Getting help.

Yes. Everything the app stores on your computer is encrypted. Not hidden, not password-protected — encrypted. Without your passphrase or recovery key it is unreadable to anyone, including us.

Most people picture a locked filing cabinet. That is the wrong picture, because a filing cabinet can be pried open and then someone reads your papers.

This is different. Your collection is stored as scrambled nonsense. Someone who takes your laptop, pulls the drive out and reads the raw file gets random characters. There is no lock to pick, because the information itself is scrambled.

Your passphrase is the only thing that unscrambles it.

You. That is the entire list.

Not us — there is no "us". No account, no server, no company holding a copy.

Not anyone on the internet. The app is built so it physically cannot make a network connection. Not "we promise not to" — the ability is switched off at the engine level.

Not someone using your unlocked laptop. The app locks itself, and locking throws away the key until you type your passphrase again.

Not Apple, not iCloud, not any backup service — unless you copy a file there yourself.

Whoever has it gets scrambled nonsense. Your watches, values, serial numbers, photos and documents are all inside the encrypted data, and it does not open without your passphrase.

This is the good case. Your computer is gone; your collection record is not exposed.

If you also lost your recovery key, your collection is gone. Permanently. Nobody can recover it — not you, not us, not anybody.

That sounds harsh, and it is the same fact that makes a stolen laptop survivable. Any back door that could let you back in could let someone else in too. So there isn't one. No email reset, no security questions, no support line.

It is what saves you if you forget your passphrase. Your collection has two independent ways in — your passphrase and this key — and either one opens it. That is its purpose: with the recovery key, a forgotten passphrase is an inconvenience. Without either one, it is over.

Yes, write it down. By hand, on paper. Put it where your important documents live — a safe, a safe-deposit box, with your attorney. Not in a note on the same laptop. Make TWO copies and keep them in separate places; one house fire should not cost you the collection.

There is deliberately no Print button. Printing does not go straight to paper: the operating system spools the job to disk first, so printing would leave your recovery key sitting unencrypted on the very computer it exists to protect — and office and network printers often keep a copy of the job on their own storage, which you cannot check or erase. Writing it out by hand avoids both, and outlasts them: this has to still be readable in twenty years, and printer ink fades.

Setup hides the key and asks you to type one block of it back before it will finish, so a key you meant to save but did not actually write down cannot slip past. Replacing it later goes through exactly the same steps, for the same reason.

It is shown once. You cannot RECOVER a recovery key you have lost — but while you can still get into your collection you can REPLACE it, which issues a new one and retires the old immediately: Data → Passphrase & recovery key → "Replace recovery key". It asks you to present either your passphrase or your current recovery key before anything is created, so it is a way to renew a key you still have (or one you think may have been seen), not a way back in after both credentials are gone.

Being unlocked is not enough on its own. Until v2.38.0 it was, and that was wrong: anyone at your unlocked laptop could mint themselves a working key while killing the one in your safe — and you would not find out until the day you needed it.

Yes, whenever you like. Data → Passphrase & recovery key → "Change your passphrase".

It asks you to confirm it is you first — with either your current passphrase or your recovery key. That is deliberate: being unlocked is not proof that you are the owner — an unattended laptop is enough — and because nobody can reset a passphrase here, someone changing it while you were away would not merely read your collection, they would close it permanently.

If you have forgotten the passphrase you are trying to replace, choose "Forgot passphrase? Use recovery key." in that dialog and enter your recovery key instead.

The change itself is instant. Your passphrase never encrypts your watches directly; it wraps the key that does. Changing it re-wraps that key and rewrites none of your data, so it takes the same moment whether you own three watches or three hundred.

Your recovery key is unaffected and keeps working. Your old passphrase stops working straight away.

It is worth acting on, and you will only be asked once.

The strength check runs when a passphrase is set. If yours was chosen in an older version, before that check existed, it was never measured — so the first time it is measured is on an ordinary unlock, which is when you may see the message.

We do not ask you to change your passphrase on a schedule, and we never will. Forced expiry pushes people towards small edits of the same password, and here it carries a real risk: there is no reset, so a change made under protest and then forgotten costs you the collection. We would rather tell you once, plainly, when a passphrase actually measures as weak, and leave the decision with you.

Being straight about the limits:

• Malware running on your computer while your collection is unlocked. If something has taken over your computer while you are logged in, encryption at rest does not help.
• A passphrase written on a sticky note attached to the laptop.
• Someone watching you type it.
• You deleting your own data with no backup.

