On your device

The Notes drawer ("My Puzzle Texts") stores its content in your browser's localStorage on your device. By default, notes are not transmitted to any server and are not shared between devices or browsers. Clearing your browser's site data removes them.

Optional cloud sync

You can choose to create an account (a username and a passphrase) to sync your notes across devices. When you do, your notes are end-to-end encrypted in your browser before they are uploaded, using a key derived from your passphrase that never leaves your device.

The sync service stores only the encrypted note data, your username, your key-derivation parameters (random salts and an iteration count), password-style verifiers that let you sign in, and encrypted copies of your note key that can only be unwrapped with your passphrase or recovery key. It cannot read your notes, and neither can we. This protection covers the sync service and the network. It assumes you trust the CacheSleuth website itself to deliver honest code, since the encryption runs in your browser using JavaScript we serve.

The account data is held by Cloudflare (Workers and D1) on servers in the United States. We use a Cloudflare Turnstile check to limit automated abuse, and we cap how many accounts can be created from one network address. An account that is not used for 18 months is automatically deleted, and you can delete yours at any time from the cloud panel in the drawer, which erases the encrypted copy on our server. Because the encryption is end-to-end, if you lose both your passphrase and your recovery key, the data cannot be recovered by anyone, including us.

One important caveat

By default, signing in on a device caches a session token and your note key in that browser so it can keep syncing without re-entering your passphrase. Anyone with access to your unlocked device or browser profile can therefore read and sync your notes (by default your notes are also stored unencrypted in that browser, as above). Changing the passphrase or deleting the cloud account does require re-entering your passphrase, so a cached session alone cannot lock you out or erase your account. Sign out on shared devices, choose a strong passphrase, and do not store passwords, financial details, or other sensitive personal data in your notes.

Lock mode (optional at-rest encryption)

The cloud panel has an "Encrypt notes on this device" option. When you turn it on, the unencrypted at-rest copy in your browser's localStorage is replaced by an encrypted vault, and the working copy plus your cached note key move to sessionStorage, which the browser clears when the tab closes. You then re-enter your passphrase once per session on each device to unlock your notes. So a cold or shared device holds only ciphertext. Lock mode protects your notes at rest, not while the page is open and unlocked, and it does not change what the sync service can see, which is still only ciphertext.

Notes and the Waypost apps

The notes drawer is part of the shared site layout, so its code is present in the Waypost app package. It has no entry point there: the sidebar that opens the drawer is hidden in the app, so notes cannot be created, read, or synced from inside Waypost.

Waypost does have its own optional sign-in, to the same CacheSleuth account, so cartridges and saved games can move between your devices. Signing in there does not fetch, store or sync your notes, and it never has: it establishes the account session and stops. The key Waypost uses for its own data is a one-way derivation of your account key, so it cannot read your notes either. See the Waypost page.