Your character, your device: the architecture decision against plaintext server sync

Today, Personarium is a desktop app: a character and its chats live in the local database on exactly the device where you created it. That's not a gap we still need to close — it's a direct consequence of the rule that carries the whole product.

Why we don't just plug in a cloud database

The most convenient solution for multi-device use would have been a hosted database syncing quietly in the background — invisible to you, but a server that necessarily sees your chats in plaintext in order to reconcile them. That's exactly what our core rule rules out: no server-side plaintext sync of chats or images, no matter how convenient. That rule doesn't just apply to text chat — it applies to every feature we build, including one that doesn't exist yet.

We evaluated ready-made solutions — and rejected them

Before committing to a custom build, we evaluated existing sync frameworks. Turso, PowerSync, ElectricSQL, and Zero all see plaintext server-side — out. Evolu, the only ready end-to-end-encrypted option, brings its own SQLite instance that collides with our full-text search. cr-sqlite is orphaned, no release in over a year. None of these fit without breaking either the privacy rule or our existing data model — the custom build is a deliberate decision, not a stopgap.

What's coming instead: device bundles, not a server account

Multi-device use is planned for a later update, following the same principle: your changes run into a local log, encrypted end-to-end with a key derived from a mnemonic phrase you own — as device bundles, either in your own cloud or on a deliberately "dumb" blob store that only ever sees ciphertext and filenames. A later stage adds direct sync between your devices on the same network, and optionally, on the road, through a relay that by construction can only forward encrypted packets.

What that means for you

Even after this expansion, your hub account only ever knows your email address and membership status — never the content of your conversations. Lose the mnemonic, and the synced archive is lost, just like the vault: no backdoor, for the same reason. And until then, desktop use stays exactly what it is today — one character, one device, no account reading along.

A server that reconciles your chats can read them. We decided early that ours shouldn't be able to — not later, either.