日常使用指南Daily usage guide
从安装到精通桌面端From install to mastery of the desktop app

1. Back upExport a backup from settings (or an encrypted one) and confirm it imports.
2. Install overDownload the new installer and install directly; the data directory %LocalAppData%\Novara\ is unaffected. Keep the installer's "keep / delete data" choice on its default, keep.
3. VerifyAfter opening, check the data is intact, search works, and the privacy-lock password still applies.

• Plaintext backups and .novaenc files from older versions import normally into the new one.
• Rolling back the desktop = reinstall the older installer; the data directory is untouched.

One-sentence definition

Novara is a local-first personal data manager (a Windows desktop app): your memos, file paths, to-dos and records live in a single file on one computer, encrypted when you want them to be, portable when you need them to be — and neither of the two ways out below ever touches anyone else's server.

The four pages

Three ways to take data out

• Local vault — the foundation of everything: a single data.novadb file, AES-256-GCM encrypted once the privacy lock is on.
• Secure snapshot — export an encrypted, read-only single-file web page; drop it on any static host or double-click it open. Built for "quick look" and sharing.
• Encrypted sync — turn one of your own machines into a ciphertext relay; your phone's browser can view and even edit. Built for continuously using a second screen.

Neither path needs any official involvement: a snapshot is a static file, and the sync server is one you deploy yourself. Details in the security and sync guides.

What else is inside

• Privacy lock: optional; password + Windows Hello, AES-256-GCM encryption, 30-minute cooldown after 5 failed attempts.
• MCP interface: lets a local AI assistant read and write data under per-item permissions, with sensitive fields masked and every call audited.
• Command palette: Ctrl+K searches every data area; a > prefix jumps straight to commands.
• Desktop sticky note: a note from the Plans page can be sent to the desktop as an independent mini window.
• Five languages and light / dark / follow-system themes (a restart applies the change).

What it does not do

• It runs no official cloud that accepts plaintext — there is no such thing as a "Novara account".
• No telemetry collection; core features never require an internet connection.
• It does not keep your lock password for you: a forgotten password has no backdoor — the only way back is a full reset (see the security guide).
• It does not hand your data to third parties: the only networking is the API checks you trigger yourself and the sync server you deploy yourself.

Download and verify

Get the installer from GitHub Releases or this site's mirror (the download page lists both sources and the SHA-256). Verifying the hash before installing is recommended:

The desktop app targets Windows x64, at minimum Windows 10 2004 (build 19041); the .NET runtime is embedded — nothing else to install.

Install

Double-click the installer and follow the wizard. It installs to Program Files\Novara by default; the Sync\ folder inside the install directory is the bundled sync server (you will use it if you turn on encrypted sync — see the self-hosting guide).

When you install over an existing installation (an upgrade), the installer asks you to pick one of two options — and this choice is worth reading carefully:

A fresh install never shows this choice and has no data to delete.

Where everything lives

The settings page deliberately offers no way to change these paths: a predictable path is part of the security model, and it keeps antivirus whitelisting and backup scripts simple.

After the first launch

• First-run tour: the first launch shows a few tour cards built from real screens; click through and you are done — no sign-up, no network.
• Launch at startup: available in settings; once off, you open Novara manually.
• Theme & language: light / dark / follow system; five languages (Simplified Chinese, Traditional Chinese, English, 한국어, 日本語) — a restart applies the change.
• Tray: the app exits directly by default; optionally it can stay in the tray (closing the window minimizes to the tray).
• Privacy lock: off by default; read "The privacy lock" before turning it on.

Installation is done. To try things hands-on, jump straight to "First five minutes".

1 · Create your first memo

1. New groupRight-click empty space on the Memo page (or use the bottom-right button) to create a group; give it a name and an icon.
2. New entryInside the group click "Add entry", pick the "Account" or "API key" type, fill in the fields and confirm — content is saved to disk in real time; there is no save button.
3. Try maskingAdd a field labelled "Password" to the entry: in the list it shows as •••••••• and only reveals the plaintext when clicked.
4. Try copyingThe button on the right of each field row copies it in one click; pin and star live in the right-click menu.

2 · Turn on the privacy lock

1. Open settingsSettings page → Privacy access lock → Enable.
2. Set a passwordAt least 6 characters (stronger is recommended). The moment you enable it, the whole vault is re-encrypted with AES-256-GCM and written to disk.
3. Try lockingLock manually (shortcut or from settings); the lock screen appears; unlock with your password. On machines with Windows Hello you can also use face / fingerprint.

