read-only token; branch protection on going public ([PUBLIC_CHECKLIST.md](../PUBLIC_CHECKLIST.md)) |
 
@@ -84,7 +85,7 @@ its argument and evidence.
    │                          ▼ HTTPS                    ▼ HTTPS           ▼ file system
    │                model provider, Wiktionary   Telegram (allowlisted   data folder
    │                (answers untrusted)          sender IDs)             (kotiko.db,
-   │                                                                     api-token 0600)
+   │                                                                     api-token: 0600)
  CI (GitHub Actions, read-only token) ──▶ stores, after a maintainer approves (slice 30)
 ```
 
@@ -96,7 +97,7 @@ its argument and evidence.
 | Extension to server | HTTP with `Authorization: Bearer` | Token check, Host check, body cap; the extension validates the address and every response | [`router.ex`](../../server/lib/kotiko/router.ex); [`lib/url.js`](../../extension/lib/url.js); [`lib/validate-words.js`](../../extension/lib/validate-words.js) |
 | Server or extension to model provider | The learner's typed text, the key | HTTPS to an address the owner set; answers parsed as JSON and checked by the word spec; deadline and attempt cap per lookup | [`llm.ex`](../../server/lib/kotiko/llm.ex) `interpret/3`; [`spec/models.json`](../../spec/models.json) budgets; [`lib/llm/client.js`](../../extension/lib/llm/client.js) |
 | Server to Telegram | Updates in, messages out | HTTPS; sender allowlist | [`bot.ex`](../../server/lib/kotiko/bot.ex); [`telegram.ex`](../../server/lib/kotiko/telegram.ex) |
-| Server to file system | The database, token, backups | `api-token` 0600; `backups/` 0700 with 0600 files; database follows the umask | [`token.ex`](../../server/lib/kotiko/token.ex); [`migrations.ex`](../../server/lib/kotiko/migrations.ex) `backup!/2` |
+| Server to file system | The database, token, backups | `kotiko.db` and its `-wal`/`-shm`, `api-token`, `models-cache.json` 0600; `backups/` 0700 with 0600 files; a data folder the server makes 0700, one that holds only Kotiko's files made 0700 at start (otherwise a warning); umask 077 in `run.sh` and the unit (`UMask=0077`) | [`private.ex`](../../server/lib/kotiko/private.ex); [`data_dir.ex`](../../server/lib/kotiko/data_dir.ex) `make_private/1`; [`migrations.ex`](../../server/lib/kotiko/migrations.ex) `backup!/2`; [`data_dir_test.exs`](../../server/test/kotiko/data_dir_test.exs); [`boot_test.exs`](../../server/test/kotiko/boot_test.exs) |
 | CI to stores | Release packages | The store jobs run in the `release` environment: a maintainer approves each run, and only `v*` tags (signed, verified against `.github/allowed_signers`) may deploy. The maintainer creates the environment before the first release | [slice 30](../../slices/30-release-pipeline/SPEC.md) |
 
 ## 4. Secure design principles
@@ -162,12 +163,11 @@ These match "What you can't expect" in the [requirements](requirements.md).
 
 - **Data at rest is not encrypted.** Anyone who can read the browser profile or the data
   folder gets the words, keys and token. Assumption: the user's account and disk are theirs.
-- **The database file follows the umask.** The server makes `api-token` 0600 and the
-  `backups/` folder 0700, but creates `kotiko.db` (and the data folder, when it makes it)
-  with the process's default permissions, and the systemd unit written by
-  `install-service.sh` sets no `UMask`. On a computer shared with other accounts, they may
-  be able to read the word list. Not yet assigned to a slice; the natural homes are 29
-  (server ops) or 40 (packaging).
+- **A shared data folder stays shared.** When `KOTIKO_DATA_DIR` points at a folder that
+  also holds other files, the server makes its own files private but leaves the folder's
+  permissions alone and warns at every start; other accounts can then see the files' names
+  and sizes, not their contents. On a disk that keeps no POSIX permissions (a Windows drive
+  in WSL) nothing can be made private; the server warns.
 - **Plain HTTP beyond loopback** exposes the token and words to the network. The server
   warns; it does not refuse.
 - **The model provider sees every lookup**, under its own terms.
diff --git a/docs/security/requirements.md b/docs/security/requirements.md
index 38ea37a..318e284 100644
--- a/docs/security/requirements.md
+++ b/docs/security/requirements.md
@@ -22,6 +22,11 @@ Kotiko has two parts: the browser extension, and an optional server you run your
   and saves it in `api-token` in the data folder, readable only by you (mode 0600). If you
   pick your own with `API_TOKEN`, it must be at least 24 characters, or the server won't
   start.
+- **Other accounts on the computer can't read your words.** The database, its `-wal` and
+  `-shm` files, the backups, the token and the model list cache are readable only by you
+  (0600), and a data folder the server makes only by you (0700). At every start it makes
+  them private again if they aren't, and warns, with the command to run, about anything it
+  can't or won't change (a data folder that also holds other files).
 - **It listens only on your computer** unless you change `BIND`. When you do, it says at
   startup who can now reach it, and warns when your token would cross a network in plain
   HTTP (repeating that warning daily when the address is reachable from the internet).
@@ -73,11 +78,10 @@ Kotiko has two parts: the browser extension, and an optional server you run your
 
 - **Protection from someone who can read your browser profile or the server's data
   folder.** Keys, the token and your words are not encrypted at rest.
-- **That the word database is private to you by default.** The server makes `api-token`
-  and its backups readable only by you, but it creates `kotiko.db` with your system's
-  default file permissions (your umask), which on many systems lets other accounts on the
-  same computer read it. Run the server under your own account on a computer you don't
-  share, or tighten the folder yourself (`chmod 700 ~/.local/share/kotiko`).
+- **A private data folder when you share it.** If `KOTIKO_DATA_DIR` points at a folder
+  that also holds other files, the server keeps its own files private but leaves the
+  folder as it is, and warns at every start. Others can then see the files' names, not
+  what's in them.
 - **Privacy on a network if you use plain HTTP** to a server on another machine. The token
   and your words travel unencrypted. Use Tailscale or HTTPS through a reverse proxy.
