Private vs Cloud sync
You choose a sync mode once at setup. Switching later is a new household. Search for private sync when you want this page.
Cloud
The sequencer sees plaintext mutations. It can reject an unbalanced transaction, a stale epoch, or a duplicate occurrence. Use Cloud if you want the later web app, household sharing, or bank connections. The server still stores only the op log and materialized tables for your household.
Private (E2EE)
Payloads are encrypted on the device with XChaCha20-Poly1305 before they leave. The household data key is wrapped with Argon2id and your recovery key (fcr2). Older fcr1 AES-256-GCM envelopes still decrypt so test data and backups can upgrade. Devices share the data key with X25519. The server sees household id, op id, a blinded idempotency key, sizes, and sequence numbers. It cannot validate splits. Each client checks incoming ops and quarantines anything invalid.
You receive a recovery key once. It wraps the household data key. Store it offline. Anyone with the key can unwrap the household. There is no reset email.
Bank aggregation is not available in pure Private mode. Import OFX or CSV locally instead.
What the server never is
The server is not a folder of SQLite files. File-based copies are how households diverge. Private mode is still op-log sync; encryption does not turn it back into a file share.