3 · Export your first secure snapshot

1. Open exportSettings → Connection card → Snapshot export.
2. Pick a passphraseTick "Reuse the privacy-lock password", or set an independent passphrase (entered twice). The export is always ciphertext — there is no plaintext-snapshot path.
3. Get the fileYou get a self-contained index.html: viewer and ciphertext in one file.
4. VerifySend the file to your phone (or any computer), double-click it, enter the passphrase — all four data areas appear read-only; refreshing asks for the passphrase again.

At this point you have used all three Novara forms: the local vault (authoritative), the privacy lock (encryption), and the snapshot (portable).

Where to next

• Want your phone to see the data any time and edit it too → deploy encrypted sync, starting with "What is encrypted sync".
• Want to restore the data on another computer → see "Backup and restore".
• Want an AI assistant to help you record things → see the MCP and AI assistants guide.
• For everyday capture → try the global quick-capture hotkey and the Ctrl+K command palette.

FAQ

Groups and entries

Organize with groups: create one from empty space or the bottom-right button; rename and pick an icon any time. Inside a group, "Add entry" creates an entry; the type decides the shape of its fields:

• Email / Account / Website / WiFi — address and credential items
• API key — the key and its endpoint
• Bank card / ID — card and ID numbers are masked automatically
• Custom — combine fields freely

An entry is a list of field rows, each with a copy button on the right; the collapsed subtitle automatically shows the key information for the type (a bank card shows its number — masked, of course).

Sensitive field masking

Fields labelled password / email password / CVV / API key / card number / ID number (plus a few unambiguous English aliases) always display as exactly eight dots •••••••• in lists and search results — the length never varies, so not even the length leaks. Click to reveal the plaintext.

The masking rule is the single one in the whole program: list page, search page, trash and MCP reads all share the same decision. There is no fork where "the list shows dots but search shows plaintext". Unrecognized custom labels are not masked — under-masking beats falsely masking ordinary content.

API key reachability check

API key entries have a check entry in the right-click menu, in three tiers (anything that spends tokens asks for confirmation first):

Checks send requests only to the third-party endpoint configured on that entry; Novara never touches or proxies this traffic.

TOTP one-time codes

Email / account / website / WiFi entries can bind a two-factor secret: the expanded card shows a live 6-digit code, one click to copy the current one. The secret gets the same masking and encryption, and snapshots and the phone can still compute codes — pure local RFC 6238, touching nothing but time.

Search across groups

The top search box searches across groups; the fuller entry point is the Ctrl+K command palette (see "Search and the command palette"). Sensitive field values never match — searching a fragment of a card number finds nothing, and that is a protection boundary, not an indexing bug.

Pinning paths

Add a file or folder path as an entry. It stores the path, not the file — nothing is copied, no space is used; it is a registered "shortcut to go there".

Typical uses: the project folder you are working in, the report you submit weekly, the company policy PDF, a NAS share — anywhere you would otherwise dig through three levels of directories is worth registering.

What "Open" does

Clicking "Open" starts the file manager with that file selected (folders open directly). It does not "open the file's contents" — it highlights the file in Explorer, ready to drag, attach or compress.

Right-click also offers copy path, handing the full path text to other programs.

Validity check

Check timing: at app start, after creating an entry, and an automatic re-check every 30 minutes. The status is essentially always fresh — no manual refresh needed.

The status is only a hint and never auto-deletes a broken entry: a red flash while an external drive is unplugged is normal; plug it back and it turns green on its own. To really clean up, right-click delete — it goes to the trash, recoverable.

Right-click actions

Copy path, open, pin, star, edit, delete — the same common actions as every page (see "Common actions"). Pinned paths sort to the top of this page, ideal for active projects.

Path or memo?

• The content is a location (folder, file, network share) → a path entry: one-click open plus the green/red state.
• The content is a piece of information (URL, account, note) → a memo: masking and field structure.
• A path entry stores only path text, never file contents — deleting it never touches the file itself.

FAQ

To-dos: parent/child check linkage

• All sub-tasks checked → the parent checks itself and the card auto-collapses (you can re-expand it).
• Any sub-task unchecked → the parent unchecks in sync and the card expands.
• A parent can exist on its own — with no sub-tasks it is just a regular card.

The list supports drag to reorder, so arrange the day as you like; pin and star work as everywhere.

The arrow next to the Plans page tabs filters by "mixed / to-dos / notes"; the list instantly shows only matching cards. Dragging is disabled in a filtered view to keep ordering consistent.