 - **Privacy from the model provider you chose.** Lookups go to it under its terms.
diff --git a/server/install-service.sh b/server/install-service.sh
index 4ee7bbc..60f3290 100755
--- a/server/install-service.sh
+++ b/server/install-service.sh
@@ -265,6 +265,8 @@ StartLimitBurst=5
 WorkingDirectory=${dir//%/%%}
 ExecStart="$(exec_escape "$dir")/run.sh"
 $environment
+# Files the server makes are readable by you only (run.sh sets the same umask).
+UMask=0077
 Restart=on-failure
 RestartSec=5
 # 78 is a mistake in .env: retrying won't fix it. Fix .env, then restart by hand.
diff --git a/server/lib/kotiko/application.ex b/server/lib/kotiko/application.ex
index 2b74372..ccc0ab6 100644
--- a/server/lib/kotiko/application.ex
+++ b/server/lib/kotiko/application.ex
@@ -10,7 +10,7 @@ defmodule Kotiko.Application do
     1. `Kotiko.Config.load!/0`     parse and check the settings; exit 78 on a mistake
     2. `Kotiko.DataDir.resolve_and_migrate!/0`
                                   the data folder; copies the words from before the
-                                  rename to Kotiko, once
+                                  rename to Kotiko, once; makes the files private
     3. API token                  from API_TOKEN, the saved file, or a new one
     4. `Kotiko.Migrations.run!/0`  back the database up if a migration is pending, then
                                   migrate on one connection, before the pool opens
diff --git a/server/lib/kotiko/config.ex b/server/lib/kotiko/config.ex
index 39510f2..bcbdaba 100644
--- a/server/lib/kotiko/config.ex
+++ b/server/lib/kotiko/config.ex
@@ -550,10 +550,12 @@ defmodule Kotiko.Config do
   end
 
   @doc false
+  # A folder this makes is private (0700); Kotiko.DataDir.make_private/1 sees to one that
+  # was already there.
   # Sobelow: the folder is KOTIKO_DATA_DIR or the default, never from a request.
   # sobelow_skip ["Traversal.FileModule"]
   def ensure_dir(dir) do
-    with :ok <- File.mkdir_p(dir),
+    with :ok <- Kotiko.Private.mkdir_p(dir),
          {:ok, %File.Stat{type: :directory, access: :read_write}} <- File.stat(dir) do
       :ok
     else
diff --git a/server/lib/kotiko/data_dir.ex b/server/lib/kotiko/data_dir.ex
index 27115a0..890d849 100644
--- a/server/lib/kotiko/data_dir.ex
+++ b/server/lib/kotiko/data_dir.ex
@@ -26,15 +26,32 @@ defmodule Kotiko.DataDir do
   which the next run deletes before starting over. Then `MOVED-TO-KOTIKO.txt` in the old
   folder says where the words went, and the old API token is copied too, so the extension
   stays connected.
+
+  Then, at every start, `make_private/1` keeps other users of the computer out: a folder
+  it creates is 0700, and every file Kotiko keeps in it 0600 (an old `slovo.db` in the
+  data folder too: its permissions, never its contents).
   """
   require Logger
   alias Exqlite.Sqlite3
-  alias Kotiko.Token
+  alias Kotiko.{Private, Token}
 
   @database "kotiko.db"
   @legacy_database "slovo.db"
   @note "MOVED-TO-KOTIKO.txt"
   @partial_suffixes [".partial", ".partial-journal", ".partial-wal", ".partial-shm"]
+  @backups "backups"
+
+  # Every file Kotiko keeps in the data folder (install-service.sh --delete-data deletes
+  # the same list), made 0600 at each start.
+  @private_files ~w(kotiko.db kotiko.db-wal kotiko.db-shm kotiko.db-journal api-token
+                    api-token.new models-cache.json models-cache.json.tmp) ++
+                   Enum.map(@partial_suffixes, &(@database <> &1))
+
+  # The old name's database, still there in a folder that was moved in place.
+  @legacy_files Enum.map(["", "-wal", "-shm", "-journal"], &(@legacy_database <> &1))
+
+  # A data folder holding only these is Kotiko's, so make_private/1 makes it 0700.
+  @own_names @private_files ++ @legacy_files ++ [@backups, @note]
 
   @type result :: :existing | :fresh | {:migrated, non_neg_integer()}
 
@@ -79,8 +96,122 @@ defmodule Kotiko.DataDir do
     source = Application.get_env(:kotiko, :data_dir_source)
 
     case migrate(target, legacy_dirs(target, source, System.user_home())) do
-      {:ok, _result} -> target
-      {:error, message} -> Kotiko.Config.halt!(message, 1)
+      {:ok, _result} ->
+        make_private(target)
+        target
+
+      {:error, message} ->
+        Kotiko.Config.halt!(message, 1)
+    end
+  end
+
+  @doc """
+  Makes sure other users of the computer can't read the words, at every start, before
+  the database opens:
+
+    * `kotiko.db` is created empty and 0600 if it isn't there yet, so the `-wal` and
+      `-shm` files SQLite makes next to it are 0600 too.
+    * Kotiko's own files that others can open (an install from before this check, or a
+      file copied in) are made 0600, and the `backups` folder and its copies 0700 and
+      0600.
+    * The folder is made 0700 when it holds nothing but Kotiko's files: then it is
+      Kotiko's folder, whoever chose it. A folder with anything else in it may be shared
+      on purpose (`KOTIKO_DATA_DIR=~`, say), so it is left as it is, with a warning that
+      says how to make it private.
+
+  What was changed is logged as one warning (others could read it until now), and
+  anything that couldn't be changed as a warning with the command that fixes it. Never
+  stops the start. Returns `:ok`.
+  """
+  def make_private(dir) do
+    database = database(dir)
+    # If it can't be made, opening the database fails next, with its own message.
+    _ = Private.create(database)
+    backups = Path.join(dir, @backups)
+
+    files =
+      Enum.map(@private_files ++ @legacy_files, &Path.join(dir, &1)) ++
+        for name <- ls(backups),
+            String.starts_with?(name, "kotiko-"),
+            do: Path.join(backups, name)
+
+    results = Enum.map(files ++ [backups], &{&1, Private.restrict(&1)}) ++ folder(dir)
+
+    case for({path, :changed} <- results, do: path) do
+      [] ->
+        :ok
+
+      changed ->
+        Logger.warning(
+          "Other users of this computer could open Kotiko's files in #{dir} " <>
+            "(#{Enum.map_join(changed, ", ", &relative(&1, dir))}). Made them private: " <>
+            "only your account can open them now."
