Data safety
Cumulus Planner was built around one rule: never silently lose a user's edit. Every architectural choice below exists in service of that rule.
Every change you make writes to a local SQLite database on your device before anything touches the cloud. If you lose network mid-edit, you lose nothing — the change is already saved locally. Cloud sync is the second step, run in the background whenever a connection is available.
When two devices modify the same month, Cumulus merges by individual slot (one task, one journal field, one objective) — not by the whole month container. The slot with the latest edit timestamp wins. You can't clobber someone else's edit on a shared view just by ticking a different box.
When you delete a plan, Cumulus doesn't erase the row — it writes a tombstone: 'this slot was deleted at time T.' Other devices read the tombstone and delete their copies to match. The tombstone lives for 60 days, enough runway for a device you only open on weekends to catch up. After 60 days, it's cleaned up locally.
If a device has been offline more than 15 days and still has unsynced local edits, Cumulus pauses before merging. A dialog appears with three choices: Pull from cloud, Push local, or Later. No merge happens until you choose. If the device is used regularly, you'll never see this dialog.
Once a day, Cumulus writes a full snapshot of your database to a local backup folder. The last 30 days are kept, oldest rotates out. You can create a manual snapshot at any time from Settings → Backups, and restore any snapshot in two clicks. The current state is itself snapshotted before restore, so there is no "undoable" step.
Export every task, routine, project, and journal entry to a single JSON file. Readable in any text editor. Your data is yours — if you ever leave Cumulus, you can take it with you.
Cumulus's cloud sync uses Supabase. Your database rows are encrypted in transit (HTTPS) and at rest (AWS KMS). Only your authenticated account can read your rows; row-level security policies enforce this at the database layer. Nothing in your plans is shared, analyzed, or sent to any third party. AI features (future) run on-request only, against the specific text you ask about.