Velnode Account

Velnode Browser  ·  a product of Dignity New Zealand Limited

_{User  |  Version 1.2  |  Last updated 2026-07-03}

---

Velnode Account

Document type: User Owner: Dignity New Zealand Limited Applies to: Velnode Browser v1.32 and later Last updated: 2026-07-03 Document version: 1.2 Status: Approved

---

This guide covers the optional Velnode Account: how to create one, sign in on a new device, manage sync categories, recover access if you forget your password, and sign out.

A Velnode Account is not required to use Velnode. Everything — browsing, bookmarks, the vault, Vee — works fully without an account, and continues to work while you are signed out.

What you'll learn

• How to create a Velnode Account.
• What the Recovery Kit is and why you must save it.
• How sync works and what you can control.
• How to sign in on a new or additional device.
• What happens if you forget your password.
• What to do if you have lost your Recovery Kit.
• How to sign out.

Prerequisites

• Velnode Browser v1.21 or later.
• A valid email address.
• A few minutes to write down or print your Recovery Kit.

---

1. What a Velnode Account does

A Velnode Account adds:

• Login from any device. Sign in with your email and password on as many devices as you like. No extra codes are required.
• Automatic cross-device sync. Signing in turns sync on immediately — your bookmarks, browsing history, notes, workspaces, pinned commands, settings, and vault are kept in step across all signed-in devices. See §5 for what syncs and how to control it.
• Recovery Kit. A 24-word phrase that lets you recover your account data if you reset your password.

---

2. How your data is protected

Velnode uses a zero-knowledge design for account data.

• Your password is never sent to the Velnode servers. Velnode derives two independent values from it: an authentication hash (sent to the server to prove you know the password) and a Key Encryption Key (KEK), which stays on your device.
• A random account data key is generated on your device, encrypted by the KEK, and only the opaque ciphertext is sent to the server. The server cannot read it.
• Dignity New Zealand Limited cannot access your account data. A Velnode server breach would expose only encrypted blobs, not your actual data.

Your Password Vault is separate. Signing in does not unlock the vault. Vault secrets open only with your vault master passphrase.

For the technical detail, see Architecture Overview §11a and Privacy Policy §4.8.

---

3. Create an account

1. Open velora://account in the address bar, or go to Settings → Account → Create account, or choose Sign in / Account from the ☰ menu.
2. Enter your email address. Use one you control — Velnode will send a verification link.
3. Choose a password. It must be at least 12 characters long and score at least "Fair" on the strength indicator. A stronger password gives you stronger encryption.
4. Click Create account. Velnode shows a brief "Securing your account…" indicator while it derives your keys. This takes a few seconds.
5. Check your email inbox for a verification message and click the link. Your account is usable before verification, but verifying confirms you own the address.

Step 6 — Save your Recovery Kit

After account creation, Velnode shows your Recovery Kit: a 24-word phrase.

Read this carefully before continuing.

This phrase is shown once and is never stored by Velnode or Dignity New Zealand Limited. It is the only way to recover your account data if you forget your password. If you lose both your password and this phrase, any data encrypted to your account is unrecoverable — by anyone. This is by design.

Do at least one of the following:

• Click Download PDF Emergency Kit and print or save the PDF to a secure location (not in Velnode's own data folder).
• Write the 24 words down in order and store them somewhere physically safe.

Click I've saved my Recovery Kit — continue when you are ready. You cannot go back to this screen.

---

4. Sign in on the same device again

If you restart Velnode on the same device where you created the account, you are signed in automatically. Your data key is cached in the operating system's secure storage (the same mechanism used by the vault). You do not need to type your password on every launch.

Signing out clears this cache. After signing out, you need your password to sign back in on that device.

---

5. Sync — what syncs and how to control it

Signing in turns sync on automatically for all seven categories. You can adjust this at any time in Settings → Sync.

What syncs

Category	Default	Notes
Bookmarks and favorites	On	Per-item merge; deletions propagate as tombstones
Browsing history	On	Union-merge only — entries are never deleted on merge. Respects Network Privacy: if recording is paused, nothing is captured or pushed.
Notes	On	Newest edit per note wins
Workspaces	On	Newest edit per workspace wins
Pinned commands and preferences	On	Per-item newest wins
Settings	On	Allowlisted user preferences only. API keys, model paths, window bounds, and other device-bound values are never synced.
Password Vault	On	Travels as an opaque blob; the sync layer never decrypts it. You must unlock the vault with your passphrase on each new device.

How your data is kept private

Every collection is encrypted on your device with your account data key (AES-256-GCM) before it is sent. Velnode's servers store only opaque ciphertext — they see sizes and timestamps, not content. Dignity New Zealand Limited cannot read any synced data.

Turning a category off

Open Settings → Sync and toggle the category off. Future changes in that category stop syncing. Data already on the server is not deleted — it stays available if you turn the category back on.

