How It Works
Four steps from first tap to a second device, with what happens on your device and what reaches the server at each one.
-
Sign In
Continue with Apple, Google, Microsoft, or a one-time email link. Signing in proves who you are. It does not unlock your data by itself; an enrolled device or your recovery method does that.
-
Your Device Makes the Keys
The first time, your browser creates the keys for your vault. The private parts stay on your devices, locked behind a passphrase you choose or a passkey. You are also shown a recovery key, once, and asked to save it, because a server that cannot read your vault cannot reset it for you either.
-
Count
Each tap becomes a small signed event. It is encrypted on your device, then sent. What arrives at the server is ciphertext plus the routing details needed to store it and pass it on.
-
Sync
A new device signs in, takes your recovery key, and from then on fetches the ciphertext and decrypts it locally. Delivery is usually quick, but a sleeping tab, a phone saving battery, or no connection can delay it. Nothing is lost while it waits.
What Travels, and What Does Not
The same list as on the home page, because it is the part that matters.
What the Service Can See
- Your account email address, kept in a protected form so sign-in mail can reach you.
- Which sign-in method you used, and a reference from that provider.
- Routing details: random identifiers for your devices, spaces and tallies, the order events arrived in, and when.
- Sizes and counts: how much encrypted data you store and how many requests you make.
- Usage counts with no account attached, and only if you turn them on in the app: for example that a tally was created, or which built-in theme was picked.
- How many accounts were created and how many sign-ins succeeded each day, as daily numbers with no account attached. The service counts these itself, whatever you choose in the app.
What It Cannot Read
- Tally names and folder names.
- Values: every count, increment and total.
- Notes and descriptions.
- The emoji you pick.
- Which theme your account uses, and the names and colors of themes you make.
What Stays on Your Device
- An encrypted copy of your vault in the browser's storage, so the app opens and counts without a connection. It is unreadable while the vault is locked.
- Two small settings in readable form: which theme to draw before you unlock (an identifier, never a name or a color you chose) and whether you turned product analytics on.
- Signing out removes this account's data from that browser.
What Protected Means
A protected tally or folder is hidden on this device until you unlock a second time, and it closes again after five minutes. It is a screen in front of the item. The item is encrypted with the same keys as everything else in your vault, no more and no less.
If You Lose Everything
If you lose every enrolled device and your recovery key, your encrypted tallies cannot be recovered by anyone, including the people who run the service. That is the cost of a vault only you can open. Keep your recovery key somewhere safe.