Encrypted Sync in Pro for Local-First Weekly Planning

Encrypted sync is part of WeekFlux Pro, and it is off until you turn it on. Local-first remains the default for everyone, so the planner works fully on a single device without sync.

Because it is opt-in, you decide if and when your plan leaves your device. Choosing not to enable sync changes nothing about how the local planner behaves.

When you enable sync, you protect encrypted sync with a password. From that password WeekFlux derives an encryption key locally, using PBKDF2-HMAC-SHA-256 at 600,000 iterations, so the work of turning your password into a key happens on your device.

At setup you also receive a one-time recovery key. It is a backup way to recover encrypted synced data if you ever forget your password, so store it somewhere safe and separate from the device.

Encrypted sync uses standard cryptography from the browser's native Web Crypto API, not homegrown algorithms. A single random data key encrypts your planner, and that data key is then wrapped separately by your password, your recovery key, or a passkey — an approach called envelope encryption. This is what lets you change your password without re-encrypting everything.

Once sync is on, your encrypted plan moves between your devices: start on the desktop, continue on mobile, and the changes follow. Everything is encrypted locally before it is sent and decrypted only on a device that holds your key.

On supported devices you can unlock with a passkey or biometrics through the WebAuthn PRF extension, so the unlock secret never leaves the device. A configurable auto-lock clears the key from memory after a period of inactivity, which is useful on shared or mobile devices.

Entering the wrong password simply fails to decrypt — it does not delete or corrupt anything, and your local data stays intact.

The trade-off is real and worth stating plainly: if you lose both your password and your recovery key, encrypted synced data may not be recoverable. Keep your recovery key somewhere safe and separate from the device.

Sync is always optional. If you go offline, WeekFlux falls back to local-first so you can keep planning, and changes reconcile when you reconnect. If you later disable sync, your local data stays on the device untouched.

Backups and exports remain available regardless of sync, and encrypted backups use the same encryption scheme. Your data stays portable whether or not you ever turn sync on.