Offline shouldn't mean one lost phone from starting over

There is one fair objection to every offline, no-account app, and it is not about privacy. It is this:

If it all lives on my phone, what happens when I lose my phone?

It deserves a straight answer, because the glib one — “export regularly!” — is how people end up with a year of history and a backup file from March. Nobody exports regularly. The safety net has to be automatic or it is decorative.

Cloud apps solve this by holding your data for you. That works, and it is why they are popular. It also means a company has a readable copy of your financial life, which is the thing you were trying to avoid.

The good news is that these were never actually the same decision. Where your data is stored and who can read it are two separate questions, and the second one is the one that matters.

Encrypt first, then upload

The trick is boring and it is decades old: encrypt the file on the device, then put the encrypted file wherever you like. The storage provider holds a blob it cannot interpret. It has no more insight into your finances than your phone company has into a sealed envelope.

In Klera that shape looks like this:

1. You set a backup passphrase once. Not at sign-in — on your first backup, which is a deliberate ordering we will come back to.
2. The whole ledger is packaged and encrypted on your phone. AES-GCM-256, with the key stretched from your passphrase using 120,000 rounds of PBKDF2-HMAC-SHA256 and a random salt. GCM is authenticated encryption, so a wrong passphrase or a tampered file fails cleanly instead of producing plausible garbage.
3. The encrypted file goes into your own Google Drive — your account, your storage quota, your control.
4. It refreshes itself daily or weekly, whichever you choose, whenever you open the app.

At no point does an unencrypted copy of your ledger exist anywhere but on your phone. Klera does not run a server that holds it, because Klera does not run a server that holds anything.

The permission that makes this different

Most apps that back up to Drive ask for broad Drive access. Klera asks for exactly one scope: drive.appdata.

That grants access to a hidden folder that Klera itself created, and nothing else. It cannot list your documents, cannot open your photos, cannot see that other apps’ folders exist. You will not find the folder in your Drive interface either — it lives outside the normal file tree.

The reason this matters more than a paragraph in a privacy policy: it is enforced by Google, at the API. Even if Klera wanted to read your other files, the token it holds does not permit it. Verifiable limits beat stated intentions, every time.

Why the passphrase is not stored anywhere

Here is where a lot of apps quietly cheat. Encrypting a backup with a key baked into the app is very convenient — no passphrase to remember, no support tickets, and you can still write “encrypted” on the feature list. It is also close to meaningless: anyone who unpacks the app gets the key, and so does the company that shipped it.

So Klera does the inconvenient thing. Your passphrase encrypts the file, we never receive it, and there is no way to recover it.

That is what makes the guarantee real. It is also a genuine risk, and it would be dishonest to bury it:

If you forget your backup passphrase, the backup cannot be opened. Not by you, not by us, not by anyone.

There is no reset link, because a reset link requires someone to hold a copy of your key. Write it down. Somewhere physical — a notebook, a password manager, the inside cover of something you will not throw away. Do it when you set it, not later.

To make automatic backups possible without asking for the passphrase every day, Klera caches it in your device’s secure keystore — the same OS-protected store your other credentials live in. That is a trade you opt into by turning auto-backup on, and it never leaves the device. On a new phone the portable secret is still the one in your head.

Restore, and why the order matters

The most valuable moment for a backup feature is the worst moment for the user: new phone, empty app, everything gone.

Which is why connecting to Drive in Klera is sign-in only. It does not immediately ask for a passphrase or push anything up. It signs in, checks whether a backup already exists in your app folder, and if one does, it offers to restore it.

That ordering exists because the opposite would break the exact case the feature is for. If connecting immediately created a backup, then a new phone would upload its empty ledger over the good one, or would have to ask you to invent a passphrase before you had anything to protect. Klera also offers the restore during first-run setup, before you have created accounts that a restore would collide with — and if you take it, setup ends there and hands you to the backup screen, because everything the remaining steps would have asked for is already inside the file.

When you do restore, you choose how:

• Replace wipes what is on the device and imports the snapshot. Predictable — you get exactly the backup.
• Merge adds only what is missing, and never overwrites a row you already have. Safe if you have started using the new phone before remembering the backup exists.

The belt-and-braces options

Drive backup is the automatic layer. Two more exist for people who would rather not involve Google at all, or who want a copy that does not depend on any of this:

• Encrypted local backup file. The same encrypted envelope, handed to your phone’s share sheet. Put it on a laptop, a USB drive, another cloud — anywhere. Restoring is the same passphrase.
• Complete JSON export. Every table, in a plain open format, in one tap. Not encrypted, so treat it accordingly — it is for taking your data somewhere else, not for storage. There is also CSV and PDF export with financial-year presets if you want the transactions rather than the database.

The principle behind all three: your history should be portable enough that leaving Klera is easy. An app that is hard to leave is telling you something about how it expects to keep you.

The short version

Offline-first was never supposed to mean fragile. It means no company holds a readable copy of your money. Those are compatible — you just have to encrypt before you upload, ask for the narrowest possible permission, and refuse to hold the key.

Which leaves exactly one job for you: write down the passphrase.

Klera is free, has no account, and works offline from the first minute. Backup lives in Settings → Backup — worth turning on in the first week, not the week you need it.