Encryption stops a file being read. It cannot stop the ordinary ways people lose things.

No, and you should not have to. You do not need to read a line of code to check it — open your computer's developer tools or a network monitor, use the app through a normal session, saving and exporting along the way, and watch your collection stay where it is. Nothing carries a watch, a value, a photograph or your passphrase anywhere. An app that asks you to take security on faith is not worth taking on faith, so we built the claim to be checkable at runtime, by anyone, in a few minutes.

Two things worth telling apart while you watch. Your COLLECTION is air-gapped — that is absolute, and it is what the monitor proves. The APPLICATION is a different question: bought from an app store, it may check with that store whether you own the paid unlock. That check carries none of your collection and cannot, because the part of the app holding your collection has no network access at all.

Five things. Most owners use two or three of them:

• Insurance documentation
• Knowing whether you are up or down, honestly
• Estate planning
• Tracking the hunt — grails and watches you are chasing
• Simply knowing what you own

If a watch is stolen or lost, your insurer asks what you had, what it was worth, and what proof you have. Guessing after the fact is a bad position.

The app prints a scheduled property inventory — every watch, reference, serial number, market value and insured value — to hand to an insurer or attach to a claim. It flags anything worth more than it is insured for.

You can also attach the actual paperwork: invoices, warranty cards, appraisals, all encrypted alongside the record.

Yes, and it keeps two numbers apart on purpose:

UNREALIZED

what your collection might be worth today, based on values you typed in. An estimate. Not money.

REALIZED

what actually happened when you sold. Sale price, minus selling fees, minus what the watch cost you to buy: the price, the duties and the shipping. Servicing is not in it. Servicing is a cost of owning a watch rather than of buying one, so it is shown separately, on the watch's own panel and in the disposition report.

Both figures are the plain arithmetic: what you paid, what it is worth or what you received, and — shown separately — what servicing has cost you.

There is no inflation-adjusted version of your gain, and that is a decision rather than an omission. The app carried one for a while. It was correct and it was useless: it did not change whether a watch was worth keeping, selling, insuring or servicing, and on anything bought recently it restated the same figure twice. A number that has to be explained before it can be used has not earned its place here.

Inflation is still used, on the watch rather than on you. A model that listed for $72 in 1968 is shown in today's money beside its current market value, because otherwise the comparison is between two different kinds of dollar. That is a fact about the watch. What your own money would be worth in a different year is a question for an accountant, not a collection register.

For dollars, from actual U.S. Consumer Price Index data — the Bureau of Labor Statistics series CUUR0000SA0 — annual averages from 1913 to 2025, plus the most recent published month as the point everything converts to. The note under each figure names both ends, so you can check the arithmetic against any CPI table.

Every dollar figure on a watch converts to that same point. That matters more than it sounds: a launch price converts to the same point whichever year it came from, so the historical figures on two different watches can be read against each other, which is the one thing a valuation panel exists to let you do.

For the other currencies the app uses a stated long-run average and says "estimate" beside it. That is not laziness: the euro did not exist before 1999 and Singapore's index does not run to 1950, so a table claiming to reach back that far would be a reconstruction presented as a measurement.

A single average was used for dollars too until it became clear that no single rate can be right about more than one era. Measured against real CPI, 1950 to 2025 compounds at 3.5% a year, 2007 to 2025 ran at 2.5%, and 2020 to 2025 at 4.5%. A rate that fits a watch bought in 2007 understates a 1953 watch by half.

Figures are stamped with the year of the data, not "today" — "in 2025 money" rather than "in today's money". When a copy of this app is a few years old, that label stays honest instead of quietly aging into a wrong claim.

One limitation worth stating: CPI measures a general basket of consumer goods. It answers "what would that money buy now", never "what did watches do". The second question is what market value is for, and only you can answer it.

The unglamorous part. If something happens to you, whoever handles your affairs needs to know what these watches are, what they are worth, which go to a named person and which can be sold.

The estate register prints exactly that, grouped by your instructions.

Yes. Mark a watch as "Seeking" and it sits in your collection as part of the hunt — but it is excluded from every financial total and from both printed documents, because you do not own it.

When you buy it, enter the purchase price or date and the app converts it to Owned automatically.

Because everything it stores is encrypted, and that passphrase is the key. There is no "set this up later" — later would mean storing your collection unprotected in the meantime.