+        )
+    end
+
+    {ignored, failed} =
+      results
+      |> Enum.filter(&match?({_path, {:error, _why}}, &1))
+      |> Enum.split_with(&match?({_path, {:error, :ignored}}, &1))
+
+    # A disk that keeps no permissions ignores them for every file: say so once.
+    if ignored != [], do: Logger.warning(not_private(dir, :ignored))
+    Enum.each(failed, fn {path, {:error, why}} -> Logger.warning(not_private(path, why)) end)
+  end
+
+  # The folder itself: made private when it holds nothing but Kotiko's files.
+  # Sobelow: the data folder comes from the server's settings, never from a request.
+  # sobelow_skip ["Traversal.FileModule"]
+  defp folder(dir) do
+    own? =
+      match?({:ok, %File.Stat{type: :directory}}, File.lstat(dir)) and
+        Enum.all?(ls(dir), &(&1 in @own_names))
+
+    case File.stat(dir) do
+      {:ok, %File.Stat{mode: mode}} ->
+        cond do
+          not Private.shared?(mode) -> []
+          own? -> [{dir, Private.restrict(dir)}]
+          true -> [{dir, {:error, :not_only_kotiko}}]
+        end
+
+      {:error, _} ->
+        []
+    end
+  end
+
+  defp not_private(dir, :not_only_kotiko) do
+    "Other users of this computer can open the data folder #{dir}. Kotiko's own files in " <>
+      "it are private, but the folder holds other files too (or is a link), so Kotiko " <>
+      "leaves it as it is. To make it private: chmod 700 #{dir}, or give Kotiko a folder " <>
+      "of its own with KOTIKO_DATA_DIR."
+  end
+
+  defp not_private(dir, :ignored) do
+    "Couldn't make Kotiko's files in #{dir} private: this disk doesn't keep file " <>
+      "permissions (a Windows drive in WSL, say), so other users of this computer may be " <>
+      "able to read your words. Keep the data folder on a disk that does (set " <>
+      "KOTIKO_DATA_DIR)."
+  end
+
+  # Sobelow: as make_private/1.
+  # sobelow_skip ["Traversal.FileModule"]
+  defp not_private(path, reason) do
+    mode = if File.dir?(path), do: "700", else: "600"
+
+    "Couldn't make #{path} private (#{format(reason)}), so other users of this computer " <>
+      "may be able to read it. To fix it: chmod #{mode} #{path}"
+  end
+
+  defp relative(dir, dir), do: "the folder itself"
+  defp relative(path, dir), do: Path.relative_to(path, dir)
+
+  # Sobelow: folders under the configured data folder, never from a request.
+  # sobelow_skip ["Traversal.FileModule"]
+  defp ls(dir) do
+    case File.ls(dir) do
+      {:ok, names} -> names
+      {:error, _} -> []
     end
   end
 
@@ -129,7 +260,7 @@ defmodule Kotiko.DataDir do
       {:ok, nil}
     else
       with {:ok, contents} <- File.read(from),
-           :ok <- File.mkdir_p(to_dir),
+           :ok <- Private.mkdir_p(to_dir),
            :ok <- Token.save(to, contents) do
         {:ok, from}
       else
@@ -153,7 +284,7 @@ defmodule Kotiko.DataDir do
   # Sobelow: the data folder comes from the server's settings, never from a request.
   # sobelow_skip ["Traversal.FileModule"]
   defp fresh(target) do
-    case File.mkdir_p(target) do
+    case Private.mkdir_p(target) do
       :ok -> {:ok, :fresh}
       {:error, reason} -> {:error, message({:io, "create the data folder", reason}, nil, target)}
     end
@@ -167,7 +298,7 @@ defmodule Kotiko.DataDir do
     database = database(target)
 
     result =
-      with :ok <- File.mkdir_p(target) |> io("create the data folder"),
+      with :ok <- Private.mkdir_p(target) |> io("create the data folder"),
            {:ok, conn} <- Sqlite3.open(legacy, mode: :readwrite) |> io("open the old database") do
         try do
           copy_locked(conn, legacy, target)
@@ -203,13 +334,14 @@ defmodule Kotiko.DataDir do
     with :ok <- lock(conn),
          :ok <- integrity(conn, :source_corrupt),
          {:ok, counts} <- counts(conn, :source_unreadable),
+         # Empty and 0600 before the words go in: VACUUM INTO keeps an empty file's mode.
+         :ok <- Private.create(partial) |> io("create the copy"),
          :ok <- Sqlite3.execute(conn, "VACUUM INTO " <> sql_string(partial)) |> io("copy it"),
          :ok <- verify(partial, counts),
          :ok <- fsync(partial) |> io("save the copy to disk"),
          :ok <- File.chmod(partial, 0o600) |> io("make the copy private"),
          :ok <- copy_token(Path.dirname(legacy), target),
          :ok <- File.rename(partial, database) |> io("rename the copy to #{database}") do
-      private_dir(target)
       {:ok, counts.words}
     end
   end
@@ -310,17 +442,6 @@ defmodule Kotiko.DataDir do
     end
   end
 
-  # Best effort: the database is already private, and a shared folder someone chose may
-  # not be theirs to change.
-  # Sobelow: the data folder comes from the server's settings, never from a request.
-  # sobelow_skip ["Traversal.FileModule"]
-  defp private_dir(dir) do
-    case File.chmod(dir, 0o700) do
-      :ok -> :ok
-      {:error, reason} -> Logger.warning("Couldn't make #{dir} private: #{format(reason)}")
-    end
-  end
-
   # Sobelow: the database path comes from the server's settings, never from a request.
   # sobelow_skip ["Traversal.FileModule"]
   defp remove_partial(database) do
diff --git a/server/lib/kotiko/llm/catalog.ex b/server/lib/kotiko/llm/catalog.ex
index 345d1d2..2d6a40e 100644
--- a/server/lib/kotiko/llm/catalog.ex
+++ b/server/lib/kotiko/llm/catalog.ex
@@ -380,8 +380,7 @@ defmodule Kotiko.LLM.Catalog do
     _ -> state
   end
 
-  # Sobelow: a fixed file name in the configured data folder, never from a request.
