diff --git a/.gitignore b/.gitignore
index 6e418bf..8f925c5 100755
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,9 @@
-# Live application data - real phone numbers, employee names, login credentials, session key.
-# Never commit these. The Docker volume recreates this folder at deploy time.
+# Previous live-data location. Production now uses the PostgreSQL Docker volume.
 /TelcoPortal-data/
-/data/
+
+# Track only the legacy import database; keep generated secrets and other local data private.
+/data/*
+!/data/telco.db
 
 # Leftovers not meant to be tracked (see chat history for context).
 /_to_delete/
diff --git a/README-Docker.md b/README-Docker.md
index 5d71e70..4d75a72 100755
--- a/README-Docker.md
+++ b/README-Docker.md
@@ -7,7 +7,8 @@ The Docker stack contains two services:
 
 ## First start and SQLite import
 
-1. Put the existing SQLite database at `data/telco.db` next to `docker-compose.yml`.
+1. The legacy SQLite database is included at `data/telco.db`, so Git-based deployments receive
+   the import source automatically.
 2. Optionally set a database password in a `.env` file:
 
    ```env
diff --git a/data/telco.db b/data/telco.db
new file mode 100644
index 0000000..75a818e
Binary files /dev/null and b/data/telco.db differ