Beta data flow

Last updated 21 August 2026

Open and save locally

Your browser serializes the case, encrypts its name and JSON with a non-extractable AES-GCM device key, and writes the ciphertext to IndexedDB. An encrypted portable export is protected by its separate recovery secret.

Open and publish a shared case

Cloudflare Access validates the invited account. BlackMold then checks per-case membership. The browser decrypts and merges the case locally, encrypts a new revision locally, and uploads only the metadata-redacted encrypted envelope. R2 stores the immutable ciphertext; D1 conditionally commits its random pointer and non-content metadata.

Membership removal

The owner creates a new case key and encrypted revision in the browser. The server atomically commits that revision and removes the member. The new recovery secret is shown once for distribution outside BlackMold.

Optional network features

External lookups and map tiles require opt-in. Depending on the selected feature, data sent to a provider can include a search term, domain, IP address, URL, identifier, email address, location, or map viewport. The provider receives the request under its own terms.

Recovery boundary

BlackMold cannot recover a lost recovery secret or decrypt server revisions. Clearing local browser data removes the device key and local library.