~/private
it uses gocryptfs -- a newer alternative to EncFS -- to encrypt paths and data (but not metadata) onto an underlying backing filesystem
