Sharing between your devices¶

In short¶

Each of your devices keeps all of its data in its own files, and works without the others. What must travel between them goes through a folder that a sync app you already use carries (Nextcloud, Dropbox, Syncthing, Google Drive, OneDrive, or another), sealed on your device first: the folder and its server can read nothing, and change nothing without it showing. There is no server of ours, and nothing reaches the developer. Nothing that happens to that folder can take data away from your devices, and what a device cannot know, it says.

How it works¶

• Your devices hold your data; the folder only passes messages between them. Each device keeps its own complete copy. The shared folder holds sealed changes, sent from one device to the others. A device that loses the folder, or finds it damaged, keeps everything it had.
• One file per device, written by that device alone. Each device writes its changes at the end of its own file in the folder, one sealed line per change, and never touches the files of the others. A sync app makes "conflicted copies" when two devices change the same file. Here that never happens, so it never has to choose for you.
• Changes, not copies. Each minute, Sioul compares your files with what they held at its last look, and sends only what changed, one entry at a time: a setting, a line of time, a dose, a sender, a note. Each device reads the new lines of the others and applies them.
• The later change wins, entry by entry. A setting changed on two devices keeps the later change. Time noted on each device stays on both. A note changed on two devices keeps both versions, one of them under a name that says so. Once all your devices run this version or a later one (below), a money line, a time session or a pinned site changed on two devices stays one, and two lines alike made on one device stay two: each has an id of its own, given when it is made, or written into it once, when your devices take the newer form. A list you change on a page (words, days off, working hours, who may reach you, mail filters, meals and naps) changes by what you did there, over the list as it is at that moment: a word or a day off added on another device while the page was open stays.
• What the sync app has to do: very little. It must carry new files, and files that grow, sooner or later and in any order. It does not need to delete, rename or lock anything. That is why any sync app works. A slow one, such as a phone's that looks every half hour, makes changes come late, never wrong.
• What a device cannot know, it says. Each device says in the folder how it is: when it started, when it closed properly, whether it is in use, and when it last shared. Each knows how far it has read the others. A device that closed properly sent everything it marked; one in use is known while its news keeps coming. If something may have happened on a device whose news has not come (a dose marked on the phone while in use, which its sync app has not carried yet), Sioul says it does not know rather than guessing, and names that device. The dose is reminded with "check first", never as "not taken" (Health).

When the sync app is late¶

Sync apps carry files at their own pace, and Sioul cannot hurry most of them. A computer's Nextcloud client sends a change within seconds; a phone's app may wait for its next scan, half an hour or more, and can leave some files behind for longer: on 6 October 2026, Murena's eDrive left a computer's changes on the server for hours while it scanned every few minutes. Until a change arrives, the other device does not know it: a do-not-disturb switch, a dose marked taken, whether the computer is still open. A device that cannot know says so (doses: "check before taking it"); it never guesses.

WebDAV is the one protocol for which Sioul takes matters into its own hands. When the shared folder sits on a Nextcloud server Sioul already has an account for (Murena's included), it also reads the other devices' files from the server itself, as a backup, and keeps whichever copy is newer: a phone then follows within about a minute, whatever its sync app does. With Nextcloud, a sync app is even optional: Sioul can keep the folder in step itself, sending as well as fetching, so that a phone needs no other app (setting it up). With any other sync app (Syncthing, Dropbox, Google Drive…), changes arrive when that app brings them. That is why Nextcloud is the first choice: where to get one.

Sent at once¶

A few seconds after you save anything that travels (a dose answered, a setting, a medicine, a project, a budget), Sioul exchanges, without waiting for the minute. And where the folder is on your Nextcloud, Sioul then sends this device's own files there itself, beside your sync app: your other devices have them within seconds, even when this device's sync app is late, and a server that lost them can be given them again (Send everything again, below).

