Backup & Recovery

Your private balance has its own backup. The blockchain cannot recreate missing private records or random margin controller keys. Keep an encrypted SEAL account backup and test restoration before relying on the account.

What to back up and when

In Settings → Advanced → Account state, export a seal-account-….json file. It contains encrypted account keys, private balance records, contacts, history, pending submissions and private margin controller keys saved in the account.

The app saves new private records before submitting actions. Remembered browser access is not a backup. Download or synchronize a current backup after account changes, especially after creating a private margin account, and before clearing browser data or switching devices.

When configured, encrypted records are also retained by an archive or account backup service. Services can lose data, deny access or observe connection and file metadata. Keep a separate secure copy instead of relying entirely on one service.

A seal-tx-….json transfer file contains one payment's delivery information. It does not back up your account.

Local passkey accounts

Choose Create account → Use a passkey on a deployment with local recovery and an intent service. A new account gets independent random keys. Save the encrypted account file and keep its generated recovery key separately before adding funds. SEAL does not upload or synchronize these account backups.

Reopening the account requires WebAuthn approval. A compatible passkey provider or security key must support the PRF extension used for encryption; ordinary passkey authentication alone is insufficient. Linux uses the same WebAuthn API. Compatibility depends on the browser and authenticator, not the presence of a fingerprint reader. For local development, use http://localhost:5173 rather than the IP address.

If setup reports that the passkey provider does not support encrypted unlock, choose another provider in the browser's save-passkey prompt. In Chrome on Mac, the older Chrome profile provider lacks PRF even when it uses Touch ID. Try Google Password Manager or Apple Passwords / iCloud Keychain on macOS 15 or later, using an updated browser. On Linux, try Google Password Manager in Chrome or a PRF-capable security key. These are provider options, not a guarantee for every browser/OS/key combination; SEAL requires the selected credential to return encryption material before account setup can proceed. See Chromium's PRF provider explanation and its macOS iCloud PRF implementation.

Enrollment rejected for missing PRF saves no SEAL account, although the browser/provider may have already created an unused passkey entry. A provider may synchronize its passkeys independently; that does not upload your SEAL account state. For an existing account, a new passkey cannot decrypt the old file: use the original credential with a compatible browser/provider, or import the file with its recovery key before setting up a replacement.

To move to another device:

1. Export the latest encrypted file from the account menu or Settings. Include changes made since the initial setup backup.
2. Choose Restore account → Import account backup on the new device.
3. Select that file and approve the original passkey. Alternatively choose Use my recovery key instead of a passkey and enter the separately saved recovery key.
4. If the original passkey is unavailable, open the account menu and choose Set up a replacement passkey. Save its new backup and recovery key. Account keys, address and funds stay the same.
5. Let the account reconcile its records before spending. Move the latest state whenever switching devices; independent local copies do not automatically stay in sync.

A synchronized passkey does not synchronize private account state. A newly created passkey does not reproduce the original credential's secret. Both the latest file and a matching passkey or recovery key are required. The recovery key is a generated high-entropy secret, not a user-chosen password. Alternatively, choose Settings → Advanced → Account state → Export with password. Import this self-contained password file from the overview without a passkey or Google. If your original passkey is unavailable, enroll a replacement for normal reopening, or import the password file again after closing.

Replacing a passkey only changes local unlock information and future exports. Older files can still be opened with their original credentials. If an account secret or old recovery copy is compromised, replacing its passkey does not revoke that copy; move funds to a fresh account. Passkey enrollment also does not change the signature-derived keys of an existing wallet account.

Wallet account recovery

1. On the new device, connect the original compatible wallet.
2. Sign the same SEAL unlock message to derive the account's decryption key locally.
3. Import the latest encrypted account file, or restore the configured backup.
4. Synchronize and let the app check the records against the blockchain before spending.

There is no separate account-file password for a wallet-backed account. The wallet must reproduce the original unlock signature. A fresh device may restore confirmed balances from available encrypted archive records, but unconfirmed actions, drafts and margin keys need the corresponding saved data.

A wallet seed alone is not a complete private account backup. Recovering the key does not recreate private data that no longer exists.

Google account recovery

Restore through the original Google account using the recovery password or a previously linked wallet. Google sign-in alone cannot decrypt the account. A random newly connected wallet is not a recovery method.

Linking a wallet preserves the same SEAL account. Linked wallets must reproduce their recovery signature, and this version provides no unlink/revocation or password reset mechanism. Retain the password and test recovery before depending on a linked wallet.

Google Drive is optional. Choose Use local-only storage in Settings to stop automatic uploads while keeping the same account and address. Export account state downloads a self-contained password-encrypted backup; import it on a new device without Google. Keep that password separately. Older history-only files still need the original Google key bootstrap or remembered device. When automatic backup is enabled, failed uploads block submission until you reconnect or explicitly opt out. Browser storage alone does not survive clearing site data.

Margin account keys

Private margin accounts use a fresh random controller key, saved inside the encrypted account document. It is not derived again from the wallet seed. Export a current account backup after creating the account and verify that the restored account contains its margin records.

Losing every copy of that controller key can prevent management or closing of the margin account. Its public debt and liquidation risk do not stop when you lose access. A wallet-backed public margin account instead uses its controller wallet.

Interrupted or missing payments

A lost response is not proof of failure. Check the saved transaction hash, receipt or intent service status before creating a replacement payment. A transaction may still confirm after a connection failure.

For a missing incoming payment, ask the sender for the encrypted transfer file or text and import it in Receive. The matching onchain payment must exist. Delivery failure does not require sending the money again. Claim and reclaim timing is covered in Send & Receive.

An Account out of sync warning can mean this device is missing a recovery record created elsewhere. Restore the latest account backup from that device or Google Drive, then sync. Import merges compatible records; it cannot restore spent funds.

Browser access and loss

Forget device access removes remembered credentials while preserving encrypted account files. Hiding a balance or disconnecting a wallet does not lock an already open private account. Anyone who can unlock the device's SEAL account can use its accessible keys.

If every copy of required encrypted records or keys is lost, public commitments and hashes cannot reconstruct them. Available ciphertext and the correct recovery method may allow restoration; without both, funds or position control can be permanently inaccessible.

Account recovery restores access to private records; it cannot repair an insolvent lending market. See Risks & Security. Technical recovery and reconciliation details are in State & Notes.