Account Cloud Sync

When you are signed into a Hive cloud account, your saved connection profiles and app settings can save to the cloud automatically and sync to every other app signed into the same account, whether that is the desktop app, the Android app, or the web client.

Sync is end-to-end encrypted (zero-knowledge). Everything is encrypted on the device with a separate sync passphrase before it leaves, so the cloud only ever stores ciphertext. The cluster tokens embedded in your connection profiles never reach the server in the clear.

Cloud sync is opt-in and off until you enable it. It is separate from Cluster Preferences, which shares theme and UI settings between clients on one cluster via the daemon; cloud sync instead ties settings to your Hive account and works even when your devices never share a cluster.

What gets synced

• Saved connection profiles - the host, port, and cluster token for each connection you have saved, so a new device can reach your nodes without re-entering anything. Profile additions, edits, renames, and deletions all sync across your devices.
• App settings, including:
  • Terminal padding, font, and keyboard options
  • Notes view preferences
  • Battery sleep (mobile background window)
  • Theme

New settings the app adds under the same synced scope are picked up automatically.

The sync passphrase

Cloud sync uses a separate sync passphrase, not your account login password. This is what makes the sync zero-knowledge: the passphrase never leaves the device, and the server never sees it or your plaintext data.

• Encryption is AES-256-GCM.
• The key is derived from your passphrase with PBKDF2 (600,000 iterations).
• Encryption and decryption happen entirely on-device. The cloud stores only the resulting ciphertext.

Because the server never holds the passphrase or the key, a forgotten passphrase is unrecoverable by design. If you forget it, there is no reset: set a new passphrase and re-sync from a device that still has your data. See Forgot your passphrase below.

Enable it

Go to Settings > Account and find the Cloud sync card. You must be signed into your Hive account first (see Accounts & Licensing).

The card lets you:

• Enable and set a passphrase - turn cloud sync on for this device and choose your sync passphrase. Your current connection profiles and settings are encrypted and uploaded.
• Sync now - push local changes and pull remote ones immediately, instead of waiting for the automatic save.
• Last synced - shows when this device last completed a sync.
• Turn off on this device - stop syncing from this device. This does not delete what is already stored in the cloud or affect your other devices.

Per-device unlock

The passphrase is remembered per device, so you only enter it once per device:

• On a device that already knows the passphrase, sync unlocks silently when you return, with no prompt.
• On a fresh device (a new browser, a phone, a reinstalled desktop app), signing in checks whether your account already has synced data. If it does, Hive tells you so and offers an Unlock shortcut to the Cloud sync card, where you enter the passphrase once. After that, it is remembered on that device too.

Until you unlock, a fresh device shows only the profiles saved locally on it - signing in alone does not bring your profiles down, because the cloud copy is encrypted with a key only your passphrase can derive.

If you used Turn off on this device, that device stops offering the unlock prompt at sign-in. The Cloud sync card still lets you turn it back on.

Entering the passphrase does not send it anywhere. It only unlocks the local key used to decrypt what the cloud sent down.

Conflicts

Each encrypted cloud snapshot is guarded by a server-side revision counter, which keeps devices from overwriting a newer cloud revision out of order. Hive then handles settings and connection profiles differently:

• App settings use last-write-wins. When two devices change settings around the same time, the most recent snapshot wins. Settings are not merged field by field.
• Connection profiles merge by name. Profiles that exist only on one device are kept, so turning on sync cannot erase an unrelated local-only profile. If two devices edit a profile with the same name, the most recently edited copy wins.
• Profile deletions are explicit. Deleting a saved profile records an encrypted deletion marker for that profile name. The marker syncs with the rest of the snapshot and wins over older copies of the profile, preventing an old device or cloud snapshot from making the deleted profile reappear. If you later create a new profile with the same name, that newer profile replaces the older deletion marker.

Forgot your passphrase

There is no recovery path, by design. Because the passphrase never reaches the server, no one, including Hive, can decrypt your data without it.

If you forget it:

1. On a device that still has your data (any device where sync is already unlocked), set a new passphrase in the Cloud sync card.
2. Re-sync. This re-encrypts your current data under the new passphrase and replaces the ciphertext in the cloud.
3. On every other device, enter the new passphrase once to unlock.

If no device still holds your data, the old encrypted blob cannot be recovered. Enable sync fresh with a new passphrase and re-add your connection profiles and settings.