• Only this device's files, never another's; each goes over what the server holds as Sioul last saw it, so it never undoes a newer copy; this device's records are never sent shorter than they were.
• Your sync app goes on as before. When it sends the same file again, nothing changes: Sioul finds it there as it is here and sends nothing twice. Sioul gives each file its date and checksum, so that Nextcloud's client recognises the same file without downloading it.
• Small files, on a slow connection too. Each change sends a small file (tens of kilobytes at most), so a phone's hotspot or mobile data carries it: a computer writing each minute sends about half a megabyte an hour. A large file, now and then, is given the time its size asks; one that does not go through is said in the panel (which file, how long it tried), and tried again later, never sooner: a minute, then two, five, a quarter of an hour, up to an hour. On a metered connection, or one measured slow, large files go at most every ten minutes.
• A text to send goes first. A text written on a computer travels in a small file of its own, sent first and alone, so that it reaches your phone within its quarter of an hour even while a large file is still on its way.
• One moment is left: a sync app looking at the server in the second between a change here and Sioul's sending. Nextcloud's client then keeps your newer file beside, as a "conflicted copy" on that computer (never read; delete it when you like), and Sioul starts its file again with all it holds. Nothing is lost, and the other devices never take a dose as known wrongly: at most they say for a minute that they do not know.

When something goes wrong in the folder¶

Nothing that happens in the folder can take your data away from you. Sioul treats every surprise as something it does not know:

• A file cut, missing, damaged or out of order (a sync app that put back an older copy, a disk's damage): what it holds is counted as not known, and said. It is never read as "taken out".
• A settings file found empty or half written on this device (a crash, a full disk) is never read as "everything deleted". It waits ten minutes, and nothing of it is taken out elsewhere meanwhile.
• A folder suddenly empty, gone or unreadable (a memory card not mounted, an access withdrawn): nothing of it is taken out on your other devices until you say so.
• Many files deleted at once from a folder still there: your other devices keep them two weeks, then they leave by themselves, unless you put them back (Notes and papers).
• An older copy put back by hand (a backup restored with its old dates) does not undo your other devices' changes.
• A device restored from a backup, or one that lost its memory, carries on from where the folder is and catches up: what it marked after the backup comes back.
• Before another device's change replaces or removes a file here, the file as it was is kept on this device, to put back if needed (below).
• The sharing folder gone, or its seal (a disk not mounted, a sync app that moved or rebuilt its folder): nothing is written until it is back, and the panel says so. Sioul never makes the folder again, empty, beside the real one.
• The folder sealed with another passphrase than this device's (two devices that each set up the folder before the other's seal arrived): this device writes nothing there, and says so; start sharing again on it with the passphrase your other devices use, and they meet.
• Two devices under one name (a disk or a phone's data copied to another): each finds the other's lines in its own file, and the panel says so; stop sharing on one of them and start again there, which gives it a name of its own.
• A list kept by another program in another encoding (not text Sioul can read): left as it is, said, and nothing of it is taken out elsewhere.
• A draft sent on one device while another changed it, neither knowing yet: it stays sent everywhere, whichever came later; the change made meanwhile is kept among that device's earlier versions.

What it protects, and what it cannot hide¶

• Sealed on your device. Every change is encrypted before it is written into the folder, with XChaCha20-Poly1305, a cipher that also detects any change made to what it sealed. Notes and papers are compressed, then sealed in pieces of 1 MiB.
• One passphrase. The key is made from a passphrase you choose, through Argon2id, which is deliberately slow and costly to try (64 MiB of memory and three passes for each guess). You type it once on each device, which keeps the key made from it in its keyring (on a phone, behind Android's KeyStore); the passphrase itself is kept nowhere and sent nowhere. A wrong one is said at once. It needs at least 12 characters: a few words you will not forget.
• What the folder and its server can see: which device wrote (an identifier drawn at random, not your name nor the device's), when, and how much. For notes and papers, how big each sealed file is: a well-known document, such as a public form, might be recognised by its size. They can also tell when a change reuses a content already sealed there (a file put back as it was).
• What they never see: what the changes are. Not the names of things (addresses, file names, settings), not their content.
• Tampering shows. Each line is bound to the device that wrote it, its place in that device's file, and its time. A line changed, moved into another device's file, or put in another order does not open. Each piece of a sealed file is bound to its file and its place, so pieces cannot be swapped, cut or added. Whatever does not open is set aside as damaged and said. It never erases anything.
• Someone who gets the folder but not the passphrase (a hacked cloud account, a curious provider) can read nothing and forge nothing. They can delete or damage files: Sioul notices, says so, and your devices lose nothing (above).
• Someone who has the passphrase, or an unlocked device of yours, can read and send changes like any of your devices. Even then, a change from the folder is written only where it belongs: never through a link, never outside your notes folder, never into Sioul's own files, never in plain into the sharing folder.
• Passwords never travel. Accounts arrive on another device without their passwords: each device asks once, and keeps them in its own keyring, or takes them from Bitwarden.
• Not hidden yet: the sizes and times above, and a small note each device leaves in the folder, unsealed: when it last exchanged, and how far it has read the others.

