Glossary

age: An open, simple file-encryption format and tool (age-encryption.org). Every Sempere file is an age file.

Annotate, Hand, Reading: The three modes of a note view. Annotate draws; Hand selects and moves items; Reading (neither button lit) only scrolls.

Attachment: A file a note holds: a picture, PDF, recording, transcript or video clip. Stored encrypted in the note’s att/ folder.

Backup: A <Name>.sempere-backup snapshot of a vault, for recovery. Nothing syncs from it.

Checkpoint, saved version: A version of a note you named with Save Version…. Never thinned away.

Delta: A small file with one save’s changes to a note. Written once, never changed.

Device id: Eight hex characters that name a device in file names and the device list, so two devices never write the same file. Not a hardware id.

Device key: A device’s own secret key for a vault, made on the device and kept in its Keychain. It never leaves the device.

Epoch: The period between two device changes. Each epoch has its own vault key; removing a device starts a new one.

Export: A readable copy of notes (PDF, PNG, Markdown, media). Not encrypted.

Home device: The one device that manages the others: it approves, renames and removes devices and replaces the recovery kit. Shown as “Manages devices”.

Inbox: The notebook where quick voice notes land.

Item: Anything on a page besides ink: a picture, text box, equation, PDF page, video clip or recording card.

Join: How a device becomes one of the vault’s devices: it asks with six words, the home device approves, and it checks six words back.

Passphrase copy: The recovery key, locked with a passphrase, stored in the vault’s keys/ folder (optional). Lets you read the vault or take over by typing the passphrase.

Post-quantum (hybrid): Encryption that combines a classic algorithm (X25519) with one designed to resist future quantum computers (ML-KEM-768). Breaking it needs breaking both.

Public key: The shareable half of a key (age1pq1…). It can encrypt for the key but not decrypt.

Quarantine: Where sync keeps a received file that fails its checks, instead of placing it in the vault. Listed under Details and Repair.

Quick voice note: A recording made from the Lock Screen, a widget, Control Center, Siri or the Mac’s menu bar, without unlocking the vault.

Recently Deleted: Where deleted notes go. Restore them from there.

Recovery key: One more key per vault, printed in the recovery kit and kept by no device. It reads the vault and can take over.

Recovery kit: A printed page with the recovery key as a QR code and text, the vault’s root fingerprint, and the steps to read a note without Sempere.

Revision: Any file of a note’s history: a delta or a snapshot.

Root fingerprint: A fingerprint of the vault that never changes, printed on the recovery kit, against which a device checks the vault’s device list.

Set aside: Kept on the device but never read as a note: a file under an old key that no device change accounts for. Listed in Repair.

Snapshot: A file with a whole note at one moment, so a note opens without replaying every delta.

Sync target: A shared place a vault syncs with, both ways: a <Name>.sempere folder (iCloud Drive, another provider, a drive or share) or a WebDAV server. Other devices open it and join.

Takeover: Making a device the home device with the recovery key, when the old home is lost.

Thinning: Removing old autosaves that a snapshot covers, to keep a note’s folder small. Saved versions stay.

Vault: A folder named Something.sempere that holds your encrypted notes. Each device keeps a complete copy inside the app.

Vault key: The key every file of an epoch depends on, wrapped in vault.json for each device and for the recovery key.

vault.json: The vault’s main unencrypted file: its id, root fingerprint, the devices’ public keys and names, and the vault key wrapped for each of them, signed by the home device.

WebDAV: A standard for sharing files over HTTPS, offered by most NAS systems and by Nextcloud.

Web viewer: A read-only Sempere that runs in a browser.