Elos · チュートリアル

🛡️ How we protect your data

Privacy isn't a detail in Elos — it's the reason it exists. Here, in plain words, is what happens to your information and why no one (not even whoever runs the server) can simply read everything.

The trip to the server is armored

Everything you type travels from your device to Elos inside an encrypted tunnel (HTTPS). Along the way — the café Wi-Fi, your provider — only unreadable scramble passes through.

It's like mailing a letter inside a sealed steel pipe, instead of a postcard anyone can read en route.

Your password is never stored

When you create a password, we don't save it. We run it through a “one-way machine” (Argon2id) that returns a scrambled mark. We keep only the mark — at login we recreate the mark and compare.

It's like a fingerprint: you can check it's you, but no one rebuilds your finger from it. If our database were copied, there'd be no password to steal.

Your notes are encrypted on your device

The notes you write about people — the most intimate part of Elos — are encrypted in your own browser, with a key only you hold. On the server they're just scrambled text (tagged enc:v2:…) that not even we can read.

A padlocked diary — and the only key is in your pocket, not in the cabinet.

Backups travel locked — and the key isn't even on the server

So you never lose anything, we make automatic copies and send them already encrypted somewhere safe. And the key that opens them is kept on no server at all: it lives only in an offline password vault, out of reach of anyone who broke into the machine. Even if someone stole the server and the copies, they still couldn't open them.

We store the safe inside another safe — and its key lives in another building.

Because the key is yours alone, keep your recovery code. When you turn on note encryption we show a recovery code once — it's the other way to reopen your notes if you forget your password. Without the password and the code, not even we can recover them: the honest price of encryption that's truly yours. The layers above protect everything in transit, at rest, and in backups; this one also closes the case of someone taking over the live server — it's end-to-end encryption, where only your device holds the key.

100% open source (AGPL license): anyone can audit how all of this really works.
No AI reads your messages. No ads, no third-party trackers, no selling your data.
Your data is yours: export everything (vCard, CSV, calendar, JSON) and leave whenever you want.
Changing your password ends other sessions immediately — if someone was in, they're kicked out.
We review Elos's security regularly and fix what we find.

📱 Install on your phone (PWA)

Elos is a PWA: it opens in the browser and installs like an app, no store needed. On Android (Chrome): open Elos, tap the ⋮ menu, then “Add to Home screen” (or “Install app”). On iPhone (Safari): tap the Share button, then “Add to Home Screen”. The Elos icon shows up like a normal app, full-screen and fast.

🔒 How the app is secure, private and encrypted

Your data lives only on the Elos server — no trackers, no ads, no third-party cookies. Passwords are protected with Argon2id, the modern password-hashing standard. Nostr login signs a challenge on your device: the private key never leaves it. All traffic should run over HTTPS (encryption in transit), automatic backups protect against loss, and at-rest database encryption is on the roadmap. The code is 100% open: anyone can audit it.

👤 What .vcf is and how to import your phone contacts

.vcf (vCard) is the standard contacts format used by virtually every phone. To bring your friends into Elos: in your phone's Contacts app choose “Export” (it creates a .vcf file); then in Elos go to People → Import .vcf. For the reverse, use Export .vcf and import the file on your phone. Duplicate names are skipped automatically — import without fear.

📅 What .ics is and how to subscribe to your calendar

.ics (iCalendar) is the universal calendar format. Elos generates a private address with your events, birthdays and important dates. Copy the address in Settings → Calendar and add it to your app: Google Calendar (web): Other calendars → + → “From URL”; Apple Calendar: File → “New Calendar Subscription”; Thunderbird: New calendar → “On the network”. It keeps itself up to date from then on.