What travels, and how¶

Never shared: what each device chooses to share, where things are on each device (each keeps its own folders), how text reads on this screen, how pages are laid out, this device's browser notices, caches, and your own OpenPGP keys (copy them by hand). Passwords stay in each device's keyring.

Setting it up¶

No cloud yet? Nextcloud is the one Sioul is tested with: where to get a Nextcloud.

On the first device:

1. Open Settings ▸ Your folder and sharing, and find Between your devices.
2. Folder: choose a folder inside the one your sync carries, such as a new folder Sioul in your Nextcloud folder.
3. Passphrase, then Once more: a few words you will not forget, at least 12 characters.
4. Share.

On the other device, choose the same folder (as your sync shows it there). Sioul sees that another device shares through it, and asks for the passphrase chosen there. Then Share.

With a Nextcloud account in Sioul (Murena's included), a device needs no sync app at all: choose Sioul keeps it in step with your Nextcloud itself, the account, and the folder's place among your files there (Documents/Sioul), then the passphrase: typed twice when the folder is new there, once when another device shares through it already. Sioul keeps its own copy of the folder on that device and sends and fetches the files itself; devices that use a sync app on the same folder share with it as before (why).

A new device, through your Nextcloud's sign-in¶

A phone or a computer with nothing set up yet joins your other devices through your Nextcloud alone, Murena's included: no sync app, no account to add first, no password typed into Sioul.

1. Open Sioul on the new device. On its first start, the Porch offers Join your other devices: Sign in to Murena, Sign in to another Nextcloud (its address, such as cloud.example.org) or I use a sync app's folder. Settings ▸ Your folder and sharing offers the same, above the two ways.
2. Your Nextcloud's own sign-in page opens in your browser. Sign in there as you do on its site, its second step included, and grant access to "Sioul (Android)" (or the system it runs on). Come back to Sioul: it waits for that, twenty minutes at most; Cancel stops it.
3. Sioul looks for your sharing folder there: Documents/Sioul, Sioul, then the folders in Documents. It says where it found it; elsewhere, choose Another place and type its place. Found nowhere, every place looked at, you may start sharing there, as on a first device. When Sioul could not look through all of them (a slow server, an error), it says so, with Look again, and never offers a new sharing then.
4. Type the passphrase you chose on your other devices, once (twice for a new sharing), and choose Join.
5. A first exchange runs at once. Sioul then says who this device shares with now, and what came: your settings, your accounts, your hours. Your contacts and calendars on that Nextcloud use the sign-in, through your account for it come with your settings, or one made from the sign-in when there is none; decided once all your other devices' settings came, a little later on a slow first exchange, so that no second account is made beside yours. Still to sign in on this device lists the accounts whose passwords never travel: mail, mostly; give each its password in Accounts.

From then on, Sioul keeps its own copy of the folder in step with your Nextcloud itself, as with Sioul keeps it in step with your Nextcloud itself.

