Private vault

1. What it is

Without the vault, your record is stored in your account the standard way: encrypted on the way and on our providers’ disks, but readable by our systems, which is what lets connected AIs and Ask Cykl read it on our server. That is how most apps work, and it is still how Cykl works unless you choose otherwise.

With the vault on, your devices encrypt every record before it leaves them, with a key that only your devices hold. Our servers keep your phone, your Mac and the web in step, but what they keep is scrambled text without the key to open it. Everything you do in Cykl works as before, offline too.

It is optional. Turn it on in Settings → Account → Sign-in & security → Private vault, or from Settings → Privacy. It takes a minute or two.

2. Who can read your record

3. What we can always see

Your email address, your plan, when you last synced, and how much space your record takes. Never what’s in it.

To keep your account working we also see the names of the devices that can unlock your vault (“iPhone”, “Chrome on Mac”) and when each was last seen, and when each record was last changed, though not what it is. The full list is under what stays in plain.

4. What changes

Stops working

• AIs you connect can’t read your record. Claude, ChatGPT and any other app with an access token get a polite refusal when they ask to read. They can still send readings, such as last night’s sleep, and those arrive.
• We can’t help by looking at your data. If something looks wrong, we can only see an export you choose to send us.

Keeps working

• Everything you do in Cykl, on every device, offline too.
• Sync between your devices.
• Readings from your watch, Health Auto Export and Shortcuts.
• Reminders and notes from Cykl.
• AI suggestions and Ask Cykl: your device decrypts the part one answer needs and sends it to Claude, which keeps nothing and never trains on it. A switch in the turn-on steps, Use AI in my vault, turns AI off for those who want none of it.

Turning the vault on also switches usage analytics off, because people who choose a vault expect nothing to leave. You can switch it back on in Settings → Privacy; it never contains what you write either way.

5. Your recovery key

When you turn the vault on, Cykl shows you a recovery key once. It looks like this:

CYKL-7K3QD-M9X2P-R4T8W-H2N6C-J5V9E-QX3M7-K

It is the only way back into your record if you lose every device you are signed in on. Nobody else has it, not even us. Keep it somewhere safe that isn’t the device itself: your password manager, the recovery sheet you can download, a printout. You type it back once to prove it was saved, and you can make a new one at any time from a device that is unlocked.

What losing it means. If every device you were signed in on is gone and the recovery key is gone too, your record can’t be opened, by you, by us or by anyone. That is the promise the vault makes, and the app says so before you turn it on. You can still keep your account and your plan: Start over gives you an empty vault, or you can sign out and come back when the key turns up. Nothing is lost by waiting.

6. Forgetting your password

That’s fine. The vault’s key is not your password, so resetting your password by email works exactly as it always has and costs you nothing. Afterwards, a device you sign in on is unlocked the usual way: from another device, or with your recovery key. This is also why the vault works for people who sign in with Apple or Google and have no Cykl password at all.

7. New devices and lost ones

A new device asks to be unlocked once, after you sign in. Approve it from a device that is already unlocked, after checking that both show the same four-digit code, or type your recovery key. If a request appears that you didn’t make, choose This wasn’t me: nothing is unlocked, and the app suggests changing your password.

A lost or stolen device can be removed from any unlocked one, in Settings → Account → Sign-in & security → Private vault. Choose Remove and change key and your record is sealed again under a new key, so the lost device can’t open anything new.

On each device, the copy the app works from is protected by that device’s own lock: your phone’s passcode, your Mac login, your browser profile. The vault’s promise is about our servers; it doesn’t add a second lock on your own devices.

8. Turning it off

From an unlocked device: Settings → Account → Sign-in & security → Private vault → Turn off private vault. Your record is decrypted and stored the standard way again, readable by our systems, so connected AIs and Ask Cykl on our server work as before. Your recovery key stops working.

9. The technical design

For anyone who wants to check our work. This is the whole design. It is published openly and has not had a paid outside review; if you find a flaw, please write to [email protected].

