> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tinfoil.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud sync & encryption

> How Tinfoil Chat encrypts everything you save with a key only you control, and how to set up sync with passkeys or a manual key backup.

Cloud sync backs up your chats, documents, projects, and settings so they follow you across the web app and the iOS app. Everything is encrypted under your personal encryption key before it reaches persistent storage, so Tinfoil cannot read any of it.

## How it works

Cloud sync is built on two components:

1. **Your encryption key.** A 256-bit AES key generated on your device when you first enable cloud sync. It is displayed as a string starting with `key_` followed by 64 lowercase characters. This key encrypts all of your synced content.

2. **The sync enclave.** All sync traffic goes through a dedicated secure enclave — hardware-isolated compute whose code is [open source](https://github.com/tinfoilsh/confidential-sync) and verified through remote attestation on every app launch, before any data is sent. The enclave seals your data under your key and hands the resulting ciphertext to storage. Tinfoil's storage infrastructure only ever sees ciphertext.

Because the sync enclave runs attested, publicly auditable code, your key is protected the same way your prompts are protected during inference: it is used inside verified secure hardware and is never stored, logged, or visible to Tinfoil. Your key is persisted only on your own devices (browser storage on web, the Keychain on iOS).

<Info>
  If you lose access to your key, your data is unrecoverable — by design.
  Tinfoil has no master key, no recovery backdoor, and no way to decrypt your
  data for you. Set up at least one [backup option](#key-backup-options)
  before relying on cloud sync.
</Info>

## What gets encrypted and synced

Every category of saved content is encrypted under your key:

| Data                                                              | Synced | Encrypted                                                                                        |
| ----------------------------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------ |
| Chats (full conversation content)                                 | Yes    | Yes                                                                                              |
| Image attachments                                                 | Yes    | Yes (each attachment gets its own AES-256 key, which is itself stored encrypted inside the chat) |
| Document attachments (stored as extracted text in the chat)       | Yes    | Yes                                                                                              |
| Projects: name, description, instructions                         | Yes    | Yes                                                                                              |
| Project documents                                                 | Yes    | Yes                                                                                              |
| Personalization: nickname, profession, traits, additional context | Yes    | Yes                                                                                              |
| Custom system prompts                                             | Yes    | Yes                                                                                              |
| Prompt library entries and favorites                              | Yes    | Yes                                                                                              |
| Preferences: theme, language, model settings, pinned chats        | Yes    | Yes                                                                                              |
| Local-only chats                                                  | Never  | On iOS, encrypted with a device key; on web, stored in browser storage                           |
| Temporary chats                                                   | Never  | Never stored anywhere                                                                            |

A small amount of sync metadata is not encrypted because the storage layer needs it to order and reconcile records: record IDs, timestamps, version counters, and per-chat message counts. Chat titles and all content are encrypted.

<Note>
  Chat search is also private. The sync enclave maintains a per-user search
  index sealed under a key derived from your encryption key, so search works
  across your encrypted chats without exposing their contents.
</Note>

## Key backup options

Your key can be protected in two ways. You can use both at once.

### Passkeys (recommended)

A passkey — the credential behind Face ID, Touch ID, or your browser's passkey prompt — can protect your encryption key so you never have to handle it manually. Tinfoil Chat uses the open-source [Passkey Kit](/guides/passkey-kit) library for this:

1. Your passkey derives a key-encryption key on your device using the WebAuthn PRF extension.
2. That key wraps (encrypts) your chat encryption key.
3. Only the wrapped copy — ciphertext — is stored server-side.

On a new device, approving one passkey prompt unwraps your key locally and cloud sync resumes. Because web and iOS use the same passkey configuration, a passkey created in the browser unlocks the iOS app and vice versa, as long as your passkey provider (such as iCloud Keychain) syncs it between devices.

You can register multiple passkeys — one per device or platform — that all protect the same key. The Cloud Sync settings show a "Registered platforms" list where you can review and remove them.

### Manual key backup

If you prefer not to use passkeys, save a copy of the key itself. Tinfoil Chat offers three formats:

* **Copy the key string** (`key_...`) to a password manager or other secure location.
* **Download a PEM file** (`tinfoil-chat-key-<date>.pem`) and store it somewhere safe.
* **Show a QR code** on one device (web) and scan it from the iOS app.

