> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloak.ag/llms.txt
> Use this file to discover all available pages before exploring further.

# Your private balance and backup file

> The three concepts behind Cloak custody — private balance, UTXOs, and the backup file that recovers them

Cloak can't see your balance, can't spend it, and can't recover it. That's the design. It also means recovery works differently from anything with a server behind it — and three terms explain all of it.

## Three terms

<CardGroup cols={3}>
  <Card title="Private balance" icon="wallet">
    Your shielded funds, held as encrypted UTXOs on your device — Cloak's servers never hold them, and there is no cloud sync.
  </Card>

  <Card title="UTXOs" icon="cube">
    The private notes inside your balance. Each shielded deposit and each payment you receive becomes a UTXO — a unit of value only you can spend.
  </Card>

  <Card title="Backup file" icon="file-shield">
    A JSON file you download from Backup & Restore. It is the recovery artifact — the one thing that can rebuild your private balance on another device.
  </Card>
</CardGroup>

Under the hood, each UTXO is a commitment in an on-chain Merkle tree, spendable only with secrets held on your device — and that is all the cryptography this page needs.

## Your backup file is the money

The backup file is a bearer instrument. Anyone holding it can restore your balance on their own device and withdraw — no wallet check or identity check stands in the way. Treat it like cash: store it somewhere you would trust with cash (a password manager or an encrypted drive), and never send it to anyone. Cloak will never ask for it.

It is also a point-in-time snapshot. UTXOs created after you exported it — new deposits, payments received — are not in the old file. Re-export after new activity.

<Tip>
  Make a fresh backup part of the routine: shield, send, receive — then re-export the file.
</Tip>

## Your wallet is not a recovery phrase

Everywhere else on Solana, the wallet seed is the master key. Cloak breaks that expectation in both directions.

**Your wallet does not restore your balance.** Connecting the same wallet on a new device does not bring your private balance back. The wallet signature is used for sign-in and local encryption only — it is not a recovery root. On a new device, the backup file is what restores funds.

**Losing your wallet does not lose your funds.** If your browser data or your backup file survives, your shielded funds survive too: any connected wallet can spend restored UTXOs. What goes with the old wallet is its [viewing key](/guide/compliance) — read-only access to the compliance history of your old activity, not the funds themselves.

## What loss actually looks like

| You lost                                                 | You still have                | Outcome                                                         |
| -------------------------------------------------------- | ----------------------------- | --------------------------------------------------------------- |
| Browser data (cleared or device gone)                    | No backup file                | Balance gone, permanently                                       |
| Your wallet                                              | Browser data or a backup file | Funds safe — restore if needed, spend with any connected wallet |
| Exclusive control of your backup file (leaked or stolen) | —                             | Whoever has the file can take the funds                         |

The first row deserves the plain version: if you clear your browser data with no backup file, your private balance is gone. Not seized — gone. Cloak cannot recover it, and neither can anyone else. That's not a limitation of our support team; it's the proof that we never had your funds.

## Restoring a balance

Two paths, same result:

* **New device, first visit** — the onboarding flow offers "I already have a backup, restore my balance." Import your file there.
* **Existing session** — open **Backup & Restore** in the sidebar and choose **Import backup**.

On import, Cloak checks every UTXO against the chain and prunes anything already spent, so an older file restores cleanly — you get exactly the UTXOs that are still unspent. Then connect a wallet and use the balance as normal.

## Payment links are not in your backup file

A [payment link](/guide/payment-links) carries its own secrets in the URL. Treat this link like cash — anyone who has it can claim the funds. Because the secret lives in the link itself, links are never part of your backup file; a lost, unclaimed link is only recoverable from the sender's live browser.

## Where next

<CardGroup cols={2}>
  <Card title="Security and threat model" icon="shield-halved" href="/guide/security">
    What Cloak cannot do, on-chain protections, and who can see what.
  </Card>

  <Card title="FAQ" icon="circle-question" href="/guide/faq">
    Straight answers on custody, recovery, and fees.
  </Card>
</CardGroup>