Restoring an export

Settings → Data → Your data → Import a file. The restore merges into the account you are signed in as. It never creates an account and never changes who you are, so on a fresh instance you sign up first, with any email and password you like, and restore into that.

For the operator’s copy of the whole database, read Reloading a dump instead.

Both kinds of file go in through the same button. An encrypted file is recognised on sight and asks for its passphrase before anything is written; a wrong one is refused outright, with nothing restored, because the file authenticates itself before a single byte of it is read back. You never have a half-finished restore to clean up after.

Once it is done, the page shows which of the two kinds of file it received, one count per table, and under it every line the restore declined to write with the reason. Read that list: it is where an incomplete restore shows up.

Restoring the same file twice changes nothing. Every table is matched on a natural key before it is written, so a second restore reports zeroes. From a file gives the key of each table and what merging means, including for a file you wrote yourself.

If a restore is interrupted

A restore is not atomic. It writes table after table, in one long sequence rather than inside a single database transaction, so a browser closed halfway, a container restarted or a connection cut leaves the account in an intermediate state: some tables back, some not, and no error page to tell you which.

To recover, import the same file again. That is enough, for the same reason a second restore of a complete file reports zeroes. Every row is matched on a natural key before it is written, never on a database id, so rows that landed the first time are recognised and skipped, and rows that never landed are written. It is the same code path either way, so there is no special recovery mode to get wrong.

Read the counts the second run shows: they are what the interrupted run had not yet written.

Danger

Do not restore a different file in the hope of filling the gap. The two would merge rather than replace, and you would be reading a mix of two backups.

API keys and the second factor

An export holds no API key and no second factor, so neither comes back. Issue new keys, and enrol your authenticator app again; the old entry still shows codes, but nothing checks them any more.

The letter to your family comes back, but not its relay: a file must not send a letter on by itself, so the relay is set up again under Settings → Hand-over, with your password and a fresh confirmation from your relative.

Secrets from an encrypted file are re-encrypted under the SECRET_ENCRYPTION_KEY of the instance doing the restoring, which is why a sealed backup opens on a machine that never saw the old key.