What the sign-in leaves: an app password of its own, made by your Nextcloud for Sioul, kept in this device's keyring, never in a file; your Nextcloud lists it among its devices and sessions (Settings ▸ Security there), where you can revoke it. Your own password never reaches Sioul. Sioul sends that app password to that server only, over HTTPS, and refuses a sign-in whose answer names another server. Cancel after the sign-in gives it back to the server; so does Stop sharing, unless your contacts and calendars use it.

On a computer that shares, Add a device (in the same panel) says what the new device needs: the server to sign in to and the folder's place there, or, for another sync app's folder, that same folder on the new device; then the passphrase, the one you chose, which Sioul never shows.

A new phone in place of an old one¶

A phone that shares beside another phone silent for a day or more, as this phone sees it, asks once: "Does this phone replace GS290, silent since Sat 10 Oct 21:40?" On a phone that just joined, that is a day after it joined; meanwhile the computer offers Forget it now (below). Said of a phone still in use, Yes would leave your doses without that phone's word: both could then remind you of the same dose. Yes, it replaces it: its sealed entry says so, and every device then counts the old phone as forgotten: it no longer holds your doses' reminders back, and a computer reminds a dose plainly again once the new phone has said it read its opening. Should the old phone ever share again, it counts again by itself. Nothing it said is lost: its last records, its texts and their pictures stay; its older records, which its last ones restate, and its versions since replaced leave the sharing folder, taken out by your other devices. No, it is a second phone: nothing changes.

On a computer, a phone silent for a day or more can be forgotten at once: Forget it now, under its line, says what it changes first. Without it, a phone that will never share again (lost, broken) holds the doses' reminders back for a week: each comes with "check first", a few minutes late. It also keeps your devices' older records in the sharing folder for half a year: each device whose records it reads keeps them until it has read them. Forgotten on a device, it no longer holds that device's records back, and that device takes the old phone's own older records out of the folder; said replaced by a new phone, on every device at once.

Removing a device's files¶

A device that left, that you forgot, or that a new phone replaces keeps its last records in the sharing folder: its last word on each thing, its texts with them. Under Devices that no longer count, each one still holding files there has Remove its files…; a device that still counts has Forget it and remove its files… on its line. Before you press, Sioul says in plain words what goes, with how much room it frees (its records, the small files it kept there, the sealed copies of the notes and papers it was the last to change that no other device names), and what stays: what each of your devices already read of it stays on that device, and the pictures and videos of texts that another phone's log names stay in the folder. A device joining later gets none of its records, unless another device's records carry them, as the texts a new phone restored. Its few small files that your other devices may still need (what it last said of itself, how far it read) stay too, a few hundred bytes. Notes deleted many at once and still held keep their sealed copies, so Put them back still works. If it still counts, it is forgotten first, for your doses too; if it was heard from within the last day, Sioul first says it may be in use now, and your doses keep their doubt for it until it says anything newer. If it is still in use after all, it shares again by itself.

The first time, a copy of what this device had is kept aside, in case. Then the other device's settings come, and what this one alone had goes out: two devices set up apart end with the first one's settings and both of their lists.

From then on, changes are exchanged a few seconds after anything that travels is saved here, each minute, and when you choose Refresh everything or Exchange now. The panel says through which folder you share, with how many other devices, and when they were last heard from. Under Your other devices, it lists each one: in use now, or closed at 22:14, and when it last shared, and the Sioul it runs ("Sioul 0.0.3 (eff8661abcde)."; an older one than this device's said, so that you can update it when you like); one you said is off, with Count it again; one silent for a week, with Forget this device; on a computer, a phone silent for a day, with Forget it now (a new phone); each, with Forget it and remove its files…. Under Devices that no longer count, those that left, that you forgot or that a new phone replaces, while their files are still in the folder, each with Remove its files… (below). Under them, this device's own: "This device: Sioul 0.0.3 (eff8661abcde).", as sioul --version says it. Stop sharing asks first, saying what stops and what stays, then ends it on this device: each device keeps its own files, and the others go on sharing among themselves.

