diff --git a/.gitignore b/.gitignore
index c726541..ae5264c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -70,3 +70,22 @@ alembic/versions/__pycache__/
 *.sqlite
 *.sqlite-journal
 .superpowers/
+
+# Raw platform captures (milestone 387 C0 and successors). These are real
+# authenticated API responses taken from the operator's own account, so they
+# carry account data — creator lists, pledge amounts, and (in Patreon's case)
+# the account email inside the `card` resources. They are kept locally because
+# re-capturing means re-authenticating by hand, and they are the ground truth a
+# characterization gets re-checked against.
+#
+# The whole directory is ignored, not one filename, so a future capture is
+# covered by this rule instead of needing a new line somebody has to remember.
+#
+# SANITIZED fixtures derived from these DO belong in git — put them somewhere
+# else (tests/fixtures/, not here), with the account data stripped.
+# Ignore the CONTENTS, not the directory: git does not descend into an
+# excluded directory, so a negation for a file inside one never takes effect.
+# Writing it this way lets README.md be committed while everything else here
+# stays out.
+tests/fixtures/captures/*
+!tests/fixtures/captures/README.md
diff --git a/tests/fixtures/captures/README.md b/tests/fixtures/captures/README.md
new file mode 100644
index 0000000..7e3b6ce
--- /dev/null
+++ b/tests/fixtures/captures/README.md
@@ -0,0 +1,43 @@
+# Raw platform captures — local only, never committed
+
+This whole directory is gitignored (see `.gitignore`). Nothing in here should
+ever be staged.
+
+## What lives here
+
+Real authenticated API responses, captured by hand from the operator's own
+browser session, kept as the ground truth a characterization note gets
+re-checked against. Re-capturing is manual and requires re-authenticating, so
+these are worth keeping locally even though they can't be committed.
+
+They carry live account data. The Patreon members capture, for example,
+contains the operator's creator list, pledge amounts, and — inside the `card`
+resources the web app's include set pulls — the account's own email address.
+That is exactly why the directory is ignored wholesale rather than by filename.
+
+## What does NOT live here
+
+**Sanitized fixtures belong in git**, under `tests/fixtures/`, not in this
+directory. A fixture with the account data stripped is the thing tests should
+load; the raw capture is only for deriving it and for re-checking a
+characterization when a platform's shape is suspected to have drifted.
+
+## Current contents expected
+
+| file | characterized in | step |
+|---|---|---|
+| `patreon_members_<YYYYMMDD>.json` | Scribe note #3886 | milestone 387 C0 |
+
+## How to (re-)capture the Patreon members response
+
+1. Log in, go to `patreon.com/settings/memberships`.
+2. DevTools -> Network, filter `api`, reload.
+3. Find the `members?include=...` request (it self-identifies: its query string
+   ends `members_request_source=settings_memberships`).
+4. Right-click the request -> **Save Response As...** -> save it here.
+
+Save the response, not a HAR: a HAR bundles the request headers, which means
+the session cookie ends up in the file.
+
+Note that the response's own `links.first` is built WITHOUT the `/api/` prefix
+and is not a usable URL — see note #3886 before writing a client against it.