Variorum help

Getting in touch

Something not working, or a question this page doesn't answer? Use Help ▸ Send Feedback… in the app, or write to support@stargazing.tech.

The one thing to know

Your writing is encrypted. Your passphrase or your twelve words — together with any copy of your library — always open it. Everything else is a convenience.

• Every library is encrypted with its own random key, kept in a small key file beside it. Variorum keeps copies of the key file for you without asking: beside the library, inside every backup, and a sealed copy in your Mac's keychain. The key file isn't secret. On its own it opens nothing.
• Every library has twelve words from the moment it's created, and asks for a passphrase. Either one opens your library, and either one can reset the other. The passphrase is simply easier to type.
• Both modes, Standard and Castle, are end-to-end encrypted. Our server never holds a key to anything.

Standard and Castle

What's the difference?

Your library is in exactly one of two modes at a time, and so is the account it syncs with. You switch between them in Settings ▸ Protection (Use Castle… and Use Standard…).

Standard is the convenient one. Besides your passphrase and twelve words, Variorum can keep quiet roads to your library's key, so you rarely type anything. One road runs through your Apple account (your iCloud Keychain, which also reaches your other Macs on that Apple account). The other is on the Mac itself (its login keychain: your login password or Touch ID). The plain truth is that in Standard, anyone who can sign in to your Mac can open your library.

Castle closes the road through Apple. In the rules' own words: "Castle is one promise: no quiet road through Apple, ever, on any device of the account." Touch ID on your Mac is optional. With Always ask, no copy of the key stays on your Mac, and you type every time.

Will Apple's roads always keep working?

We don't promise that. An Apple ID change, an iCloud sign-out, a keychain reset or a move to a new Mac can each end one. The promise is that you never need them: your passphrase or your twelve words always open your library.

I reset my iCloud Keychain, or my Apple road stopped working.

There's nothing to do. The next time Variorum opens, it uses whatever quiet road still works and quietly makes a fresh Apple road. It asks for your passphrase or twelve words only when no quiet road is left. Either way, nothing was ever at risk.

What can Apple see? What can Variorum see?

Our server never sees your writing, in either mode. As for Apple: in Standard, your iCloud Keychain holds a key to your library. That's Apple's road, never ours, and it's a key, never your writing. The keys your sync account uses are never given to Apple. In Castle, nothing Variorum made opens through your Apple account (with two old exceptions, under backups below). With Touch ID on in Castle, your Mac keeps the key behind your fingerprint; with Always ask, it keeps no copy at all.

I'm entering Castle. Anything I should know?

Entering asks for your passphrase and your twelve words. Your library gets a new key, and the library's Apple and on-device keychain items are deleted. The Apple ones are deleted on every device of your Apple account, so your backups become Castle-protected along with your library.

Entering also turns off your scheduled plain-text export, with one notice you can reverse: a plain copy on disk would undo the promise, so it's your call. If you want a plain copy outside Castle, export one first from Settings ▸ Data Safety.

Castle is account-wide. When one device enters, every device on the account follows, each typing your passphrase or twelve words once. Until a device follows, it can still read its own local copy through its own quiet road. That's accepted, and said plainly.

I switched to Castle. Are my old backups protected?

Yes. Entering Castle deleted the keychain items your Standard-era backups' quiet locks relied on, so from then on they open only with your passphrase or your twelve words, like your library. Time Machine copies of Variorum's backups follow the same rule.

There are two exceptions, and neither one reaches your current writing. A Standard-era backup locked under an Apple account you've since left keeps that lock, because Variorum can't delete another account's keychain item. And a key file someone kept outside Variorum's own folders still opens the backups from before you entered.

I left Castle. Who can open what now?

Leaving asks for your passphrase and your twelve words, and hands everything to Standard. Your library gets a new key that carries every earlier one, a fresh Apple road, and its on-device road back. From then on, your writing, the server's copy, the sync key and every backup you have ever made open through your Apple account and your Mac again. Your other devices follow out quietly, with a notice.

The leave screen says it plainly: "Your library and all your backups will open through your Apple account and this Mac again; if you want Castle-era writing to stay Castle-protected, don't leave."

Does Castle on my Mac make my iPhone Castle?

