Encryption

Passphrase to Argon2id (64 MB, 3 iterations) wraps a random data key. A 24-word recovery code wraps it again. Chunks are FastCDC, then AES-256-GCM. Chunk ids are HMAC(data key, plaintext). Paths and per-file sizes are only inside the encrypted manifest. Stored chunks are padded to 64 KiB so the size is not the plaintext length. Source: packages/core/src/crypto.js, packages/core/src/byo.js, packages/server/src/index.js.

What can UndoHaven see?

On our server: account id, optional display name, device label, snapshot timestamp, padded byte total, HMAC chunk ids, plan and wrapped keys. Not email (we do not ask for one), not file paths, not per-path sizes, not passphrase or recovery words. If you use your own bucket, chunk bytes never touch our R2. The optional cloud index is still only the encrypted manifest.

服务器上有账户 id、可选显示名、设备名、快照时间、填充后的总字节、HMAC 分块编号、套餐和被包裹的密钥。没有邮箱（我们不收集）、没有路径、没有单文件大小、没有口令或恢复码。自有桶时，分块不会进我们的 R2。