Backup, export & privacy

Everything you’ve built lives on your own machine — this lesson is how you carry it, keep a safety copy, and understand why it stays private.

What you’ll learn

• What “local-first” actually means for your data.
• How to export your whole workspace into one portable bundle.
• The guardrails that keep your secrets and your spending safe.

1. Local-first by default

Your workspace — Companies, workers, conversations, the Library, Plans — lives in a local database on your own device. There is no askTheodor cloud holding your content. You bring your own provider keys, and since v0.9.268 they’re encrypted at rest: the encryption key sits in a separate file outside the database, so a copy of the database alone can’t reveal them. The only data that ever leaves is what a worker sends to the provider you chose, when you (or a Plan you approved) ask it to.

2. Export a portable bundle

Open Settings → Backups. Three tiles estimate the size first, then ⬆ Export workspace writes your entire workspace — Companies, workers, routines, Plans, Library files, Kafenio history, and the whole database — into one file. Optionally set a password (at least 8 characters) to encrypt it with AES-256-GCM. The extension tells you which: .atbackup for plain, .atbackup.encrypted for protected.

3. Import on another machine

On the new install, pick the file, 🔍 Inspect bundle to read its version and date, then confirm by ticking the box and typing OVERWRITE. Restart when it’s done so the database reopens against the restored data.

Import replaces everything

Importing does not merge — it erases the current workspace and replaces it with the bundle. The typed OVERWRITE is there because it can’t be undone. If there’s anything in the target install you want to keep, export it first.

Remember the password

There’s no recovery if you forget an encrypted bundle’s password — the encryption is real. Store it somewhere safe.

When you’ll be glad you did this

Three concrete situations, and the honest caveat that goes with them:

Moving to a new machine. Export on the old one, import on the new one, restart — Companies, workers, their memories, the Library and your Plans all arrive intact. What doesn’t come across is your provider keys: the encryption key that protects them is machine-local by design, so you re-paste those on the new install. Everything else is the point of the bundle.

Before you try something drastic. About to import a demo pack, restructure your Companies, or let a new Routine loose on your files? Export first. It takes a minute and turns an irreversible experiment into a reversible one.

Proving where your data actually is. For a client or an auditor asking where their material lives, the answer is demonstrable rather than a policy statement: it’s a file on this machine, here it is, and here’s the export. Encrypt the bundle if it’s leaving your control.

A backup you’ve never restored isn’t a backup

Once — ideally on a spare machine or a fresh install — actually import a bundle and confirm it opens. Discovering a broken assumption during a real recovery is the worst possible time to find out.

Recap

askTheodor keeps your data on your machine, your provider keys encrypted at rest, and gives you one portable (optionally encrypted) bundle to back up or migrate. With your portfolio safe and portable, you’re ready for the playbooks — complete setups for who you are.

📖 Reference in the docs: Backups · Security & privacy

➡️ Next: Playbook: company of one