The short version
Everything you save is locked on your own device before it goes anywhere. The lock is made from your vault passphrase, which never leaves the device. Relic's servers hold the locked version and a few plain facts they need to run sync, and that is all they can hold. Nobody at Relic can open your items, and nobody at Relic can give your passphrase back to you.
The Settings›About pane names the lock in one line:
- Encryption
- End-to-end · XChaCha20-Poly1305
That is the only piece of jargon on this page. The rest is what actually happens, step by step. The technology page has the long version if you want it.
Your passphrase becomes a key
When you create a vault you choose a vault passphrase. Relic runs it through a slow, deliberate calculation on your computer and gets a key out of the other end. The passphrase itself is never sent anywhere, and neither is the key.
Your items are not sealed with that key directly. Relic makes one random key for the vault, and your passphrase's key wraps it, the way a locked box holds a smaller key. That is why changing your passphrase is quick: Relic only has to wrap the same vault key again, so none of your items are touched. See your vault passphrase.
What the server holds
Every item is sealed on the device that captured it, before it is uploaded. What arrives at the server is a sealed blob plus a short envelope of plain facts. The envelope is what lets the server put your items in order, page through them, and count what you are using. It carries:
- the item's id,
- when it was made and when it last changed,
- how many bytes it takes up,
- whether you kept it in your Vault.
The title, the text, the picture, the file, the note, the tags and everything else are inside the sealed part. The server also stores the wrapped vault key and the salt used to make your key, which are useless without the passphrase it never sees. What Relic can and cannot see lists the whole thing, including the account facts like your email.
On another device
A second device downloads the same sealed items and the same wrapped key. You type the same vault passphrase, it makes the same key, the wrapped key opens, and your items open with it. Nothing is decrypted along the way. You can also unlock a new device by pairing it with one you already use, which hands the key across directly.
Sync is only a courier. It moves sealed bytes between your devices and never sees inside them.
Why nobody can reset it
There is no "forgot your vault passphrase" email, because there is nothing to send. Relic keeps no copy of your passphrase and no copy of your key. A service that could hand your data back to you could also read it, and could also hand it to somebody else.
Checking it for yourself
You do not have to take any of this on trust. The apps and the sync server are open source, so anyone can read the code that does the sealing and check that nothing else is sent. The developers page points at the repository and the file formats, and self-hosting lets you run the sync server yourself if you would rather not use ours at all.