Keys

• Vault key. 32 random bytes (256 bits), made on the device that turns the vault on. One per account per key version; removing a device with change key makes a new version. It seals every record and setting, and is never derived from your password.
• Account key pair. X25519. The public half is stored in plain beside the vault’s state, so our server can seal things to your account without being able to open them. The private half is stored sealed with the vault key.
• Recovery key. 30 random characters in Crockford base32 (150 bits), shown in six groups of five after CYKL, then one check character that catches any single typo or swapped pair. HKDF-SHA256 turns it into a wrapping key, and the server stores the vault key sealed with it. Because the key is random and long, it needs no slow password hash, and unlocking with it is instant. Typing it back accepts any case, missing dashes, and 0/O and 1/I/L alike.
• On each device the vault key and the account’s private key are kept in the platform’s secret store: the iOS Keychain, the Android Keystore, Electron’s safeStorage on Cykl for Mac, and a separate IndexedDB database in a browser, which is the weakest of the four and the app says “this browser” for that reason.

How a record is sealed

• Each record is encrypted on its own with XChaCha20-Poly1305 under the vault key, with a random 24-byte nonce. The stored value is the nonce followed by the ciphertext.
• The associated data is uid/collection/documentId/keyVersion, and the record’s own id travels inside the ciphertext; after opening, the device checks that the id maps to the same blinded document id. So a sealed record can’t be moved to another account, another collection or another record, or replayed under an old key, without failing to open.
• Settings are sealed the same way.
• Document ids are blinded: the first 26 characters of base32(HMAC-SHA256(vault key, collection/id)). Some ids were words you chose, such as a metric’s name; blinding keeps them out of the database’s paths. Deletion markers use the same blinded id.
• Changes still merge field by field, as they always have: the device opens the account’s copy, lays its change over it and seals the result again, inside one transaction.
• Database rules refuse a record written in clear into a vault account, so an older version of the app can never write your record unencrypted.

What stays in plain

• Each record’s blinded document id, when it was last updated, its schema version and when the server received it. Sync needs them; they say that something changed and when, not what.
• How many records there are, and how large each sealed one is.
• Your account: email address, the name you gave at sign-up if any, when it was created, your plan and subscription status, the vault’s on switch and key version, and your choice about usage analytics.
• The vault’s public key, the sealed private key, the sealed recovery wrap and when the recovery key was confirmed.
• The devices that can unlock: their names, platforms, and when each was added and last seen. No keys.
• For changes sent by connected apps: their status, times and which app sent them; their content is sealed.

The fields that let a fresh device show today’s page before the rest arrives (a day’s date, whether an action is done, a cycle’s level and dates) are dropped in a vault. A new device downloads each collection whole instead, so its first look takes a little longer.

Unlocking a new device

• The new device makes a one-time X25519 key pair and posts an unlock request with its public half.
• Both devices show a four-digit code derived from a hash of the new device’s one-time public key and the account’s public key. If our server swapped the new device’s key to put itself in the middle, the codes would differ, which is why the app asks you to compare them.
• The approving device seals the vault key and the account’s private key to the new device’s one-time key. The request is deleted when it is used, or after 10 minutes.
• With the recovery key instead, the device derives the wrapping key with HKDF-SHA256 and opens the stored wrap itself.

Writes the server receives

Readings from your watch, Health Auto Export and Shortcuts, and changes sent by connected apps, reach our server in the clear over HTTPS, because that is how those apps send them. In a vault account the server seals each one to your account’s public key the moment it arrives (an ephemeral X25519 key agreement, HKDF-SHA256 and XChaCha20-Poly1305) and stores only that. Your devices open it and apply it, and the record of changes they keep is sealed by the device too. Reading requests from connected apps are refused with a message the app can pass on to you.

AI in the vault

Ask Cykl and AI suggestions run from your device: it decrypts the part of your record one answer needs and sends that, through our server, to Anthropic’s Claude. Our server passes it on and stores nothing; Anthropic doesn’t keep it or train on it. With Use AI in my vault off, nothing is sent at all.

Libraries

@noble/ciphers (XChaCha20-Poly1305), @noble/curves (X25519) and @noble/hashes (HKDF, HMAC, SHA-256): audited, dependency-free JavaScript, the same code on the phone, the Mac, the web and our server.

What it doesn’t cover

• The copy on your own devices, which their own lock protects.
• An export file you save, which is in clear so you can read it anywhere.
• Old unencrypted copies in our providers’ backups from before you turned the vault on, which expire on the schedule in our privacy policy.

More on how your data is handled in general is in the privacy policy.