Not as a policy. As a fact about the architecture.

Somewhere around midnight, you open the app after a week away. The passphrase field is blank. Your brain cycles through the obvious options, then the less obvious ones, then stops. In every other app you've used, this is a thirty-second problem. Click forgot password, check your inbox, set a new one. You're back. It works because the company is holding a key for you. Their server can reset your access because their server has a copy of what provides that access. Mune cannot do this. Not as a policy choice. As a fact about the architecture. If something in the system can let you back in without your passphrase, it can let me back in without your passphrase — and it can let anyone with my credentials back in without your passphrase. The minute that's true, the privacy claim becomes a line in a terms of service and not a property of the system.

So the first time you set a passphrase in Mune, you'll be shown 24 words. They're in a specific order. They look like a poem written by someone with a limited vocabulary and no interest in coherence. They are, mathematically, the only path back into your account if the passphrase is gone. The format is called a BIP39 mnemonic. It comes from cryptocurrency wallets — the closest working cousin to what Mune does: software that holds a key on your behalf and refuses to hand it to anyone, including itself. You'll probably never use them. Most people don't lose passphrases for things they open every day. The recovery key is for the bad version of that night. The phone in the river. The laptop wiped in a hurry. The week your brain decides it doesn't remember the thing you've typed a hundred times. Write them on paper. Somewhere you'd keep a passport. Not in any app on any device. They need to exist in exactly one place, and that place should be offline.

The friction is real. Asking someone to copy 24 words before they've written a single thing in the product is not a UX win. It's a tax. And I'm not going to tell you it isn't. The alternative is what every other product ships: a reset link, a database somewhere with access to your real key, a privacy promise that lives in one paragraph on a settings page. I built that version first. I shipped it. I ran it for two months while the front page said end-to-end encrypted. Then I rebuilt it. The 24 words are the reason that sentence is now accurate. They're a small chore. They're also the whole point.