Where your data is stored

On your Mac (every choice)

• ~/Library/Application Support/ro.pixel8.remem/ holds vault.db (your items, each one encrypted, plus this Mac’s access log), account.json and security.json (your settings).
• account.json is not encrypted. It holds your email, account ID, this device’s identity key, your sync server’s address, and the optional phone number if you gave one.
• Someone who copies vault.db can see how many items you have and when they changed, but not what they are. Your vault’s name, Personal, is stored there in the clear.
• In the access log, each entry’s time, what kind of thing happened and whether it came from the app or the terminal are in the clear. Which program asked, which item and what was read are encrypted with a key made from your vault’s key, so a copy of the file shows that something read the vault, and when, but not what. An entry written while the vault is locked keeps no detail at all.
• The access log keeps those details private, but it can’t stop someone with your Mac’s files from altering it. Settings marks what it can detect: “This entry could not be verified. It was changed after it was written.” on an altered entry, and “1 earlier entry is missing from the log.” (or how many) where entries were removed.
• If you used Remem before this protection arrived, updating removed the identifying text from older entries. A backup or snapshot of the file made before you updated, such as a Time Machine copy, can still hold it.
• Your Keychain holds your Secret Key, and, if Touch ID unlock is on, the key that unlocks the vault.
• Encrypted backups and exports are files you keep wherever you put them.

Where the synced copy lives

For Remem Cloud, storage is set up in the EU, but Cloudflare’s network accepts your connection at the location nearest you, wherever that is. Release downloads are kept in a separate EU storage bucket that holds no vault data. Cloudflare’s point-in-time backups of the database roll off within 30 days.

In your browser

The extension keeps an encrypted copy of your items in the browser profile, and your Secret Key encrypted under your master password. Someone who copies your browser profile could try to guess your master password offline, so choose a strong one.