-  # sobelow_skip ["Traversal.FileModule"]
+  # 0600, like every file in the data folder (Kotiko.Private).
   defp write_cache(state) do
     json =
       Jason.encode!(%{
@@ -391,11 +390,11 @@ defmodule Kotiko.LLM.Catalog do
       })
 
     path = cache_path()
-    tmp = path <> ".tmp"
 
-    with :ok <- File.write(tmp, json), :ok <- File.rename(tmp, path) do
-      :ok
-    else
+    case Kotiko.Private.write(path, json, ".tmp") do
+      :ok ->
+        :ok
+
       {:error, reason} ->
         Logger.warning("Couldn't save the model list to #{path}: #{:file.format_error(reason)}")
     end
diff --git a/server/lib/kotiko/migrations.ex b/server/lib/kotiko/migrations.ex
index cf730e4..b85c68b 100644
--- a/server/lib/kotiko/migrations.ex
+++ b/server/lib/kotiko/migrations.ex
@@ -70,6 +70,13 @@ defmodule Kotiko.Migrations do
     path = Path.join(dir, "kotiko-pre-#{Kotiko.Health.version()}-#{stamp}.db")
     path = if File.exists?(path), do: String.replace_suffix(path, ".db", "-2.db"), else: path
 
+    # Empty and 0600 before the words go in: VACUUM INTO fills an empty file and keeps its
+    # mode. The chmod after covers an empty file that was already there.
+    case Kotiko.Private.create(path) do
+      :ok -> :ok
+      {:error, reason} -> raise File.Error, reason: reason, action: "create", path: path
+    end
+
     repo.query!("VACUUM INTO " <> sql_string(path))
     File.chmod!(path, 0o600)
 
diff --git a/server/lib/kotiko/private.ex b/server/lib/kotiko/private.ex
new file mode 100644
index 0000000..6547581
--- /dev/null
+++ b/server/lib/kotiko/private.ex
@@ -0,0 +1,117 @@
+# SPDX-FileCopyrightText: 2026 ScriptKittyOS and the Kotiko contributors
+# SPDX-License-Identifier: Apache-2.0
+
+defmodule Kotiko.Private do
+  @moduledoc """
+  Folders and files only the server's own account can open: folders 0700, files 0600.
+
+  The BEAM can't set the umask or give a mode when it creates a file, so a new file
+  starts with the process's umask (usually `022`: everyone can read it). These helpers
+  create a file empty, make it private, and only then put anything in it. `run.sh` and
+  the systemd unit also start the server with umask `077`, so with them nothing is ever
+  readable by others, not even for the moment between creating a file and its `chmod`.
+
+  SQLite gives the `-wal`, `-shm` and `-journal` files it makes the same mode as their
+  database (and `VACUUM INTO` an empty file keeps that file's mode), so creating
+  `kotiko.db` or a backup empty and 0600 before SQLite opens it keeps those private too.
+
+  These are POSIX permissions (Linux, macOS, WSL). On a file system that ignores them,
+  like a Windows drive mounted in WSL, `restrict/1` returns `{:error, :ignored}`.
+  """
+  import Bitwise
+
+  @doc "Whether `mode` lets anyone but the owner in (any group or other bit is set)."
+  def shared?(mode), do: band(mode, 0o077) != 0
+
+  @doc """
+  Creates the folder `dir`, and any missing parents. When this creates `dir` itself, it
+  is made 0700 before anything is put in it. A folder that already exists is left as it
+  is: `Kotiko.DataDir.make_private/1` decides about those.
+  """
+  # Sobelow: callers pass the data folder (or one inside it) from the server's settings or
+  # an operator's command line, never a path from a request.
+  # sobelow_skip ["Traversal.FileModule"]
+  def mkdir_p(dir) do
+    if File.dir?(dir) do
+      :ok
+    else
+      with :ok <- File.mkdir_p(dir), do: File.chmod(dir, 0o700)
+    end
+  end
+
+  @doc """
+  Creates `path` as an empty file only the owner can read, for SQLite to fill. Does
+  nothing when `path` already exists.
+  """
+  # Sobelow: the database or backup path under the configured data folder, never a request's.
+  # sobelow_skip ["Traversal.FileModule"]
+  def create(path) do
+    case File.open(path, [:write, :exclusive]) do
+      {:ok, io} ->
+        :ok = File.close(io)
+        File.chmod(path, 0o600)
+
+      {:error, :eexist} ->
+        :ok
+
+      {:error, _reason} = error ->
+        error
+    end
+  end
+
+  @doc """
+  Writes `contents` to `path` (mode 0600) through `path <> suffix`: the new file is made
+  private before anything goes in, then renamed over the old one, so readers never see a
+  half-written file and the contents are never in a file other users can read.
+  """
+  # Sobelow: a fixed file name in the configured data folder, never a path from a request.
+  # sobelow_skip ["Traversal.FileModule"]
+  def write(path, contents, suffix \\ ".new") do
+    tmp = path <> suffix
+    _ = File.rm(tmp)
+
+    with :ok <- mkdir_p(Path.dirname(path)),
+         :ok <- create(tmp),
+         :ok <- File.write(tmp, contents) do
+      File.rename(tmp, path)
+    end
+  end
+
+  @doc """
+  Makes the file (0600) or folder (0700) at `path` private when others can open it.
+  Returns `:ok` when it is already private or isn't there, `:changed`, or
+  `{:error, reason}`: a file error, or `:ignored` when the file system kept its own modes.
+  A symbolic link is left alone: what it points to may not be Kotiko's.
+  """
+  # Sobelow: paths of Kotiko's own files in the configured data folder, never a request's.
+  # sobelow_skip ["Traversal.FileModule"]
+  def restrict(path) do
+    case File.lstat(path) do
+      {:ok, %File.Stat{type: type, mode: current}} when type in [:regular, :directory] ->
+        if shared?(current), do: tighten(path, private_mode(type)), else: :ok
+
+      {:ok, %File.Stat{}} ->
+        :ok
+
+      {:error, :enoent} ->
+        :ok
+
+      {:error, _reason} = error ->
+        error
+    end
+  end
+
+  @doc "The private mode for a `:regular` file (0600) or a `:directory` (0700)."
+  def private_mode(:directory), do: 0o700
+  def private_mode(_regular), do: 0o600
+
+  # Checks again afterwards: some file systems accept chmod and keep their own modes.
+  # Sobelow: as restrict/1.
