How Encryption Works

CurbApps sync is end-to-end encrypted and zero-knowledge.

The model

1. Each entity, whether a bookmark, note, OTP account or vault entry, is encrypted on your device with AES-256-GCM before it leaves.
2. The encryption key is derived from your master password, or generated as an auto-unlock device key.
3. The sync server stores and forwards ciphertext only. It never holds the key and never sees plaintext.

What this means

• We cannot read your synced data, by construction: not the content, not the titles.
• A breach of the sync server yields only encrypted blobs.
• Losing your master password means the data cannot be recovered; that is the trade-off for a server that needs no trust.

Scope

Identity, accounts and billing live in Supabase. Sync data lives in a separate data plane, so the two are kept apart by design.