To restore on another device, paste the key string, upload the PEM file, or scan the QR code during setup.

<Warning>
  Do not share your key with anyone, and only store it in a secure location.
  Anyone with your key and access to your account data can decrypt your
  chats.
</Warning>

## Set up cloud sync

<Tabs>
  <Tab title="Web app">
    ### Enable cloud sync

    1. Sign in at [chat.tinfoil.sh](https://chat.tinfoil.sh).
    2. Open **Settings** (gear icon in the sidebar) and select the **Cloud Sync** tab. You can also navigate directly to [chat.tinfoil.sh/#settings/cloud-sync](https://chat.tinfoil.sh/#settings/cloud-sync).
    3. Turn on the **Encrypted Cloud Sync** toggle.
    4. In the setup dialog, click **Continue**. If your browser supports passkeys, you'll be prompted to create one — this generates your encryption key and protects it with the passkey in one step.
    5. Without a passkey, choose **Generate Encryption Key** instead, then save the displayed key using **Download** (PEM file) or **Copy** before clicking **Let's go!**.

    ### Set up a passkey later

    1. Go to **Settings → Cloud Sync**.
    2. In the **Passkey** section, click **Add Passkey for seamless sync** (or **Set Up Passkey on This Device** if your other devices already use one).
    3. Approve the passkey prompt.

    ### View or copy your key

    1. Go to **Settings → Cloud Sync**.
    2. Under **Your Personal Encryption Key**, use the eye icon to reveal the key, click the key to copy it, or use the **QR code** and **Download** buttons.

    ### Restore your key on a new browser

    1. Sign in and open **Settings → Cloud Sync**, then turn on cloud sync (or click **Set Up Cloud Sync** in the sidebar).
    2. If you have a passkey, click **Unlock with Passkey** and approve the prompt. Done.
    3. Otherwise, choose **Restore Encryption Key**, then paste your `key_...` string or upload your PEM file, and click **Restore Key**.
  </Tab>

  <Tab title="iOS app">
    ### Enable cloud sync

    1. Sign in, open the sidebar, and tap **Settings**.
    2. Under **Chat Settings**, tap **Cloud Sync**.
    3. Turn on the **Cloud Sync** toggle. If you already have a passkey from another device, the app unlocks your key automatically with Face ID or Touch ID.
    4. For first-time setup, tap **Continue**, then **Generate Key**. Save the displayed key with **Save to Files** or the copy button, then tap **Done**. If a passkey was created during setup, the key is protected automatically and this step is skipped.

    ### Set up a passkey later

    1. Go to **Settings → Cloud Sync**.
    2. In the **Passkeys** section, tap **Add Passkey for seamless sync** (or **Set Up Passkey on This Device**).
    3. Approve with Face ID or Touch ID.

    ### View or copy your key

    1. Go to **Settings → Cloud Sync**.
    2. In the **Encryption** section, tap the copy button next to **Current Key**, or tap **Reveal Backup Key** (passkey users) to display the full key. For safety, copied keys are cleared from the clipboard after five minutes.

    ### Restore your key on a new device

    1. Enable cloud sync as above. If a passkey is available, the app recovers your key automatically.
    2. Otherwise choose **Restore Encryption Key**, then either type or paste your `key_...` string, import your `.pem` file, or tap **Scan QR Code** and scan the QR code shown in the web app's Cloud Sync settings. Tap **Restore Key**.
  </Tab>
</Tabs>

## If you lose your key

If you lose both your key backup and all passkeys, your encrypted data cannot be recovered. The apps offer a **Start Fresh** option that generates a new key so you can keep using cloud sync — but data encrypted under the old key is lost. The confirmation screen states this explicitly before you proceed.

To avoid this situation:

* Set up a passkey on at least one device with a synced passkey provider (such as iCloud Keychain).
* Keep a copy of the key string or PEM file in a password manager.
* Both together give you two independent recovery paths.

## Next steps

<CardGroup cols={2}>
  <Card title="Data controls & deletion" icon="trash" href="/chat/data-controls">
    Local-only chats, temporary chats, exporting, and deletion behavior.
  </Card>

  <Card title="Passkey Kit" icon="github" href="/guides/passkey-kit">
    The open-source library behind Tinfoil Chat's passkey-protected keys.
  </Card>
</CardGroup>