On a Nextcloud (Murena's included), the panel also says whether Sioul reads the folder on the server itself, beside your sync app, and when it last did: Also fetch them from the server, on once the folder is found there under the same seal (why). If Sioul does not find it, give its place there (such as Documents/Sioul) and choose Look there. Below it, Also send this device's changes to cloud.example.org directly, on with it: Sioul sends this device's own files there itself, right after each change (why), and says when it last did.

Send everything again, while you share: each of this device's files the server lacks, or holds otherwise, is sent again, whatever was sent before; then the other devices' news is fetched. For a sync app that was late, or a server that lost files. It says what it did, such as "Sent 14 files to cloud.example.org at 10:42.", or why nothing went.

Your notes folder travels by its own sync, not by Sioul, unless you switch it on below. If it does not seem to be inside a synced folder, the panel says so: your other device would not see your notes and projects. Moved into one (and chosen again in Settings), they travel too; or switch Notes, Projects and money and Papers on, and Sioul carries them, sealed.

Devices on different versions of Sioul¶

Your devices may run different versions of Sioul for a while, such as a phone updated after the computer. They go on sharing; what they send each other changes form only once all of them can read the new one.

• A device on an older Sioul holds the newer form back. This version of Sioul shares money lines, time sessions, pinned sites and lists of words in a newer form: one line or one session changed on two devices stays one, and two sites pinned, or two words added, on two devices at the same moment both stay. Until every device of the sharing runs this version or a later one, all of them keep sharing in the form the older one reads, and the panel says so: "One of your devices runs an older Sioul…", the device's own line saying which. Meanwhile, a time session, your pinned sites or a list of words changed on two devices at the same moment keep only the later change, as before. Once that device is updated, your devices take the newer form by themselves, once: each writes into its own files an id for each money line, preset, split and time session that has none (the file as it was is kept among the earlier versions), and sends only what the older form had lost, such as a second line alike. A device retired without Stop sharing holds the newer form back until you choose Forget this device for it (offered once it has been silent for a week, or at once for a device known only by what it shared before), or for 180 days.
• A device that needs a newer Sioul. If your other devices share a part in a form newer than this device's Sioul reads, this device says so once in the status line ("This device needs a newer Sioul to share “Time”…") and, as long as it lasts, in Settings ▸ Your folder and sharing. It still reads what it can. What you change here in that part stays on this device, and what changes on the others waits here. Once you update Sioul on this device, both are applied, the later change winning: a change made here gives way to a later one made on the other device. If the device that shares the newer form stops sharing, you forget it, or it stays silent for 180 days, the part travels again between your other devices, and what waited here from that device is set aside. Should that part be Health, this device says meanwhile that it does not share its doses, after a restart too: your other devices then say they do not know a dose it may have answered, never that it was not taken.

What travels from this device¶

Under What travels from this device, each part has its switch, says what it carries, and when it last sent and received a change:

Each device chooses for itself: switching a part off on the phone changes nothing on the desktop. A part switched off sends nothing and takes nothing out on your other devices; switched on again, it joins them as a new device would: what they hold comes first, and what only this one holds goes out. A device that never chose shares what Sioul shared before parts had switches: everything but notes and papers, and projects and money if you had ticked them; never the messages from your phone nor the texts, which wait for your choice on each device. Before Notes or Papers is switched on, the panel says how many files would travel, and how big they are in all.

Notes and papers¶

Switched on, notes and papers travel through the same sealed folder, one file at a time:

