Private Sync encrypts your synced content on your own machine before it is uploaded, using a key the server never sees. It is available on every plan — it is not a Pro feature.
What it encrypts — and what it does not
This is the most important section on the page. Private Sync protects content, not the labels around it:
| Field | Encrypted? |
|---|---|
| Workspace entry content | Yes |
| Your personal context and custom vocabulary blob | Yes |
| Voice command action parameters | Yes |
| App favourite aliases | Yes |
| Workspace names and tags | No — plain text |
| Workspace entry titles | No — plain text |
| Hands-Free spoken phrases, vocabulary words, app identifiers | No — plain text |
Names, tags, and titles stay readable because the website renders them in your account area and the server matches on them. Hands-Free phrases are a subtler case: entries are addressed by an unkeyed hash of the phrase itself, so encrypting a short, guessable phrase like "open chrome" would not actually hide it from anyone holding a wordlist. Rather than imply protection that a dictionary attack defeats, we leave it plainly readable and tell you so.
Turning it on
- 01Start the conversionInkSpoke generates an encryption key and a recovery key locally. Nothing is uploaded yet.
- 02Save the recovery keyIt looks like
INKS-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX. It is displayed once and stored nowhere else. Put it in a password manager before you click past this dialog. - 03Let it re-encryptExisting synced content is re-encrypted locally, then the wrapped key is escrowed and the account flips to encrypted mode.
Unlocking your other devices
Each additional device asks for the recovery key once. Paste it and that device can read your encrypted content from then on. A wrong or malformed key is rejected with a specific message rather than silently failing.
If you lose the recovery key
We cannot recover it. That is the point of the design — the key never reaches our servers, so there is no copy for support to look up.
The escape hatch is Reset Private Sync, which you run from the website while signed in. It clears the escrowed key and purges the synced rows that hold unreadable ciphertext, returning the account to a usable state.
It fails closed
If InkSpoke cannot confirm whether your account is in encrypted mode — a flaky network, an ambiguous server response — it holds the affected changes rather than uploading them unencrypted. Sync may show as pending; it will not quietly downgrade your protection. The server independently rejects a plaintext value on a field that should be encrypted.