Sync & encryption

Takt stores notes in a local database first. With device encryption enabled, note content is encrypted on your device before sync.

How device-encrypted sync works

Your encryption passphrase is processed with PBKDF2-HMAC-SHA256 using 600,000 iterations and a random salt to derive a wrapping key. That wrapping key encrypts your device-generated AES-256 master key; your note content is encrypted locally with AES-256-GCM (with the note's ID bound as additional-authenticated-data) before sync. The passphrase is not sent to the server and cannot be reset by Takt. The runtime encryption key lives in the browser as a non-extractable CryptoKey — it cannot be read out by page scripts or extensions.

Unlocking on a new session

By default, Takt asks for your encryption passphrase once per session. You can optionally cache the derived key (still as a non-extractable CryptoKey) for a chosen timeout so the app re-opens without re-entry. Disabling the cache means a passphrase prompt on every launch.

On devices with a registered passkey that supports the WebAuthn PRF extension, the passkey itself can unlock your encrypted notes — no passphrase re-entry. The wrapped key bytes on the server are inert without the registered authenticator.

Two passwords, one account

Takt has two distinct credentials:

• Login password — protects your account on the server. Used for sign-in and 2FA.
• Encryption passphrase — protects device-encrypted notes. Used to derive the encryption key on your device.

You can change either one independently from the Settings page.

Resetting the login password

What a reset does to your notes depends on which mode you're in:

• If you set a separate encryption passphrase, your notes survive a reset — the wrapping is independent of the account password.
• If you use the login password to also wrap the key (no separate passphrase configured), completing an email-link reset deletes all encrypted notes. The server cannot re-wrap them under a new password because it never had the key. The reset page and the privacy notice warn about this before you confirm.

Two-factor authentication

Optional TOTP-based 2FA is available for the login password. Set it up once with an authenticator app and you'll be asked for a code after entering your password on a new device. Setup also generates one-time 10-character recovery codes (shown in grouped form for readability) that you can use if you lose access to your authenticator. Codes are stored hashed and are deleted on use.

Re-authentication for sensitive actions

Some account actions — changing your password, deleting your account, and similar — prompt for your current password again, even when you are already signed in. This limits the damage if someone gets brief access to an unlocked session.

• Deleting your account requires re-entering your current password.
• Changing your login password automatically signs out every other active session.

Sessions

Sessions have an absolute lifetime of 90 days. Beyond that you'll be asked to sign in again, even if the session has been kept warm. You can end every session at once from Settings → Sign out everywhere.

Offline-first sync

Changes are written locally first. Sync runs in the background when the app has connectivity:

• Local writes go into a pending changes queue.
• The queue drains to the server in order. Device-encrypted note content is uploaded encrypted.
• Incoming changes from other devices are decrypted locally and merged.

The status banner at the bottom of the sidebar shows whether sync is complete, pending, offline, or blocked by an error.

What the server stores

• Your account email and a bcrypt hash of your login password.
• Encrypted note payloads (ciphertext) for device-encrypted notes.
• Per-note metadata: timestamps, task/done state, deadlines, reminders, trashed flags. This is needed to merge changes between devices and to drive the agenda view.
• Encrypted images, drawings, and the Excalidraw library — stored as ciphertext.
• Routing tokens for push notifications (opaque per-device tokens).

Takt does not store your encryption passphrase, your encryption key, or the content of device-encrypted notes in any readable form. Tag names that appear inside device-encrypted notes are parsed on your device from the decrypted text and are not server-readable.

Optional server-readable features

Some optional features require server-readable content. A note has to be in this mode to participate in any of them:

• API access — the note is reachable to an API key you created. Tag names on these notes are also server-readable so that API consumers can filter by tag.
• Email-to-note — incoming mail is appended to a server-readable note.

These notes are marked separately in the UI and are converted by a device when the mode changes. Use device-encrypted sync for notes you want protected by your on-device encryption passphrase.

Where it runs

The backend runs on Swiss infrastructure (Hostpoint AG). The web app loads no third-party scripts, analytics, fonts, or trackers — only its own origin. Push notifications to iOS go through Apple's APNs (routing only; no note content).

The demo

The demo does not sync. Data stays in the browser's local database and can be reset from the demo controls.