• Only what changed: each file is compressed, sealed apart and sent once; a note changed sends that note alone, not the folder. Files over 64 MB stay on their device, and the panel says which. On a phone whose sync app never deletes what was deleted elsewhere (Murena's eDrive), every sealed file it brought stays in the sharing folder there: count on room for your notes and papers twice over. On the server, Sioul takes out what it no longer needs itself, eDrive or not. A device where Sioul keeps the folder in step itself lets go of the sealed copies the server no longer has, apart from those it still needs. On a phone of that kind, its background brings the others' new notes and papers, so that they are there when you open Sioul, offline too; on mobile data or a slow connection, one large file at most every ten minutes. A recording or a scan of a megabyte or more travels once it has not changed for ten minutes, or an hour after it began to change: saved again within minutes, only its last save goes.
• Left out: what your sync app or your editor makes beside your files (hidden files, ~ and .tmp files, conflicted copies, Office's locks), names that are not text, and what the other parts carry.
• Changed on two devices at once: both versions are kept. The later one keeps the name; the other is kept beside it as "lease (conflict 2026-10-05 16.05).md", on every device, and the panel says so for a day. Keep the one you want, or merge them by hand. The notes page does the same when you save a note that changed on another device while it was open.
• An older copy put back by hand (a backup restored with its old dates) does not undo your other devices' changes: the newer version comes back, the older copy kept beside it, and the panel says so. To send an older version, use Put back below.
• Taken out: a note deleted on one device goes on the others ten minutes later (it may be on its way back), kept there among the earlier versions in case, as a copy: its sealed copy in the sharing folder then leaves it as soon as each of your devices has read that it was deleted. On Android that copy takes room (your notes and Sioul's own storage are apart), so a large deletion is kept a part at a time, over a few exchanges.
• Many deleted at once: if many files leave a folder at once (deleted in bulk, a folder moved within the notes), your other devices keep them two weeks. The Porch says it once, calmly: how many went, from which folders, when, and when they leave, with Put them back (each comes back where it was, dated as it was; a file written there since stays as it is) and Take them out now (those files alone). Nothing has to be pressed: two weeks after each went, they leave your other devices by themselves, unless they came back. Settings ▸ Your folder and sharing says it as long as it lasts, with the same buttons.
• A folder suddenly empty, gone or unreadable (a disk not mounted, an access withdrawn), or replaced by a link (Sioul never follows links in the notes folder): that is not a deletion. Nothing of it is taken out on your other devices, however long it lasts, and nothing is written into it; the panel says so, with Take them out everywhere for when you did it on purpose. Switching Notes off and on fills the folder again from your other devices.
• Names a phone takes for one: two notes whose names differ only by case or by how an accent is written ("Lease.md" and "lease.md") are one file on a phone: the second waits, and the panel says so; rename one.
• Room: nothing is written without room for it and some left over; a note that does not fit waits, said, and comes when there is room.
• How long replaced versions stay: a version replaced leaves the sharing folder, and its server, two weeks later (90 days while one of your devices runs Sioul 0.0.5 or older, which counts on it). A device away longer than two weeks catches up on the latest version of each file only: the versions made meanwhile are gone from the folder. What it held before is kept among its earlier versions there. A device you forgot, or that a new phone replaces, holds nothing back: its versions since replaced leave the folder two weeks later, taken out by a device of yours that shares Notes, Papers and Spam filter (and Texts, with a phone among your devices); its last records stay until you choose Remove its files (below). What Sioul takes out of the server goes to the server's trash; on some servers (Murena's, by its users' reports) it counts against your space until the trash is emptied: in the server's web page, Files ▸ Deleted files, select them all, Delete permanently.
• Not with a synced notes folder: if a sync app already carries your notes folder on this device (Nextcloud, Dropbox, Syncthing), Sioul refuses to carry it too, and says why: two carriers would undo each other's changes. On a phone, Sioul cannot read the sync app's settings: it asks you before Notes or Papers is switched on, and until you say, takes a notes folder in the same top folder as the sharing one (Documents…) as carried, with a button to say no sync app carries it. Your answer is for that notes folder: move the notes elsewhere and Sioul asks again. Move the notes to a folder no sync carries to let Sioul carry them, or leave them to that sync. Sioul does not recognise every sync app (Google Drive, Insync, rclone, MEGA…): leave Notes off where one carries your notes.
• On Android, notes and papers wait while Sioul lacks Android's access to all your files (without it, Sioul would see only the files it made).