+  # sobelow_skip ["Traversal.FileModule"]
+  defp tighten(path, mode) do
+    with :ok <- File.chmod(path, mode),
+         {:ok, %File.Stat{mode: now}} <- File.lstat(path) do
+      if shared?(now), do: {:error, :ignored}, else: :changed
+    end
+  end
+end
diff --git a/server/lib/kotiko/token.ex b/server/lib/kotiko/token.ex
index adfddc7..26fefac 100644
--- a/server/lib/kotiko/token.ex
+++ b/server/lib/kotiko/token.ex
@@ -69,20 +69,9 @@ defmodule Kotiko.Token do
   @doc """
   Writes `contents` to `path` (mode 0600). The file is made private before the token goes
   in, and swapped in with a rename, so the token is never in a file other users can read.
+  A data folder this creates is private too (`Kotiko.Private`).
   """
-  # Sobelow: callers pass the token file's path from the data folder, never a request's.
-  # sobelow_skip ["Traversal.FileModule"]
-  def save(path, contents) do
-    tmp = path <> ".new"
-    _ = File.rm(tmp)
-
-    with :ok <- File.mkdir_p(Path.dirname(path)),
-         :ok <- File.touch(tmp),
-         :ok <- File.chmod(tmp, 0o600),
-         :ok <- File.write(tmp, contents) do
-      File.rename(tmp, path)
-    end
-  end
+  def save(path, contents), do: Kotiko.Private.write(path, contents, ".new")
 
   @doc """
   One pasteable value carrying both the server address and the token, for the
diff --git a/server/run.sh b/server/run.sh
index 057818c..a488409 100755
--- a/server/run.sh
+++ b/server/run.sh
@@ -9,6 +9,10 @@
 # Runs with MIX_ENV=prod unless MIX_ENV is set (in your shell or in .env). Prod builds
 # into _build/prod, so the first start after switching compiles everything once.
 set -euo pipefail
+# Everything the server writes (your words, their backups, the token) is readable by you
+# only. The server makes its own files private too; this covers the moment each one is
+# made, and anything else it writes.
+umask 077
 cd "$(dirname "$0")"
 
 if [ ! -f .env ]; then
diff --git a/server/test/kotiko/boot_test.exs b/server/test/kotiko/boot_test.exs
index 6614010..f71d4f4 100644
--- a/server/test/kotiko/boot_test.exs
+++ b/server/test/kotiko/boot_test.exs
@@ -23,6 +23,8 @@ defmodule Kotiko.BootTest do
   end
 
   # Runs `script` after putting `vars` in the app env. Returns {output, exit status}.
+  # The VM gets umask 022, the usual default, so files that end up private were made
+  # private by the server itself.
   defp boot(vars, script, %{tmp: tmp, inetrc: inetrc, home: home}) do
     paths =
       Mix.Project.build_path()
@@ -39,7 +41,7 @@ defmodule Kotiko.BootTest do
 
     {elixir, path} = elixir_without_shims()
 
-    System.cmd(elixir, paths ++ ["-e", code],
+    System.cmd("sh", ["-c", ~s(umask 022 && exec "$0" "$@"), elixir | paths ++ ["-e", code]],
       cd: tmp,
       stderr_to_stdout: true,
       env: [
@@ -131,6 +133,14 @@ defmodule Kotiko.BootTest do
     :ok = :gen_tcp.send(socket, "GET /health HTTP/1.1\\r\\nhost: localhost\\r\\nconnection: close\\r\\n\\r\\n")
     {:ok, response} = :gen_tcp.recv(socket, 0, 5_000)
     IO.puts("HEALTH " <> response)
+    mode = fn path ->
+      case File.stat(path) do
+        {:ok, stat} -> stat.mode |> Bitwise.band(0o777) |> Integer.to_string(8)
+        {:error, _} -> "missing"
+      end
+    end
+    files = ["", "kotiko.db", "kotiko.db-wal", "kotiko.db-shm", "api-token"]
+    IO.puts("MODES " <> Enum.map_join(files, " ", &mode.(Path.join(#{inspect(data)}, &1))))
     :ok = Application.stop(:kotiko)
     """
 
@@ -151,6 +161,10 @@ defmodule Kotiko.BootTest do
     assert output =~ "Telegram:  off"
     assert output =~ "HEALTH HTTP/1.1 200"
     assert output =~ ~s("db":"ok")
+    # Only this account can open the folder, the database and the files SQLite makes
+    # next to it (SCR-450), though the VM ran with umask 022.
+    assert output =~ "MODES 700 600 600 600 600\n"
+    refute output =~ "Other users of this computer"
     # The key is in the settings, so it's never in the log.
     refute output =~ "sk-or-v1-0123456789abcdef"
   end
diff --git a/server/test/kotiko/config_test.exs b/server/test/kotiko/config_test.exs
index 666f4f4..4828f38 100644
--- a/server/test/kotiko/config_test.exs
+++ b/server/test/kotiko/config_test.exs
@@ -473,7 +473,7 @@ defmodule Kotiko.ConfigTest do
       %{root: root}
     end
 
-    test "a missing folder is created", %{root: root} do
+    test "a missing folder is created, private", %{root: root} do
       dir = Path.join(root, "a/b")
 
       assert {:ok, config, _} =
@@ -481,6 +481,17 @@ defmodule Kotiko.ConfigTest do
 
       assert config[:data_dir] == dir
       assert File.dir?(dir)
+      assert Bitwise.band(File.stat!(dir).mode, 0o777) == 0o700
+    end
+
+    test "a folder that's already there keeps its permissions here", %{root: root} do
+      File.mkdir_p!(root)
+      File.chmod!(root, 0o755)
+
+      assert {:ok, _config, _} =
+               Config.parse(%{"KOTIKO_DATA_DIR" => root}, resolver: &resolver/1)
+
+      assert Bitwise.band(File.stat!(root).mode, 0o777) == 0o755
     end
 
     test "a file in the way is an error", %{root: root} do
diff --git a/server/test/kotiko/data_dir_test.exs b/server/test/kotiko/data_dir_test.exs
index 46765a9..d00b74f 100644
--- a/server/test/kotiko/data_dir_test.exs
+++ b/server/test/kotiko/data_dir_test.exs
@@ -136,6 +136,7 @@ defmodule Kotiko.DataDirTest do
 
     assert File.dir?(ctx.target)
     assert File.ls!(ctx.target) == []
+    assert mode(ctx.target) == 0o700
     refute File.exists?(ctx.legacy_dir)
     assert log == ""
   end
@@ -326,6 +327,7 @@ defmodule Kotiko.DataDirTest do
       new = Path.join(ctx.target, "api-token")
       assert File.read!(new) == "the-old-token\n"
       assert mode(new) == 0o600
+      assert mode(ctx.target) == 0o700
 
       File.write!(new, "a-newer-token\n")
       assert {:ok, nil} = DataDir.copy_legacy_token(ctx.legacy_dir, ctx.target)
@@ -341,4 +343,136 @@ defmodule Kotiko.DataDirTest do
       assert {:ok, nil} = DataDir.copy_legacy_token(ctx.legacy_dir, ctx.legacy_dir)
     end
   end
+
+  # ── make_private/1 (SCR-450) ────────────────────────────────────────
+  # The test process keeps the shell's umask (often 022), so what ends up 0600 or 0700
+  # was made private by the server.
