The app
Backup
Keep an encrypted copy of the text of your chats and of your credit, and open it on another device with a passkey or a recovery code.
Your chats and credit live in your browser. A backup keeps an encrypted copy of the text of your chats and of your credit on Thinkr's server, so you can open them on another device, or in the same browser after you clear its site data. Your browser encrypts the backup before it sends it, and Thinkr cannot decrypt it.
Photos and files that you attach, and the images and videos that models make, stay in the browser that holds them. On another device, a chat opens with its text alone.
Turn on backup
Open the settings
In the chat app, open Settings and pick Backup, or press Back up under your credit in the sidebar.
Make a passkey
Press Turn on backup and confirm the passkey with Face ID, Touch ID, Windows Hello, or the lock of your device. Your passkey manager, such as iCloud Keychain or Google Password Manager, keeps the passkey and syncs it to your other devices.
Keep the recovery code
The app shows a recovery code of 32 characters, once. Keep it in a password manager or on paper. It opens your backup on any device, even without your passkey.
From then on, each change of your chats and credit goes into the backup about 10 seconds later.
Restore a backup
On the new device, open Settings, pick Backup, and press Use a passkey or Use a recovery code. The app brings the chats and credit of the backup into the browser, keeps what was there already, and keeps the backup on. Two devices that share a backup stay in step: a chat that you delete on one goes on the other too.
If each device held a balance of its own, the app moves what is left on one onto the other, so both devices pay from one balance. Thinkr's proxy then learns that the two balances belong together.
How the backup is encrypted
- The recovery code holds 160 random bits. The secret of your backup derives from it with HKDF-SHA-256 (RFC 5869), and every key of the backup derives from that secret.
- Your browser compresses the backup and seals it with AES-256-GCM. A revision inside the seal stops the server from serving an older backup as new.
- A passkey unlocks the secret through the PRF extension of WebAuthn. The user handle of the passkey is the random ID of the backup, so a new device finds the backup in one prompt.
- This browser keeps the secret in its storage, next to your vouchers, so the backup runs without a prompt.
The code that encrypts the backup is open source at github.com/thinkrsh/thinkr-sync, under the Apache License 2.0.
What Thinkr stores
Thinkr's server keeps the encrypted backup, its size, and a hash of the token that lets your devices replace or delete it. The log of the proxy records each request to the backups without naming the backup. Thinkr never receives your recovery code, the key, or your passkey.
Limits
- A backup holds up to 32 MB of chat text and credit.
- If you lose your recovery code and every passkey, nobody can open the backup, and Thinkr cannot recover it.
- Some browsers and passkey managers cannot derive keys from a passkey. The app then turns on backup with the recovery code alone.
- When you turn off backup, the app deletes the backup from Thinkr's server, and your other devices stop backing up. Your chats and credit stay in each browser.