Local-first & encryption

Lar reads and writes the local workspace first. Creating, editing, browsing, and searching do not require an account or a connection. Sync is optional transport rather than the source of truth.

What “local-first” means

Your device has a complete working copy of the workspace.
Network interruptions do not turn the app read-only.
Concurrent edits merge automatically; Lar does not ask you to choose “mine” or “theirs.”
The interface reports transport states such as connecting, syncing, current, offline, degraded, or error. It does not expose a separate merge-state UI.

Local-first is not the same as backup. Sync can reproduce accidental deletion or unwanted edits. Create portable backups independently.

Protection on desktop

Desktop encrypts workspace data at rest, including titles, properties, and search data. Attachments, versions, and other files use authenticated encryption. Workspace keys stay in the operating system’s secure storage.

Protection on web and mobile

The web/PWA and mobile builds protect workspace updates and attachments. Some rebuildable local search and display data remains unencrypted in browser or app storage, so web/mobile at-rest protection is not yet identical to desktop.

When data leaves the device

Data can leave only through a feature you configure or invoke, including:

Workspace sync or per-Object sharing
Publishing an encrypted snapshot
Cloud AI after a consent decision
A connected integration during Test, Sync, or background sync
An outbound Workflow action such as a webhook
An export saved to a location you choose

The sync/sharing relay receives encrypted updates and routing metadata, not content keys. Connected AI and integration services necessarily receive the payload shown or described by their consent surface.

Recovery responsibility

Encryption cannot recover a lost key or deleted workspace. Keep verified backups somewhere distinct from the active workspace. Before deleting a workspace or account, read the confirmation carefully: server-account deletion and local workspace deletion are different operations.