Memoir security
Security without vague promises
“Encrypted” should say what is encrypted, when, and what the owner must protect. Memoir separates its cloud-payload protection from local storage and device access controls.
Cloud payloads
Encrypted before supported data is uploaded
Supported cloud-sync payloads are encrypted before upload with AES-256-GCM using key material derived with Argon2id.
- Payload cipher
- AES-256-GCM protects supported cloud-sync payloads.
- Key derivation
- Argon2id derives key material from the owner's protection inputs.
- Storage destination
- The encrypted payload is stored in the Google Drive account the owner connects.
Access controls
Password, app lock, and platform biometrics
Memoir includes password and recovery-key setup, an app-lock flow, and biometric convenience unlock where the platform supports it.
Biometric behavior depends on the platform and device. It is a convenience path for unlocking protected key material, not a claim that Memoir stores a face or fingerprint template.
Recovery
The owner holds the recovery path
A recovery key can restore access to protected Memoir data, but Memoir cannot recreate a lost password and recovery key.
Keep recovery material somewhere separate and durable. Memoir does not run a service that can retrieve your password, recovery key, or plaintext diary. Losing every recovery path can make encrypted cloud data inaccessible.
Next step
Plan an optional Drive backup
Review who owns the storage, what crosses the network, and what you need to retain for a future restore.