Persistent sign-in

Once signed in you remain signed in across restarts. Velnode quietly rotates your session token in the background. If you prefer to type your password each time you launch, turn on "Always ask me to sign in on launch" in Settings → Sync.

If your session expires or is revoked, sync pauses and a prompt appears asking you to sign in again. Your local data is not affected.

First sync on a new device

After you sign in on a new device, Velnode pulls your synced data and applies it locally. A toast notification confirms how many items were restored. The vault arrives locked — you will need your vault passphrase to use autofill on the new device.

Migrating from the legacy sync passphrase

If you previously used the passphrase-based sync, Velnode offers a one-time prompt to move your sync onto your account. Accepting migrates your local data, retires the legacy passphrase requirement, and uses your account recovery phrase going forward. Declining keeps the legacy setup active for that session; Velnode re-offers on the next launch.

---

6. Sign in on a new device

1. Open velora://account and choose Sign in.
2. Enter your email address and password.
3. Velnode re-derives your Key Encryption Key from the password, fetches the encrypted data key from the account server, and unwraps it automatically.
4. The Account page shows your email address and plan. Velnode is signed in.

No extra codes or Recovery Kit entry is required for a normal sign-in on a new device.

Your Password Vault on the new device shows as Locked until you unlock it with your vault master passphrase — signing in does not do that for you.

---

7. Forgot your password

If you cannot remember your password:

1. Go to velora://account → Sign in → Forgot password?
2. Enter your email address. If the account exists, Velnode sends a password-reset link. If you do not receive it within a few minutes, check your spam folder.
3. Click the link in the email. Velnode opens the account page with a "Set new password" form.
4. Enter and confirm your new password. Velnode sends the reset to the server. Your login is now restored. However, because the new password produces a different key, your account data encrypted under the old key cannot be unwrapped yet.
5. Enter your Recovery Kit. Velnode prompts you to type the 24 words from your Recovery Kit. This lets Velnode re-derive the key that unlocks the existing encrypted data and re-wrap it under your new password.
6. Click Restore and continue. Velnode re-wraps the data key and stores the new blob. Your new password now works everywhere.

After this process completes, your previous Recovery Kit is still valid as a backup. You can generate a new one from Settings → Account → Recovery Kit if you prefer.

---

8. Lost your Recovery Kit

If you have lost your Recovery Kit, and you still remember your password, your account and its encrypted data are safe — carry on as normal and consider generating a fresh Recovery Kit from Settings → Account → Recovery Kit.

If you have both forgotten your password and lost your Recovery Kit:

1. Use the forgot-password flow (section 7 above) to restore login.
2. When Velnode asks for the Recovery Kit, you will not be able to provide it.
3. Your login is restored, but your previously-encrypted account data cannot be unlocked. It remains on the server as encrypted ciphertext that neither you nor Dignity New Zealand Limited can decrypt.
4. Velnode generates a new data key for your account going forward.

This outcome — login restored, encrypted data lost — is the honest, unavoidable consequence of zero-knowledge encryption. There is no server-side backdoor, and Dignity New Zealand Limited cannot make an exception. If you generate a new Recovery Kit in future, keep it safe.

---

9. Sign out

Go to Settings → Account and choose Sign out, or open velora://account → Sign out.

Signing out:

• Deletes your session from the account server.
• Clears the cached data key from the OS secure storage on this device.
• Removes the session token from data/account.json.

Velnode remains fully functional after sign-out. Your local data — bookmarks, timeline, notes, vault — is unaffected.

---

10. Account settings

Open Settings → Account or velora://account to access:

Setting	What it does
Email address	Shown for reference.
Plan	Your current plan (Free).
Email verified	Confirmation that your email address has been verified.
View Recovery Kit	Generates a fresh Recovery Kit if you have lost the original. You will need to enter your current password.
Manage devices	Shows active sessions (devices where you are signed in). You can revoke any session from here.
Delete account	Permanently deletes your account and all server-side data within 30 days. Your local data is not affected.

Upgrade to Pro — not yet available; the in-app entry point shows "coming soon" with a notify-me option. Cloud sync itself is free for every account today, including 250 MB of end-to-end encrypted storage. A Velnode Pro subscription is planned for a future release and will be described in a supplement to these docs.

---

11. Troubleshooting

For account-specific issues, see Troubleshooting §10 (Account issues). For sync-specific questions, see FAQ (About account sync). For general help, e-mail [email protected] with the version number from the title bar (or ☰ → About Velnode).

---

12. Where to read next

• Getting Started — the broader first-run guide.
• FAQ — account and sync FAQ.
• How It Works §7 and §7a — the account and sync technical story in plain language.
• Privacy Policy §4.8 — what the account server stores.
• Architecture Overview §11a — the technical design.

---

Document maintained by Dignity New Zealand Limited. Questions: [email protected].