Use the "Generate a strong passphrase" button unless you have a reason not to. It gives you seven ordinary words — something along the lines of metal-digit-tape-singer-punch-panel-white. That is far harder to guess than the usual name-and-year with a symbol stuck on each end, and far easier to remember than a jumble of characters.

If you would rather type your own, the app scores it as you go and turns down the genuinely weak ones. Since nobody can reset it for you, that check is the only chance to catch a poor choice before it matters.

Yes. Either bring your own sheet or start from the template.

Data → Advanced — bulk import & export → "Download watch template (.xlsx)" gives you an .xlsx with the seventeen columns it reads and one example row to replace. Every column is formatted as text, so a reference or serial number beginning with a zero keeps it. Leave the header row as it is; blank cells are fine, and only Brand or Model is required.

Data → Advanced — bulk import & export → "Import watches (.xlsx, .csv)" reads .xlsx and .csv alike — there is no need to convert anything. Before a single row is imported it shows you every column in your file, which field it will go into, any column it did not recognize, and how many watches will be updated versus added.

IMPORTING YOUR OWN EXPORT DOES NOT DUPLICATE IT. The last column, "Watch ID", is how a row is recognized as a watch you already hold. Export your collection, change some prices in a spreadsheet, import it back, and those watches are updated rather than added a second time.

An update only changes the seventeen columns in the sheet, and changing a sale date or price can also change a watch's status. Photographs, documents, service history and everything else on the record are left exactly as they were — so correcting a price in a spreadsheet cannot cost you a warranty card.

A row with no Watch ID is added as a new watch. That is what the blank template is for, and what happens to rows you type yourself. If you delete the Watch ID column from an export and import it back, you WILL get a second copy of everything — the app says so in the preview when it sees rows whose serial you already hold.

One caution if you are using .csv rather than the template: spreadsheet programs drop a leading zero from a number as you type it, so a reference of 0123 becomes 123 in your file before this app ever sees it. Use the .xlsx template and that cannot happen.

No. Maker and model are enough to save a watch. Everything else can be added whenever you get to it.

The fields that matter most for insurance are serial number, market value and scheduled (insured) value.

They answer three different questions, and a watch can be all three at once:

PERSONAL RATING

how much do I love this? (the 1-5 stars)

GRAIL

is this one of the ones I chased?

IF ASKED TO SELL

would I let this one go: Open to offers, or For sale?

Why they are separate: a watch that has appreciated past what you would pay today can be five stars, a grail, and for sale all at the same time. One combined field could not say that.

"If asked to sell" is left blank on most watches, and blank is the answer, not a gap — it means the watch is not for sale. The field is there to mark the exception, so you only fill it in for the few watches that could actually leave.

Grail is one you are evaluating, or one you chased and landed.

Holy grail is the unattainable one — the someday watch.

A watch you do not own yet, but are hunting or evaluating.

It shows in your collection with a SEEKING tag, but never appears in a money total, an insurance schedule or an estate register. It is a placeholder for the hunt, not an asset.

"For sale", under "If asked to sell", is an intention. You still own it, and it is still counted in your collection.

Status "Sold" is a fact. It is gone, it leaves your held totals, and it moves into your realized profit and loss.

On purpose, and it tells you when it happens.

Enter a sale date or price and it marks the watch Sold. Enter loss details and it marks it Lost. Enter purchase details on a Seeking watch and it marks it Owned.

Without this, a watch you had clearly sold would still be counted in your market value, cost basis and insurance coverage — making every total wrong with nothing on screen to warn you.

Because it counts what the watch really cost you to buy, not just the price on the invoice. Selling fees come off the sale, and duties and shipping go on to the purchase.

Worked example: a watch bought for $4,000, with $110 of duty and $40 of shipping, sold for $6,500 with $780 in fees. Against the sticker price that looks like a $2,500 win. Sold or lost says $1,570, because the fees come off and the cost of getting the watch to you goes on.

Servicing is not in that number. Two services at $1,950 turn the $1,570 into a $380 loss — and that after-servicing figure is the one to trust for "did I do well on this watch". It is shown on the watch's own panel and in the disposition report, beside the figure above.

Replacing it would cost more than what your policy would pay out. The gap is what you would have to absorb yourself.

The app measures against Replacement cost where you have entered one, and falls back to Market value where you have not. Q51 explains why those are two different numbers.