Once sync is on, yes. Castle belongs to your account, and every device follows by typing your passphrase or your twelve words once. Before sync, each library has its own mode; your iPhone learns the account's when it joins.

Your passphrase and twelve words

Where are my twelve words?

Variorum never stores your twelve words, so it never shows you the same ones twice. The card above the quick entry offers them ("Your library is encrypted — click here to record the twelve words that are its key."), and so does the tour's last card. After that they're in Settings ▸ Protection, under Record your twelve words…. Write them down when they appear, because they won't be shown again.

Looking again later makes new words for you to write down. Your library's key doesn't change, and every backup still opens with the words you had when you made it. Until you've recorded your words, only your Mac's quiet roads open your library (and your passphrase, once you've set one). That's why the card stays until you do.

I forgot my passphrase.

Go to Settings ▸ Protection ▸ Reset forgotten passphrase…. In Standard, your Mac holds your library's key, so you can choose a new passphrase without the old one. In Castle, confirm it's you with your twelve words (or with Touch ID, if you turned it on for this Mac), then choose a new one.

Changing my passphrase, or making new words

Either one re-locks your library's current key; it doesn't change the key. Every backup of your library still opens with your new secrets, and with the ones you had when you made it, because every key change carries the earlier keys forward. If your library syncs, your account's lock changes in the same act. The doors say so in one sentence.

My twelve words were seen.

Make new ones in Settings ▸ Protection (Record your twelve words…). From then on the old words no longer open your library, or your account if it syncs. Backups you made before still open with the words you had then, because a backup always opens with the secrets of its day. If someone may also have copies of those backups, delete the ones you don't need, Time Machine included.

I lost my passphrase and my twelve words.

In Standard, your Mac's quiet roads usually still open your library. Set a new passphrase right away, then record new words.

In Castle, if you turned on Touch ID for this Mac, it still opens your library: reset your passphrase with it now. If you've lost all three, nothing opens your library any more. That's the promise working. The doors warn before anything is lost, and the words are shown and asked to be written down from the first day. An old backup made in Standard won't open through your Apple account either, apart from the two exceptions above.

Why is there no reset?

Because a reset would be a key we hold, and we hold none. Your twelve words are your reset: they set a new passphrase. In Standard, your Apple account and your Mac usually open your library too. In Castle, nothing but your own secrets does.

Backups, copies and new Macs

Restoring a backup

A backup is your library plus its key file. It opens with the passphrase and twelve words you had when you made it. It also opens with your current ones, since every key change carries the earlier keys forward. And on this Mac, its quiet road opens it while that road still holds the backup's key.

Settings ▸ Data Safety ▸ Restore from Backup lists the copies on this Mac. Look inside opens one read-only: nothing is written, and closing it forgets it. Make this my library turns the copy into a new library, with a fresh identity and a fresh key, in the mode you're in now, under your current passphrase and twelve words. Your current library steps aside whole into Previous Libraries, where you can look inside it or bring it back the same way. "You never leave Castle by opening something."

A restored library doesn't sync until you turn sync on for it. Then it joins your account by its rows, like any device. A backup carries no sync key and no device identity, so a Mac new to a library joins as a new device.

Moving to a new Mac

Two devices share a library through sync, never through files. With sync on, sign in on the new Mac and type your passphrase or twelve words once, and everything arrives.

Without sync, use File ▸ Send Library to Another Mac… (also in Settings ▸ Data Safety). It writes a folder holding a copy of your library and its key file. Send the whole folder, then open it on the new Mac with File ▸ Open Library…. The new Mac's current library, if it has one, steps aside whole into Previous Libraries.

The copy becomes its own library when it arrives, with a fresh key under the secrets you type there, and from then on the two can drift apart. If both Macs sign in to the same account, the copy merges by its rows, exactly as any device does. The file itself shares nothing between the Macs.

Can my library live in iCloud Drive?

Your working library stays on this Mac. iCloud Drive syncs files while they're being written, which can corrupt a live database. Backups are complete, sealed copies, which is what a synced folder is good at. You can pick a second backup folder in Settings ▸ Data Safety, such as iCloud Drive or an external drive, and a backup lands there once a day. To have your writing on every device, use sync.

What if every copy is gone?

A library whose every key file and every backup are gone is gone. Synced libraries are the exception: your account's passphrase or twelve words bring them back from your account.