+
+  describe "make_private/1" do
+    defp file!(path, mode, contents \\ "") do
+      File.mkdir_p!(Path.dirname(path))
+      File.write!(path, contents)
+      File.chmod!(path, mode)
+      path
+    end
+
+    test "a new folder: kotiko.db is made empty and 0600, so -wal and -shm are too", ctx do
+      {:ok, :fresh} = migrate(ctx)
+      log = capture_log(fn -> assert :ok = DataDir.make_private(ctx.target) end)
+      assert log == ""
+
+      database = DataDir.database(ctx.target)
+      assert mode(database) == 0o600
+      assert mode(ctx.target) == 0o700
+
+      {:ok, conn} = Sqlite3.open(database)
+
+      try do
+        create_tables(conn)
+        insert(conn, 1, 3)
+        assert mode(database <> "-wal") == 0o600
+        assert mode(database <> "-shm") == 0o600
+      after
+        Sqlite3.close(conn)
+      end
+    end
+
+    test "an install from before: Kotiko's files are made private, with one warning", ctx do
+      dir = ctx.target
+      File.mkdir_p!(dir)
+      File.chmod!(dir, 0o755)
+      database = file!(DataDir.database(dir), 0o644, "words")
+      wal = file!(database <> "-wal", 0o644)
+      shm = file!(database <> "-shm", 0o664)
+      token = file!(Path.join(dir, "api-token"), 0o600, "token")
+      cache = file!(Path.join(dir, "models-cache.json"), 0o644, "{}")
+      # A folder moved in place keeps the old name's database next to the new one.
+      legacy = file!(Path.join(dir, "slovo.db"), 0o644, "words")
+      note = file!(Path.join(dir, "MOVED-TO-KOTIKO.txt"), 0o644, "moved")
+      backup = file!(Path.join(dir, "backups/kotiko-pre-0.4.0-20261001T000000Z.db"), 0o644)
+      File.chmod!(Path.join(dir, "backups"), 0o755)
+
+      log = capture_log(fn -> assert :ok = DataDir.make_private(dir) end)
+
+      assert log =~
+               "Other users of this computer could open Kotiko's files in #{dir} " <>
+                 "(kotiko.db, kotiko.db-wal, kotiko.db-shm, models-cache.json, slovo.db, " <>
+                 "backups/kotiko-pre-0.4.0-20261001T000000Z.db, backups, the folder " <>
+                 "itself). Made them private: only your account can open them now."
+
+      for path <- [database, wal, shm, token, cache, legacy, backup],
+          do: assert(mode(path) == 0o600, path)
+
+      assert mode(Path.join(dir, "backups")) == 0o700
+      assert mode(dir) == 0o700
+      # The note says where the words went; nothing in it is private.
+      assert mode(note) == 0o644
+      assert File.read!(database) == "words"
+
+      # Once private, nothing more to say.
+      assert capture_log(fn -> DataDir.make_private(dir) end) == ""
+    end
+
+    test "a folder holding other files too is left as it is, with how to fix it", ctx do
+      dir = Path.join(ctx.root, "shared")
+      File.mkdir_p!(dir)
+      File.chmod!(dir, 0o755)
+      database = file!(DataDir.database(dir), 0o644)
+      theirs = file!(Path.join(dir, "notes.txt"), 0o644)
+
+      log = capture_log(fn -> DataDir.make_private(dir) end)
+
+      assert mode(database) == 0o600
+      assert mode(dir) == 0o755
+      assert mode(theirs) == 0o644
+      assert log =~ "could open Kotiko's files in #{dir} (kotiko.db)."
+
+      assert log =~
+               "Other users of this computer can open the data folder #{dir}. Kotiko's own " <>
+                 "files in it are private, but the folder holds other files too (or is a " <>
+                 "link), so Kotiko leaves it as it is. To make it private: chmod 700 #{dir}"
+    end
+
+    test "a data folder that is a link is left as it is, with a warning", ctx do
+      real = Path.join(ctx.root, "real")
+      File.mkdir_p!(real)
+      File.chmod!(real, 0o755)
+      link = Path.join(ctx.root, "link")
+      File.ln_s!(real, link)
+
+      log = capture_log(fn -> DataDir.make_private(link) end)
+
+      assert mode(DataDir.database(real)) == 0o600
+      assert mode(real) == 0o755
+      assert log =~ "can open the data folder #{link}."
+    end
+
+    test "a private folder that isn't only Kotiko's is fine as it is", ctx do
+      dir = Path.join(ctx.root, "mine")
+      File.mkdir_p!(dir)
+      File.chmod!(dir, 0o700)
+      file!(Path.join(dir, "notes.txt"), 0o644)
+
+      assert capture_log(fn -> DataDir.make_private(dir) end) == ""
+      assert mode(DataDir.database(dir)) == 0o600
+    end
+
+    test "a file it can't change gets a warning with the command that fixes it", ctx do
+      # A folder without the x bit: its files can't be reached until it's fixed.
+      dir = Path.join(ctx.root, "odd")
+      file!(DataDir.database(dir), 0o644)
+      File.chmod!(dir, 0o644)
+      on_exit(fn -> File.chmod(dir, 0o700) end)
+
+      log = capture_log(fn -> DataDir.make_private(dir) end)
+
+      assert log =~
+               "Couldn't make #{dir}/kotiko.db private (permission denied), so other " <>
+                 "users of this computer may be able to read it. To fix it: chmod 600 " <>
+                 "#{dir}/kotiko.db"
+
+      # The folder holds only Kotiko's files, so it was fixed.
