Exactly where your data lives, what is encrypted on your machine, and the short list of things our servers can read.
What it's for
This is the honest map of where your data lives and what, if anything, leaves your machine. Read it once, so nothing about how Umbra stores things surprises you on a bad day.
On your machine vs on our servers
Almost everything stays on your computer: your Accounts, their Fingerprints, cookies and storage, your proxies, your one-time codes. Our servers exist for two narrow jobs — checking your licence, and (only if you switch it on) syncing an encrypted copy of your Accounts between your own devices.
Sync is encrypted, not zero-knowledge
When you turn Sync on, the contents of your Accounts and proxies are encrypted on your machine before anything uploads, with a key derived from a passphrase you choose. We store what we cannot read.
What the server can read
Encryption hides the contents — not the fact that they exist. To sync at all, the server necessarily sees some things in the clear.
Can read
Item ids, how many items you have, the exact size of each sealed blob, your licence key, your device id, the encryption salt, a sealed verifier, and your account email and device list.
Cannot read
The contents of any Account or proxy — logins, cookies, Fingerprints, addresses, codes. Those are sealed on your machine.
If you've ever read "the server only learns ids and counts," that's the sentence to distrust — sizes, licence and device identifiers are visible too. The honest line is narrower: the server can't read your Accounts' contents.
The captcha harvester is shared
Here is the one place isolation is deliberately looser, and you should know it before a drop. When a site throws a CAPTCHA (or a Google sign-in), the solve runs in a single, shared helper Session — not behind the Account's own exit.
Lose the passphrase, lose the backup
The flip side of us not being able to read your backup is that we can't recover it for you either.