Putting back an older version¶

Before a change from another device is written into a file here, or takes it out, Sioul keeps the file as it was, on this device only: the last 20 versions of each file, and all those of the last 30 days; of a file deleted since, those of the last 30 days; never more than a gigabyte in all, the oldest going first. Your versions of events, tasks and contacts set aside when they changed here and on their server too are kept like a file's: the last 20, and all those of the last 30 days, whether the item is still on its server or not. They are never shared. A note or a paper whose version is still in the sharing folder is kept as a pointer to it, for 12 days, rather than copied (the folder keeps a replaced version two weeks); one no longer there is copied. A note another device deleted is kept as a copy, moved here, which costs no room; on Android, where it cannot be moved, it is copied, a part at a time over a few exchanges.

In Settings ▸ Your folder and sharing, Show earlier versions lists them: each part, its files (the one changed last first; type part of a name to find older ones), and under a file its versions, with when and how big. Put back first says what it would change, then puts that version back:

• a note, a paper, a draft goes back whole; the file as it was just before is kept in the list too, so putting back can be undone the same way;
• an event, a task or a contact changed here and on its server between two syncs: the server's version was kept, and yours is listed here, under Your calendars and contacts, named by its title, on a phone too; put back, it goes to its server over the server's version;
• a file of settings or lists (your settings, the doses taken, time noted) goes back entry by entry: each setting or mark the version held is put back as it was, those taken out since come back, and those added since stay. Putting back never takes out, on any device, what was added after that version: a dose marked this morning stays marked.

The next exchange sends what was put back to your other devices, as a change you made now.

On a phone¶

Sioul for Android shares the same way, through the folder your phone's sync app keeps on the phone: Murena's eDrive, Syncthing, FolderSync, Autosync, Nextcloud's own app, or any app that keeps a folder on the phone in step with your cloud (Nextcloud, Dropbox, Google Drive, OneDrive…). Sioul reads the folder; it asks only that new files, and files that grow, reach the other side some day.

• No sync app at all: a new phone joins through Murena's sign-in, or another Nextcloud's, from Join your other devices on its Porch (a new device); with your Nextcloud account in Sioul already, choose Sioul keeps it in step with your Nextcloud itself when you start sharing on the phone. Sioul then sends and fetches the files itself, and the phone needs neither eDrive nor another sync app for the sharing (setting it up).
• Where: some sync apps carry only a few folders. Murena's eDrive carries your cloud's Documents (with Pictures, Music…), not the rest of it: share through a folder inside Documents, such as Documents/Sioul. Sioul suggests one there when your synced folder has a Documents folder, and says so when the one chosen is outside it.
• On the phone: Settings ▸ Your folder and sharing, Allow access to files (Android's switch), then Choose… the folder, your passphrase, Share.
• Accounts come without their passwords: each asks for its own once, typed or from Bitwarden.
• Your notes, projects and papers: the phone keeps a notes folder of its own, which no sync carries. Switch Notes, Projects and money and Papers on in the same panel, on the phone and on each device whose notes folder no sync carries: they then travel sealed with the rest, a note at a time. On a computer whose notes folder a sync app already carries, they stay off: that computer's notes reach the phone only from a folder no sync carries, with Notes switched on there too.
• The sync app's pace: a phone's sync app often brings the cloud's changes only every half hour. Where the folder is found on your Nextcloud, Sioul reads your other devices' news there itself, each minute while it is open and as soon as you come back to it, and leaves the sync app to its own pace. A note or a paper changed on another device comes the same way: Sioul fetches it from there as soon as it learns of it, and writes it within a minute while it is open. Otherwise, when the app offers a way to be asked (Murena's eDrive does), Sioul asks it to look now: after you mark something, when you come back to Sioul, and every five minutes while it is open, so what your other devices marked comes within a minute. Without either, it comes at the app's pace, and the doses say what Sioul cannot know meanwhile. What the phone marks goes the other way at once where the folder is found on your Nextcloud: Sioul sends it there itself (sent at once).
• With Sioul closed: Sioul keeps your devices in step in the background, with one quiet notification. Every few minutes (every two while another of your devices runs Sioul, every fifteen while you sleep; at night a computer left on with nobody at it does not count, unless a dose is due and not marked) it reads your other devices' news on your Nextcloud itself, where the folder is found there, and asks the sync app nothing, so that the phone sleeps between two looks; otherwise it asks the sync app to look. It also reads what the sync app brings as soon as it is written: do-not-disturb turned on at your computer follows within a few minutes (Do not disturb on every device). Turned off, changes come when you open Sioul.
• Doses while Sioul is not on the screen: each coming dose is given ahead to Android's alarm clock. At its time, Sioul first reads your other devices' news: on your Nextcloud itself where the folder is found there; else, or when that does not go through within a few seconds, from the sync app, given twenty seconds to bring it. Then it reminds you, or not if another device marked it taken, or with "check first" if it cannot know: offline, with no news read since the dose's time, that is the case even for a device last known closed.
• Files kept online only: if your sync app keeps files on the server until you open them (OneDrive, Google Drive, iCloud, Nextcloud's "virtual files"), set the sharing folder to stay always on this device.
• What is never needed: deletions (eDrive never deletes on one side what was deleted on the other: the old files Sioul clears stay, and are not read again), and nothing it keeps aside, such as conflicted copies, is read.

