Cheatsheet: Your starting point: write down what you're protecting and from whom

The two questions

Question 1: What do I want to protect? (EFF term: your assets)

Question 2: Who do I want to protect it from? (EFF term: your adversaries)

One paragraph, five sentences or fewer. Write it in your own situation. Keep it somewhere only you can read it.

Two sentences is fine. A third sentence (the worry behind the worry) is a bonus, not the assignment. If it comes naturally, keep it; if not, stop at two.

Four asset buckets

Bucket	Examples
Information about people who trust you	Student names, grades, parent contacts; client records; patient information; source identities; employee data
Information about yourself you keep close	Health status, immigration status, legal exposure, professional drafts before they are ready, opinions you have not published, conversations you are working through
Credentials and account access	Logins, account recovery info, professional credentials, family accounts whose compromise would harm people you care about
Original work in progress	Anything not yet finished or published whose premature exposure would cost you revenue, reputation, a competitive position, or another person’s trust

You will not have something in every bucket. The buckets exist so you do not miss a category.

Five adversary categories (for an AI-tool seed paragraph)

Category	What it means
The vendor itself	Anything you give the vendor is, in some sense, in the vendor’s possession. Surveillance, storage, and training-data worries all sit here.
Whoever the vendor shares with	Third parties the vendor passes your data to: business partners, advertising relationships, government legal demands.
Whoever might breach the vendor	Attackers who access the vendor’s systems without permission. A different category from the vendor itself; both belong on the list.
People with shared access	Family members on a shared account, colleagues using a shared workplace login, a former partner still holding a credential, a contractor whose laptop touches your shared drive. Not adversaries by intent; often adversaries by accident.
You, in a moment of inattention	Honest planning, not self-blame. The most common adversary in most situations is your own next click: pasting into the wrong window, sending a draft to the wrong recipient, forgetting which conversation a session was in. Knowing this in advance is what lets you slow down at the moments that matter.

You do not need every adversary. You need the ones that actually apply to your situation.

Three pitfalls to dodge

Pitfall	Reality
Writing someone else’s threat model	Privacy literature is full of journalist-shaped threat models. Yours probably looks different. A teacher’s paragraph is not a journalist’s paragraph; both are valid; only one is yours. Write your real situation.
Listing assets you do not actually have	A short paragraph that is accurate beats a long paragraph that is aspirational. If you do not handle client data, client data does not go on the asset list.
Treating the paragraph as final	It is not. The paragraph is a Phase 1 artifact. Phases 2 through 5 add vocabulary and tools; lesson 6.6 grows it into a full personal privacy plan. Write a true first version, not a perfect final version.

3-step recovery: if you are stuck

Stuck on assets? Name three buckets from the table above, then write one specific instance of each. Do not start with “my data.” Start with a name or a file.
Stuck on adversaries? Write down every party whose possession of your assets would cost you something. Then cross out the ones whose possession would not actually cost much. Keep what remains.
Stuck on the whole paragraph? Write one sentence that completes this: “I am protecting [specific thing] from [specific party].” One true sentence is a complete seed paragraph. Build from there.

Where this seed goes next

Phase	What it adds to your paragraph
Phase 2	Shows you what actually happens to your assets when you press Enter. Data-flow trace.
Phase 3	Gives you a four-category vocabulary for the threats your adversaries pose.
Phase 4	Teaches the five-question rubric for reading a vendor’s actual posture against your asset list.
Phase 5	Shows how architectural choices eliminate some worries by design rather than by promise.
Lesson 6.6	Returns to this paragraph. Grows it into your complete personal privacy plan.

The first paragraph is the seed. Lesson 6.6 is the harvest.