+      assert mode(dir) == 0o700
+    end
+  end
 end
diff --git a/server/test/kotiko/llm/catalog_test.exs b/server/test/kotiko/llm/catalog_test.exs
index 751643f..5f4077c 100644
--- a/server/test/kotiko/llm/catalog_test.exs
+++ b/server/test/kotiko/llm/catalog_test.exs
@@ -128,6 +128,7 @@ defmodule Kotiko.LLM.CatalogTest do
       LLMStub.stub(fn _, conn -> LLMStub.answer(conn, %{}) end, models: @models)
       :ok = Catalog.refresh()
       assert File.exists?(cache_file())
+      assert Bitwise.band(File.stat!(cache_file()).mode, 0o777) == 0o600
 
       restart()
       assert %{source: "cache"} = Catalog.status()
diff --git a/server/test/kotiko/private_test.exs b/server/test/kotiko/private_test.exs
new file mode 100644
index 0000000..13b2b59
--- /dev/null
+++ b/server/test/kotiko/private_test.exs
@@ -0,0 +1,157 @@
+# SPDX-FileCopyrightText: 2026 ScriptKittyOS and the Kotiko contributors
+# SPDX-License-Identifier: Apache-2.0
+
+defmodule Kotiko.PrivateTest do
+  # Private folders and files (SCR-450). The test process has whatever umask the shell
+  # gave it (often 022), so a file that comes out 0600 was made private by the code.
+  use ExUnit.Case, async: true
+  alias Exqlite.Sqlite3
+  alias Kotiko.Private
+
+  setup do
+    root = Path.join(System.tmp_dir!(), "kotiko-private-#{System.unique_integer([:positive])}")
+    File.mkdir_p!(root)
+    on_exit(fn -> File.rm_rf(root) end)
+    %{root: root}
+  end
+
+  defp mode(path), do: File.lstat!(path).mode |> Bitwise.band(0o777)
+
+  test "shared?/1 is any group or other bit" do
+    refute Private.shared?(0o100600)
+    refute Private.shared?(0o40700)
+    assert Private.shared?(0o100640)
+    assert Private.shared?(0o100604)
+    assert Private.shared?(0o40701)
+  end
+
+  describe "mkdir_p/1" do
+    test "a folder it makes is 0700", %{root: root} do
+      dir = Path.join(root, "a/b")
+      assert :ok = Private.mkdir_p(dir)
+      assert mode(dir) == 0o700
+    end
+
+    test "a folder already there is left as it is", %{root: root} do
+      dir = Path.join(root, "shared")
+      File.mkdir_p!(dir)
+      File.chmod!(dir, 0o755)
+      assert :ok = Private.mkdir_p(dir)
+      assert mode(dir) == 0o755
+    end
+
+    test "a file in the way is an error", %{root: root} do
+      path = Path.join(root, "file")
+      File.write!(path, "")
+      assert {:error, _} = Private.mkdir_p(path)
+    end
+  end
+
+  describe "create/1" do
+    test "makes an empty 0600 file, and leaves one that's there alone", %{root: root} do
+      path = Path.join(root, "kotiko.db")
+      assert :ok = Private.create(path)
+      assert mode(path) == 0o600
+      assert File.read!(path) == ""
+
+      File.write!(path, "words")
+      File.chmod!(path, 0o644)
+      assert :ok = Private.create(path)
+      assert mode(path) == 0o644
+      assert File.read!(path) == "words"
+    end
+
+    test "returns the error when the folder isn't there", %{root: root} do
+      assert {:error, :enoent} = Private.create(Path.join(root, "missing/kotiko.db"))
+    end
+  end
+
+  test "write/3 saves through a private file and creates a private folder", %{root: root} do
+    path = Path.join(root, "new-folder/models-cache.json")
+    assert :ok = Private.write(path, "{}", ".tmp")
+    assert File.read!(path) == "{}"
+    assert mode(path) == 0o600
+    assert mode(Path.dirname(path)) == 0o700
+    refute File.exists?(path <> ".tmp")
+
+    File.chmod!(path, 0o644)
+    assert :ok = Private.write(path, "[]", ".tmp")
+    assert File.read!(path) == "[]"
+    assert mode(path) == 0o600
+  end
+
+  describe "restrict/1" do
+    test "tightens a file or folder others can open, and says so", %{root: root} do
+      file = Path.join(root, "kotiko.db")
+      File.write!(file, "")
+      File.chmod!(file, 0o644)
+      assert :changed = Private.restrict(file)
+      assert mode(file) == 0o600
+      assert :ok = Private.restrict(file)
+
+      dir = Path.join(root, "backups")
+      File.mkdir_p!(dir)
+      File.chmod!(dir, 0o755)
+      assert :changed = Private.restrict(dir)
+      assert mode(dir) == 0o700
+    end
+
+    test "leaves a private file, a missing one and a link alone", %{root: root} do
+      file = Path.join(root, "api-token")
+      File.write!(file, "")
+      File.chmod!(file, 0o400)
+      assert :ok = Private.restrict(file)
+      assert mode(file) == 0o400
+
+      assert :ok = Private.restrict(Path.join(root, "missing"))
+
+      elsewhere = Path.join(root, "not-kotikos")
+      File.write!(elsewhere, "")
+      File.chmod!(elsewhere, 0o644)
+      link = Path.join(root, "models-cache.json")
+      File.ln_s!(elsewhere, link)
+      assert :ok = Private.restrict(link)
+      assert mode(elsewhere) == 0o644
+    end
+  end
+
+  # What make_private/1 relies on: SQLite gives the files it makes next to a database
+  # that database's mode, and VACUUM INTO an empty file keeps that file's mode.
