JournaLock Local Vault
=======================

This folder on your device contains your encrypted journal.

- journalock.db : Main encrypted database (entries + hash chain + timestamps)
- attachments/  : Files you attached to journal entries (encrypted with per-file keys wrapped by your master key; look for .enc + .key sidecars)
- backups/      : Local mirrors created from the in-app Backups page
- exports/      : Manual exports + Master Key Emergency Kits (PDF, .txt, .qr.png)
- logs/         : Audit trail (audit.log - append-only security and action log)

Everything stays on YOUR device under your control.
• Windows / macOS / Mac Catalyst: Browse the folder directly in Explorer / Finder.
• Android: Vault is in app-private storage. Use in-app Export or cloud backup to move data off-device.
• iOS / iPadOS: With the app configured for document sharing, open the Files app and look under "On My iPhone > JournaLock" (or the app's Documents container).
You can copy this entire folder to another drive / computer / external storage for backup.
To move the vault: use Settings > Local Vault Storage inside the app, then restart.

All content and attachments use AES-256 with a master key (in SecureStorage) that wraps per-document keys. The master key is protected by your device's Secure Enclave / keychain + your PIN/biometrics. Export a backup of the master key from Settings → Security (one key unlocks everything).

================================================================================
CRITICAL — MASTER KEY EMERGENCY KIT (THE ONLY RECOVERY PATH)
================================================================================
When you set or change your Master Password (Settings), or click 'Generate & Save Master Key EMERGENCY KIT',
the app automatically creates files in the exports/ folder:
  Master_Key_Emergency_Kit_YYYYMMDD_HHMMSS.pdf
  Master_Key_Emergency_Kit_YYYYMMDD_HHMMSS.txt
  Master_Key_Emergency_Kit_YYYYMMDD_HHMMSS.qr.png

THESE FILES CONTAIN YOUR FULL 256-BIT MASTER ENCRYPTION KEY (Base64 + QR).

IMMEDIATELY AFTER GENERATION:
1. OPEN THE PDF (or .txt).
2. PRINT MULTIPLE COPIES ON REAL PAPER.
3. STORE THE PHYSICAL PRINTS IN AT LEAST TWO PHYSICALLY SEPARATE, SECURE, OFFLINE LOCATIONS
   (fireproof safe at home, bank safe-deposit box, attorney's office, split shares with trusted people).

THIS PRINTED MATERIAL IS THE *ONLY* WAY TO EVER GET YOUR ENCRYPTED INFORMATION BACK
if you lose this device, the app's SecureStorage is cleared, you forget your Master Password,
or you set up on a brand new machine without first exporting the key.

JournaLock has ZERO access to your keys or plaintext. There is no 'forgot my key' button that works.
Sole master key holder = permanent data lockout risk if all copies are lost.

After you have printed and physically secured the copies, return to Settings and use the
'I have printed...' confirmation checkbox. This writes a record into your vault's audit.log.

Best practice: Re-generate + re-print a fresh kit after every Master Password change.
See in-app Security page and Settings for the full 2FA-vs-Encryption Key Management explanation.
