Local-first & encryption

Write up a Book on a plane, search your reading notes with no signal, and know that the copy on your laptop is encrypted at rest. Lar reads and writes the workspace on your device first. Creating, editing, browsing, and searching need no account and no connection. Sync is an optional way to move changes between devices, not the source of truth.

What local-first means

Your device has a complete working copy of the workspace.
A dropped connection does not make the app read-only.
Concurrent edits merge automatically. Lar never asks you to choose “mine” or “theirs.”
The interface shows the state of the connection, such as connecting, syncing, current, offline, degraded, or error. There is no separate merge-state screen.

Local-first is not a backup. Sync can copy an accidental deletion or an unwanted edit to every device, so keep backups as well.

Protection on desktop

The desktop app encrypts the workspace database at rest, including titles, properties, and the search index. Attachments, saved versions, and other files use authenticated encryption (AES-256-GCM).

The workspace key is sealed with your operating system’s keychain. If the keychain is unavailable, which can happen on some Linux setups, Lar stores the key unencrypted on disk. Settings → About Lar then warns you, and anyone with file access to the device can read the key.

Protection on web and mobile

The browser app and the mobile apps encrypt workspace updates, attachments, and the search index with your workspace key. The difference from desktop is how the key itself is protected:

Browser: the key lives in the browser’s storage. Device unlock (a passkey) or a passphrase, both set in Settings → Security, protects it. If you continue without logging in, the browser opens the workspace without asking, so code running on the page, such as a malicious extension, could read your notes.
Mobile apps: the key goes to the native keychain or keystore.

Clearing a browser’s site data deletes the key along with the workspace. Save your recovery code, and read Install & availability.

When data leaves the device

Data leaves only through a feature you set up or use, including:

Workspace sync or per-Object sharing
Publishing a snapshot to the web
A cloud AI action, after you consent to it
A connected integration, when you choose Test or Sync or turn on background sync
An outbound Workflow action, such as a webhook
An export saved to a location you choose

The desktop app also checks for updates on its own; that request carries no note content. See the FAQ.

The relay stores and forwards encrypted updates. It never receives your content keys, so it cannot read your notes or their structure. It can see routing metadata: which accounts share with each other and when, and your public keys. A peer-to-peer signaling server only introduces your devices, and the room password encrypts updates before they cross it.

AI providers and integrations are different: they receive the content shown or described when you consent, because they need it to do the work.

Keep your own recovery path

Encryption cannot bring back a lost key or a deleted workspace. Keep verified backups somewhere separate from the active workspace. Before deleting anything, read the confirmation carefully: Delete server account removes server-side account data but leaves local workspaces on the device, and deleting a local workspace is a separate action.