+  describe "SQLite and a database made private before it opens" do
+    test "the -wal and -shm files are 0600 too", %{root: root} do
+      db = Path.join(root, "kotiko.db")
+      :ok = Private.create(db)
+      {:ok, conn} = Sqlite3.open(db)
+
+      try do
+        :ok = Sqlite3.execute(conn, "PRAGMA journal_mode = WAL")
+        :ok = Sqlite3.execute(conn, "CREATE TABLE words (native TEXT)")
+        :ok = Sqlite3.execute(conn, "INSERT INTO words VALUES ('кот')")
+
+        assert mode(db) == 0o600
+        assert mode(db <> "-wal") == 0o600
+        assert mode(db <> "-shm") == 0o600
+      after
+        Sqlite3.close(conn)
+      end
+    end
+
+    test "VACUUM INTO an empty private file keeps it private", %{root: root} do
+      db = Path.join(root, "kotiko.db")
+      copy = Path.join(root, "copy.db")
+      {:ok, conn} = Sqlite3.open(db)
+
+      try do
+        :ok = Sqlite3.execute(conn, "CREATE TABLE words (native TEXT)")
+        :ok = Sqlite3.execute(conn, "INSERT INTO words VALUES ('кот')")
+        :ok = Private.create(copy)
+        :ok = Sqlite3.execute(conn, "VACUUM INTO '#{copy}'")
+      after
+        Sqlite3.close(conn)
+      end
+
+      assert mode(copy) == 0o600
+      assert File.stat!(copy).size > 0
+    end
+  end
+end
diff --git a/server/test/kotiko/scripts_test.exs b/server/test/kotiko/scripts_test.exs
index 091506c..03802f3 100644
--- a/server/test/kotiko/scripts_test.exs
+++ b/server/test/kotiko/scripts_test.exs
@@ -90,6 +90,20 @@ defmodule Kotiko.ScriptsTest do
       assert calls(ctx) == ["mix prod deps.loadpaths --no-compile", "mix prod run --no-halt"]
     end
 
+    test "starts the server with umask 077, so what it writes is private", ctx do
+      stub(ctx, "mix", ~s[echo "umask $(umask)" >> "#{ctx.calls}"])
+      write_env(ctx, "", 0o600)
+
+      # A loose umask in the shell it's started from doesn't matter.
+      {_, 0} =
+        System.cmd("bash", ["-c", "umask 022 && exec bash run.sh"],
+          cd: ctx.dir,
+          env: [{"PATH", "#{ctx.bin}:/usr/bin:/bin"}, {"HOME", ctx.home}, {"MIX_ENV", nil}]
+        )
+
+      assert "umask 0077" in calls(ctx)
+    end
+
     test "fetches dependencies when they are missing or out of date", ctx do
       stub(ctx, "mix", ~s(if [ "$1" = deps.loadpaths ]; then exit 1; fi))
       write_env(ctx, "", 0o600)
@@ -162,6 +176,8 @@ defmodule Kotiko.ScriptsTest do
 
       assert text =~ "\nRestartPreventExitStatus=78\n"
       assert text =~ "\nStartLimitBurst=5\n"
+      # Files the service makes are private from the moment they exist.
+      assert text =~ "\nUMask=0077\n"
 
       calls = calls(ctx)
       assert "mix prod compile" in calls
diff --git a/server/test/kotiko/token_test.exs b/server/test/kotiko/token_test.exs
index aa4ec02..b314ce9 100644
--- a/server/test/kotiko/token_test.exs
+++ b/server/test/kotiko/token_test.exs
@@ -57,6 +57,13 @@ defmodule Kotiko.TokenTest do
     assert {:error, "The token in " <> _} = Token.resolve(nil, dir)
   end
 
+  test "a data folder it has to make is private too", %{tmp_dir: dir} do
+    data = Path.join(dir, "new-data")
+    assert {:ok, _token, {:generated, _}} = Token.resolve(nil, data)
+    assert Bitwise.band(File.stat!(data).mode, 0o777) == 0o700
+    assert Bitwise.band(File.stat!(Token.path(data)).mode, 0o777) == 0o600
+  end
+
   test "generate replaces the saved token", %{tmp_dir: dir} do
     {:ok, old, _} = Token.resolve(nil, dir)
     assert {:ok, new, {:generated, _}} = Token.generate(Token.path(dir))
diff --git a/site/src/content/docs/server/index.md b/site/src/content/docs/server/index.md
index f05c7ef..7ab4446 100644
--- a/site/src/content/docs/server/index.md
+++ b/site/src/content/docs/server/index.md
@@ -48,6 +48,11 @@ prints it. `mix kotiko.token` (in `server/`) prints it again, with a pairing str
 your own, set `API_TOKEN` in `.env` (at least 24 characters, for example from
 `openssl rand -hex 24`).
 
+Only your account can read what the server keeps in the data folder: your words, their
+backups and the access key. If something there is readable by others, the server makes it
+private at start, or tells you the command that does. See
+[files in the data folder](/server/configuration/#files-in-the-data-folder).
+
 Your keys don't have to be in `.env`: each one can live in its own file, with
 `LLM_API_KEY_FILE=/path/to/file` instead of `LLM_API_KEY=...` (and the same for the other
 keys). Replacing a key is then replacing its file and restarting. See
diff --git a/slices/29-server-ops-hardening/SPEC.md b/slices/29-server-ops-hardening/SPEC.md
index ed9a820..5389280 100644
--- a/slices/29-server-ops-hardening/SPEC.md
+++ b/slices/29-server-ops-hardening/SPEC.md
@@ -150,6 +150,7 @@ is table-tested without touching the environment.
 ```bash
 #!/usr/bin/env bash
 set -euo pipefail
+umask 077   # what the server writes is private (SCR-450)
 cd "$(dirname "$0")"
 [ -f .env ] || { echo "No .env yet. Run: cp .env.example .env && chmod 600 .env, then fill it in." >&2; exit 78; }
 if [ -n "$(find .env -perm /077)" ]; then
@@ -188,13 +189,18 @@ CONTRIBUTING and `.env.example` say to single-quote values containing `$`, space
   WorkingDirectory=<escaped dir>
   ExecStart="<escaped dir>/run.sh"
   Environment="PATH=<escaped PATH>"
+  UMask=0077
   Restart=on-failure
   RestartSec=5
   RestartPreventExitStatus=78
   ```
 
   (`WorkingDirectory=` takes the rest of the line as one path, so spaces need no quotes
-  there, only `%` escaping.)
+  there, only `%` escaping. `UMask=0077`, like `umask 077` in `run.sh`, keeps every file
+  the server makes private from the moment it exists; the server also makes its own files
+  0600 itself, see `Kotiko.DataDir.make_private/1` and the
+  [configuration reference](../../docs/reference/configuration.md#files-in-the-data-folder).
+  Added for Linear SCR-450.)
 - After installing, wait up to 20 s for `GET /health` to return 200 and print the result;
   on failure print the last 20 journal lines and the exit status.
 - Slice 04 adds the old-unit cleanup; slice 40 adds release support.