definitely do your own research on security! quick answers: - data is stored in your browser's local storage, in a local database. - if you are using sync (either the hosted version or running your own server) the app syncs the encrypted bullets and metadata to a server. updates are pushed out to all devices, the data is decrypted on the device, in the browser. - if you're not using sync, you _would_ lose all your data if the browser cleared its data. there's an "export" button in the settings that dumps your entire database as .json in a way that it can be "imported" back again later.