Sticky notes

A note holds a stretch of text; overly long content can be expanded in place. Notes auto-save in real time just like to-dos.

Desktop notes suit things like "three things I must remember today" — always in view, no need to open the main app.

Reminders

To-dos and notes can both set reminders: right-click → Set reminder, then pick a date and time in the dialog. Once confirmed, the card border fades from green to red as the deadline approaches — you can see at a glance what is due.

When it fires: a reminder card pops (content + a "Got it" button) and a system toast is sent, once. Cancelling goes through a double confirmation and the border returns to normal.

Delete and restore

Deleted to-dos/notes go to the trash and can be restored to their original spot; only "delete permanently" truly removes them (see "Trash and restore"). With sync on, deletions reach the phone too.

Right-click menu reference

FAQ

Rich-text journal

Click "New journal entry" to open the editor: bold / italic / underline / text color, and images can be inserted. Both formats run on the embedded web editor, so it feels like the document editor you already know.

The pill toolbar below the editor has two states — the behavior people ask about most:

Markdown documents

A new document is a Markdown record: plain-text editing with a live preview switch (Write ↔ Preview), so you see # become a heading as you type. The list badge shows "Document" to distinguish it from "Journal".

A document edits title + body; saving updates the modified time and the list re-sorts accordingly.

Export is explicit too: a journal can "export MD (with / without images)" (a lossy conversion); a document only "exports Markdown (as-is)" (lossless). Journals and documents are never converted into each other — both directions lose information, and a format jump drags a chain of complexity behind it.

List ordering and filtering

The list orders by "pinned first, then modified time descending", with drag to reorder; the tab arrow filters mixed / journal / document. All records share the timeline review, handy for looking back at older journals.

Deletion

Deleted records go to the trash and are not physically erased right away; with sync on, deletions travel to the phone as tombstones and normal lists filter them out.

FAQ

Soft delete

Memo, paths, to-dos/notes, records — all four pages use soft delete: deleted entries move to the trash and stay in the database, reversible at any time. The cost of a mistake is kept as low as possible.

Normal lists on the phone and in snapshots filter these entries — "the phone does not show trash contents" is by design, not a missed sync.

One exception to know: deleting a memo group takes effect immediately and does not go through the tombstone path (the group itself has no deleted-flag field); entries inside the group are still each handled as soft deletes.

Restore

Select an entry in the trash and click restore: it returns to exactly where it was — original group, original sort position, pin and star intact. Restore never asks for confirmation — it is itself a reversible action.

In a sync environment, the next round of sync tells every device "it is back".

Permanent deletion

"Delete permanently" in the trash requires double confirmation; only then is the entry truly removed. Use it when sensitive data must be gone right away.

With sync on, deletion joins sync as a tombstone: every device learns "it was deleted" and it will not resurrect in the next round; the web side filters tombstones from normal lists the same way.

Two small reminders

• Global search does not search the trash — inside the trash, use the trash's own browsing and locating.
• "Delete permanently" cannot be undone through sync: it is a terminal state, so think for three seconds first. A snapshot is a static copy from its export moment; after a permanent deletion, re-export to reflect the change.

Where deletion happens

Deletion matches the right-click menus of the four pages: memo entries, path entries, to-do/note cards and the records list all carry "delete". The trash page itself offers the two exits: restore and delete permanently.

In a sync environment deletion is consistent across devices: delete here and it disappears from the phone's normal list; the other direction too — an entry deleted on the phone (with edit credentials) arrives back on the computer's trash as a tombstone.

Relation to server version history

Permanent deletion does not touch existing history versions on the server: old versions keep aging out under the retention policy (10 versions by default) until newer ones push them out. That is normal version mechanics — the ciphertext server keeps history exactly until the policy says to let go.

To converge all devices quickly after a deletion: click "Sync now" once on the desktop and confirm nothing is left to push.

The command palette

Press Ctrl+K anywhere: the top half is the global search box; typing a > prefix enters command mode. Full keyboard navigation — your hands never leave the keyboard.

What search covers

• Across the four data areas: memo, paths, plans (to-dos/notes), records.
• Memo searches across groups — no need to remember which group an entry lives in.
• Results jump back to the original page still operable: keep editing, pin, star, delete right there.
• Search targets normal lists and excludes the trash — deleted entries live in the trash page.
• The top search box and Ctrl+K share one matching rule set and the same masking boundary.

