Driftleaf encrypts everything with your passphrase — not a vendor-held key, not a recoverable copy stored anywhere. That's the whole privacy model: we never see your data because it's never sent anywhere for us to see.
Your passphrase is run through scrypt to derive an encryption key, which is never stored — only the salt used to derive it is. Notes, database contents, and metadata (titles, folder paths, timestamps) are encrypted with AES-256-GCM. AES-GCM authenticates ciphertext, so a bit-flip or truncated file is detected on read rather than silently returning garbage — and corruption is caught per-file, not branch-wide.
A branch is just a folder (internally called a vault):
my-branch/
├── .driftleaf/
│ ├── vault.json format version + scrypt salt (never the derived key)
│ ├── canary.enc known-plaintext blob used to check your passphrase on unlock
│ ├── manifest.enc encrypted index of notes, folders, and databases
│ ├── notes/
│ │ └── <note-id>.enc
│ └── <database-id>.db.enc
There's no password reset. Driftleaf doesn't store your passphrase or a recoverable copy of the key, so a forgotten passphrase means the branch cannot be opened — by you or by anyone else. Write it down somewhere safe when you create a branch, ideally in a password manager.
From Settings → Diagnostics & Branch Health → Create backup, Driftleaf copies your branch (including the hidden .driftleaf/ directory) to a destination outside the branch, without overwriting earlier backups. You can verify a backup from the same screen — verification is read-only and never modifies the backup. To restore, copy the verified folder back and open it in Driftleaf.
Because the branch is just a folder, a manual copy to an external drive or another machine works too — as long as you include .driftleaf/, not just the visible note folders (that hidden directory holds encrypted database data and the key material).
Writes go to a temp file and land via an atomic rename, so a crash mid-save can't leave a half-written file. Every unlock runs a reconciliation pass that cross-checks the manifest against what's actually on disk and repairs mismatches automatically.
Driftleaf can run local JavaScript extensions from the Extensions button. They execute in isolated windows with network access disabled by default; note-graph and selected-database access are separate, off-by-default permissions. Extension code and its grants are stored inside your encrypted branch.
Nothing, by default. The only network activity is an optional update check, which contacts GitHub for public release metadata — nothing about your branch, notes, or passphrase ever leaves your machine.
Driftleaf is covered by AetherAssembly's project-wide security policy — see it for how to report, what's in scope, and what to expect.