Some things, one device at a time¶

• Medicines are reminded by the device you are using only, so that a dose is not reminded twice. A dose marked taken goes to the others at once.
• The sites' gathered notification comes on the device you are using.
• Invoices are numbered on one device only, so that a number is never given twice. Another device says where they are made, and offers Make invoices on this device. A device that numbers them and has not been heard from (its sync stopped, or late on a phone) still holds them, until it is heard from, closes Sioul, or a day goes by without its news. See Time and invoices.

Not there yet¶

Sizes padded to steps, and the devices' notes sealed too, so that the folder tells even less; a database server instead of a folder, for those who would rather have one; drafts in your mail server's Drafts folder, for other mail programs to see; phones other than Android's. The format is plain and documented (the design notes), so that they can come.

For technical readers¶

• Records are sealed with XChaCha20-Poly1305 (RustCrypto), a random 192-bit nonce each. The associated data binds each record to its device, its round, its place in the file and its clock: a record moved, reordered or copied into another device's file does not open.
• The key: Argon2id v1.3, 64 MiB, 3 passes, 1 lane, a 16-byte random salt, and a check value sealed under the key, all in the folder's seal.toml. A seal asking more than 1 GiB or 16 passes is refused, so that a tampered folder cannot make a device spend unbounded memory. Each device's keyring keeps the 256-bit key; the passphrase, at least 12 characters, is kept nowhere.
• Notes and papers: HKDF-SHA-256 derives a sealing key and a naming key from it. A file is gzip-compressed, then sealed in 1 MiB pieces, each bound to the file's name, its index and whether it is the last, so that pieces cannot be swapped, cut or added. Names are an HMAC-SHA-256 of the content's hash, so that equal files in two folders cannot be linked. A file must open whole and match its record before it replaces anything, and opening stops at 64 MiB, whatever the compressed size claims.
• Order: a hybrid logical clock, the later change winning entry by entry.
• Writing from the folder never goes through a link, outside the part's own folder, in plain into the sharing folder, or into Sioul's own state.
• From a Nextcloud server: WebDAV over HTTPS only, never redirected, with that account's password taken from the keyring for each request; a folder there is read only when its seal.toml is this folder's, byte for byte.
• To a Nextcloud server: this device's own files only, each a PUT with If-Match its ETag as last seen (If-None-Match: * where none was), X-OC-Mtime and OC-Checksum: SHA1:…; refused (412), the server's copy is looked at and taken as sent when it is the same (size and checksum, else its bytes). A records file is never sent shorter.
• The build: each device's version and commit, in its sealed entry and sealed in the first line of each batch of its records; the server never learns them.
• Unsealed: each device's small note (when it last exchanged, how far it read the others), sizes and times. Padding to fixed steps is not built.
• Format: the design notes.