Cross-device planning, encrypted by design.

Encrypted sync is part of WeekFlux Pro, and it is off until you turn it on. Local-first remains the default for everyone, so the planner works fully on a single device without sync.

Because it is opt-in, you decide if and when your plan leaves your device. Choosing not to enable sync changes nothing about how the local planner behaves.

When you enable sync, you set up an encrypted vault protected by a password. From that password WeekFlux derives an encryption key locally, using PBKDF2-HMAC-SHA-256 at 600,000 iterations, so the work of turning your password into a key happens on your device.

At setup you also receive a one-time recovery key. It is a backup way into your vault if you ever forget your password, so store it somewhere safe and separate from the device.

The vault uses standard cryptography from the browser's native Web Crypto API, not homegrown algorithms. A single random data key encrypts your planner, and that data key is then wrapped separately by your password, your recovery key, or a passkey — an approach called envelope encryption. This is what lets you change your password without re-encrypting everything, and it means no wrapping secret is ever sent to the server.

Once sync is on, your encrypted plan moves between your devices: start on the desktop, continue on mobile, and the changes follow. Everything is encrypted locally before it is sent and decrypted only on a device that holds your key.

On supported devices you can unlock with a passkey or biometrics through the WebAuthn PRF extension, so the unlock secret never leaves the device. A configurable auto-lock clears the key from memory after a period of inactivity, which is useful on shared or mobile devices.

Because the encryption is zero-knowledge, WeekFlux cannot reset your password or read your data for you. Entering the wrong password simply fails to decrypt — it does not delete or corrupt anything, and your local data stays intact.

The trade-off is real and worth stating plainly: if you lose both your password and your recovery key, no one, including WeekFlux, can recover the encrypted data. That is the cost of a design where only you hold the keys.

Sync is always optional. If you go offline, WeekFlux falls back to local-first so you can keep planning, and changes reconcile when you reconnect. If you later disable sync, your local data stays on the device untouched.

Backups and exports remain available regardless of sync, and encrypted backups use the same scheme as the vault. Your data stays portable whether or not you ever turn sync on.