Sensitive fields never match

Values of password, card number, CVV and API key fields never enter the search index; the result summary shows the mask. Searching "6222", a card-number fragment, will not surface the entry — so no one can fish sensitive information out of your unlocked computer.

Find entries by name, account, email address or notes — all plaintext fields that are within scope.

Habits that make it smoother

• Press > before you think of the command — a new to-do is just "> new to-do" plus Enter, faster than three menu clicks.
• When you cannot recall an entry's name, search its notes or group name — the context of the same group usually surfaces it.
• After jumping from a result, the right-click menu is still there — keep editing or pinning without hunting for the entry again.

Coverage at a glance

With sync on, search on the phone and in snapshots follows the same masking rules — what cannot be found on the computer cannot be found on the phone; the boundary does not depend on the device.

Search and the list pages share the same data and the same masking decision — "masked in the list but plaintext in search" cannot happen.

Auto-save (there is no save button)

Content saves automatically in real time. There is no hidden save button to look for and no "forgot to save" accident: edits hit disk as you type, on exit, and before locking — write, then move on.

It also means "revert to the last manual save" does not exist as a concept: what you see is what is saved.

The right-click menu

Right-click any card for the action menu: edit, copy, delete, pin, star, plus each page's own specials (API check, set reminder, send to desktop, export). One menu structure across all four pages — learn it once, use it everywhere.

Pin and star

• Pin: sorts to the very front of the list, for what you are working on now.
• Star: a gold corner mark that flags important things across lists.
• Both stack; list order is always "pinned first, then modified time descending", and within pinned, by modified time.

Dialogs and closing

Dialogs close with Esc or a click outside; anything involving deletion, overwriting or clearing asks for double confirmation — the confirm dialog states the consequence plainly instead of offering a lone "OK".

Themes and language

Light / dark / follow-system themes and five languages (Simplified Chinese, Traditional Chinese, English, 한국어, 日本語) all switch in settings; a restart applies the change (deliberately not hot-switched, to keep UI state consistent).

Quick capture and workspaces

• Global hotkey: from inside any application, the hotkey captures a memo / to-do / note straight into its data area — no window switching, no hunting for Novara.
• Workspaces: virtual groups across the five data types — gather a project's memos, paths, to-dos and records under one name while the originals stay put.
• Network indicator: the title bar always shows "● local only"; a matching hint appears only when an API check or a sync action runs. Whether the app is touching the network is visible at all times.

FAQ

Enabling it

Settings page → Privacy access lock → Enable, and set a password (at least 6 characters, up to 64). Enabling takes effect immediately: the entire vault is re-encrypted with AES-256-GCM and written to disk on the spot, and from then on every launch starts at the lock screen.

The password is never stored as plaintext: only a salted hash is kept locally (PBKDF2-SHA256, 3 million iterations). The decryption key is derived from the password — with the wrong password, nobody opens it.

Two ways to unlock

If Hello verification fails or is cancelled, the app silently falls back to password entry without counting a failed attempt; the Hello button does not appear on systems without it. After a password change, the Hello credential is updated automatically.

Locking is a hard lock

All three triggers produce the same lock: manual locking (shortcut), idle timeout (5 / 10 / 30 minutes / 1 hour / never), and Windows lock-screen linkage — press Win+L to lock the PC and Novara locks with it.

What "hard" means: session keys are wiped, the database instance is unloaded from memory, and sync pauses immediately (no network while locked is a hard rule — it is not bypassed because "the server has a newer version"). Unlocking = re-verify the password, re-derive the key, reload the vault. It is not a soft lock that merely covers the UI — nothing readable is left behind the lock screen.

Build the Win+L habit when leaving your desk and let the idle auto-lock back you up — with both layers on you are properly covered.

Five wrong attempts

No attempts are accepted during the cooldown, which blocks automated brute-forcing. Windows Hello failures do not count toward the five — they never touch the password.

Changing the password and turning the lock off

• Changing the password requires the current one; the change is a single transaction: re-encrypt the whole vault first, then update the credential file. If either step fails, both sides stay consistent — there is no intermediate state where "the vault uses the new password but the credentials the old one".
• Turning the privacy lock off decrypts the whole vault and clears the Windows Hello credential — the data returns to a single plaintext file.
• After importing an external backup, the app suggests setting up Hello again (avoiding the ambiguity of "Hello unlocking a vault locked with the old password").

