What encryption here means

The three names, and why naming them matters

A padlock icon is not a claim — it cannot be checked, and it cannot be wrong. These can:

• AES-GCM-256 — the cipher that seals note content. GCM is an authenticated mode, which means tampering with the stored data makes decryption fail loudly rather than quietly returning nonsense.
• PBKDF2-SHA256 — how a passphrase becomes a key. It is deliberately slow, so guessing passphrases in bulk is expensive.
• The system Keychain — where the key lives, rather than in the database next to the data it protects.

All three are in LatticeCore/Sources/LatticeCore/Crypto/LatticeCrypto.swift. You do not have to take my word for any of it, which is the point of writing them down.

What "before it leaves your device" actually means

Content is sealed on your device and the sealed bytes are what gets stored or synced. A server holding those bytes holds something it cannot read.

That is a meaningfully different claim from "we encrypt your data", which almost always means encryption in transit (TLS, which every website including this one has) and at rest on a disk the provider also holds the key to. Both are worth having. Neither means what people hear.

The four things it does not protect you from

This is the honest half, and it is longer than the reassuring half on purpose.

1. Anyone who can unlock your device. The key is in the Keychain and the Keychain opens when you do. Encryption at rest is protection against a stolen disk, not against a borrowed phone.
2. Metadata. How many notes you have, when you wrote them, how big they are, how often you sync. Ciphertext hides content; it does not hide the shape of the collection around it.
3. Anything you send somewhere on purpose. If the AI layer is switched on and you ask a question about your vault, the excerpts needed to answer it leave in a form the server can read — they have to, or it could not answer. Encryption at rest says nothing about that flow. The trust page tracks it separately for that reason.
4. A bug in my implementation. The algorithms are standard and well-analysed; the code calling them is mine, unaudited, and read by nobody else. Most real-world failures are in that second category rather than the first.

A forgotten passphrase is a lost vault

There is no recovery path, and there cannot be one that is not also a back door. A "reset my encryption" button implies someone holding a spare key — which would make every sentence above false. If encryption is real, losing the key means losing the data. That trade is the product, not a rough edge.