Copies made by versions before 0.10

Variorum 0.10's protection doesn't open libraries from before its design, and there's no migration. The few people this affects were told, and exported or synced first, then started fresh. An old copy stays readable by the old version of Variorum that made it.

Sync and your account

Joining your account from a new device

Your account's shared keys are locked by your passphrase and your twelve words only, never by Apple, so joining always takes one of them. That moment is also a reminder, if you never wrote your words down, while you still have access.

A device holds one pair of secrets at a time. The first device to turn on sync hands its library's passphrase and words up to become the account's. A device that joins later adopts the account's pair, and is told plainly: "Your library's twelve words are now your account's twelve words; here they are; the old ones still open backups you made before today."

My other device uses a different Apple ID.

Sync still works. Every device types your passphrase or twelve words once to join, whatever Apple account it uses. In Standard, that device's own library then opens on its own, through the Apple account it's signed in to and its own keychain.

Can I still read old writing years from now?

Yes. Everything on the server is sealed under the sync key that was current when it was written, and your account keeps every sync key it has ever had, so a device joining years later reads everything. The sync key changes only when your account enters Castle.

I stopped syncing a library, or signed out.

"Leaving an account changes none of your library's keys or secrets — it stops syncing, and the server keeps what you pushed (removing it is the account-deletion road)." Signing back in is a join.

Deleting my account and starting over

Deleting removes the server's copy and your account's keys. Your libraries stay on your devices and still open. Deleting asks for your account password and a typed phrase. To start over, create a new account and turn on sync; your library moves to it and uploads, and your other devices join the new account the usual way. One thing deleting can't erase is the sign-in service's own record of past sign-ins; the privacy page has the details.

Someone knows my account password.

Use Sign Out Everywhere in Variorum's account settings, then change the password at stargazing.tech (changing your password happens on the website, not in the app). They could never read your writing with it, and after that they can't sign in either.

Someone has my old backups and my Apple account, and I've since moved to Castle.

They can't open those backups, apart from the two exceptions above. Your library and your sync are under keys that were never locked for your Apple account. If they also have your account password, they can delete your account or sign you out. Either would be loud, and every copy on your devices survives. So change that password and use Sign Out Everywhere.

Someone was inside my Apple account, and I'm in Standard.

Secure your Apple account first, with Apple's tools: change your Apple ID password and remove devices you don't recognize. Then use Replace All Keys… in Settings ▸ Protection. It gives your library a new key, locked under your passphrase and twelve words, and keeps the earlier keys so your backups still open. But in Standard your Apple account keeps a quiet road to your library. Castle is the stronger answer: it's exactly the mode with no Apple road at all.

I lost a device, or one was stolen.

In this order: use Sign Out Everywhere, so the device can't sync; then change your account password. In Castle, the writing on that device stays locked behind your passphrase or twelve words (or its Touch ID, if you turned that on). In Standard, whoever can sign in to that device can read what was on it; that's Standard's trade. The device is also signed in to your Apple account, which holds a key, so remove it there too (your Apple ID's device list, or Find My). If you'd like your library to move to a key that device never had, Replace All Keys makes a new one.

Finding things

• One finder. The Library's search field answers everything. Words find passages, grouped under their notes, with honest counts and quiet filter chips. A #tag on its own lists the tagged notes themselves, with the books that tag flows into on top. A plain word that names a tag offers it as a one-press chip (tag: #name ›); saying it's a tag is always your choice, never a guess.
• when ▾ opens a calendar: press one day, or a first day and then a last day for a span. The sentence at its foot confirms what you picked, and nothing narrows until you press a day.
• Takes and commits. Every take of every paragraph is searched. Commits (the moments you saved) are searched only when you add the + commits filter, and each of those results is marked "commit · ‹day›". + archived adds archived material.
• Click a result, land at the match. The note opens in Write with the match selected and the find bar ready; ⌘G steps to the next one.
• Inside a book. A book's 🔍 runs the same search within that book, and ⌘K shows passages under its title matches.
• What it doesn't search. The Trash, and saved versions of whole notes.
• It's local. The search index is built on your Mac and never syncs. The server couldn't build one, since it stores only sealed text.

Variorum beta · Privacy · Variorum and AI · Questions: support@stargazing.tech