The facts

• No recovery backdoor: neither the project nor the server can unlock anything — the encrypted vault does not even contain "security answers"; a wrong password simply does not open it.
• No remote channel: wiping, unlocking and recovery all happen on your machine — there is no remote wipe or remote unlock feature.
• Five wrong attempts lock the app for 30 minutes (the deadline is persisted locally); this limit exists precisely to stop "someone who forgot the password from trying over and over".
• The only way forward: wipe all data, rebuild an empty vault, then restore from a backup. Data added since the last backup cannot be recovered.

How to avoid ever getting there

• Keep the lock password in a password manager you trust — the only prevention that truly works; everything else is mitigation.
• Export backups regularly (plaintext or .novaenc), and actually test-import once in a new place — an unverified backup is not a backup.
• Windows Hello makes daily unlocking convenient but does not replace remembering the password: what Hello retrieves is the password itself, and the credential may not survive a system reinstall.
• .novakey backs up the sync space key, not the lock password — do not confuse the two.
• Changing the password requires the current one — treat it as a "confirm I still remember it" drill and run a backup while you are there.

If it is already forgotten

1. Wipe and rebuildChoose to wipe the data at the lock screen (confirmation required); you get a brand-new empty vault.
2. Restore a backupSettings → Data archive & restore → import the latest backup file; after a restart your data is back.
3. Set a new passwordRe-enable the privacy lock — and this time commit the password to memory.

That sentence is the reason this page exists: a backup's value is redeemed on the day the password is forgotten.

FAQ

Two kinds of backup

Both keep the checksum header, and files exported by older Novara versions import normally into 9.0. With the privacy lock on, import/export first asks for the lock password.

Automatic backups

%LocalAppData%\Novara\backups\ keeps a rolling window of the last 10. It is a safety net, not a strategy — for anything important, export deliberately and put it on another drive.

Automatic and manual backups do not replace each other: the former is disaster recovery (you can still get data back after a crash or a slip), the latter is migration (you hold it, can carry it, can import it on another machine).

The restore flow

1. Pick the fileSettings → Data archive & restore → import. With the privacy lock on, the lock password is asked for first.
2. Confirm the overwriteImporting overwrites all current data — the confirmation dialog says exactly that.
3. Automatic snapshotBefore overwriting, Novara automatically snapshots the current database — the app keeps the regret pill for you.
4. RestartAfter the import, the app needs a restart to clear old in-memory state.

Moving to a new computer: export (plaintext or encrypted) → copy the file → import on the new machine → restart. The encrypted backup's password is the one you set at export time, not the lock password — unless you ticked reuse.

One detail

After importing a backup, if you use Windows Hello, set it up again (the imported vault matches the password at export time). The app will prompt you — do not ignore it.

When to back up

• Right after the first unlock with real data inside — make the first manual export immediately.
• After every large reorganization (CSV import, migration, bulk deletion).
• After changing the lock password: verify the new password and a fresh backup together, so "it can be imported" always stays true.
• A fixed rhythm (say monthly) beats "when I remember" by a wide margin.

Desktop side

With the privacy lock on, data.novadb is ciphertext as a whole; encrypted or not, these files live under your user profile, tied to the Windows account, with other programs' access governed by Windows permissions.

The server's data (if you enabled encrypted sync) lives in a fully independent directory — %LOCALAPPDATA%\Novara\Server\data for the Windows direct-run path, the container-mounted /data by default under Docker. Removing the desktop app does not touch the server, and vice versa.

Does uninstalling lose data?

Uninstalling removes the program; whether user data is cleared is your call, and the default is to keep it. Reinstall the same version or upgrade, and the data is waiting in place.

If any doubt remains before deleting data, export a backup from settings first — two minutes that buy a regret pill.

Can the paths be changed?

The settings page deliberately offers no "change storage path" entry: predictable paths are part of the security model (antivirus whitelisting, backup scripts and restore flows all stand on fixed paths).

To move to another computer, use "Backup and restore"; to keep several devices consistent, use "What is encrypted sync".

Where exports go

Where backup files and snapshots are saved is chosen at export time — the app neither picks for you nor quietly copies anything. A few suggestions:

• Put backups on another physical drive or a cloud drive; a backup on the same disk as the database does not survive disk failure.
• Encrypted backups and snapshots are already ciphertext — cloud storage is safe; compress and encrypt a plaintext backup before uploading it.
• An exported snapshot is a standalone index.html; copying, renaming or uploading it never affects its ability to decrypt.

• Take data out the door and share it → the secure snapshot guide
• See it on the phone any time, and edit → the encrypted sync guide
• Run your own sync server → the sync deployment guide