Yes, but you have to tell it. Set the "Provider or policy type" and "Coverage limit" fields under Market value & insurance.

Some specialist policies pay above the scheduled value — 150% is a common figure. Without that setting, the app assumes you are covered only for the scheduled figure and will warn you about gaps that do not exist.

It cuts the other way too. A standard homeowner's policy usually caps a single watch far below its value unless individually scheduled. Record that honestly and the app will tell you the truth.

Set its status to Stolen and fill in the Loss & claim section: the date, police report number, claim number, and what the insurer actually paid you.

Damaged / destroyed and Lost are separate statuses alongside it, so your collection records what actually happened rather than filing all three under one word.

The settlement is treated as proceeds, exactly like a sale price, so the claim appears properly in your realized profit and loss. The disposition report labels it as an insurance claim rather than a sale.

PHOTOS are wrist shots and reference images. They are automatically shrunk so a page of twenty watches does not choke. Click any photo to see it full size, with a "Save full size" button.

DOCUMENTS are evidence — invoices, warranty cards, appraisals. Images or PDFs, stored exactly as you gave them, never compressed, because the fine print matters. They appear as a list on the watch's detail panel; click one to save the original file.

Use Documents for anything you might have to show an insurer.

Two steps:

1. Insurance & Sales → Insurance & Warranty, then one of the three "Insurance schedule" buttons: all watches, insured only, or not insured. All three open the document for you — that is the document itself, not a PDF yet. It is not saved to Downloads: an unencrypted schedule sitting there is exactly what cloud backup tools copy off the machine, so it goes to a temporary folder instead.
2. When it opens, press Cmd-P (Ctrl-P on Windows) and choose "Save as PDF" from the PDF menu at the bottom-left (Windows: choose "Microsoft Print to PDF" as the printer).

The three versions exist because this document is meant to be handed to an insurance agent, and "insured only" or "not insured" lets you do that without showing them the size of your whole collection. "Insured only" is a confirm-what's-covered document; "not insured" is a get-quotes-on-these document, without revealing what's already covered elsewhere.

The app explains this on screen when you save the document.

Because it has no way to. The window this app draws in cannot print, and it has no engine for making a PDF, so the last step has to happen somewhere that does — your browser.

What the app can do, and now does, is write the document out and open it for you, so all that is left is the keystroke. It writes to a temporary folder rather than Downloads, because an unencrypted schedule sitting in Downloads is exactly what cloud backup software copies off the machine.

It is this app turning one watch's record into something you would actually want to read — and, if you like, print and keep.

Open a watch, and next to its name at the top you will see "Open folio". It opens the watch on a page of its own: the photograph first, then how you came by it, what it is, how original it is, how it is running, the rest of your photographs, and — if you wrote one — your own note about why it matters to you. Anything you have not recorded is left out rather than printed empty, so a watch you know little about produces a shorter page, not a page full of blanks.

The panel behind it is the record: every field, including what you paid. The folio is the document made from it, which is a different thing and deliberately holds less.

It opens in your browser, ready to print or save as a PDF. Press Cmd-P (Ctrl-P on Windows) and choose "Save as PDF".

Yes — it was written for that. It is the one document here meant for you and for whoever inherits the collection, rather than for an insurer or a buyer.

What it never contains: what you paid, what it is worth now, what it is insured for, who insures it, your policy number, what you sold it for, the case or movement serial number, and the access code for wherever it is kept. None of that is a setting you can switch on. The document was built without them because it has no gate in front of it — unlike the sales dossier, it does not ask who is about to receive it.

It also claims nothing on your behalf. There is no certificate, no authentication, no guarantee. Where it reports originality, it is printing the assessment you recorded; where it reports how the watch is running, it is reading your own timing entries. Nothing in it was issued by a manufacturer or an appraiser, and it does not pretend otherwise.

To print it: it opens in your browser, so press Cmd-P (Ctrl-P on Windows). Untick "Headers and footers" in the print dialog first, or your browser stamps its own date, page numbers and the file path onto every page.

Yes. Archive → Collection folio. Tick the watches you want, give it a title, and it renders them as one document with a title page.

Tick them however suits the collection you have in mind. The list groups by category, by disposition, by complication or by rotation, whichever you pick, and each group has a select-all — so "the ones I have marked to keep in the family" is two clicks, and so is "my divers". "Show" narrows the list to one of those answers when a long collection makes the groups hard to see. They appear in whatever order the collection is listing them, so sorting the list behind the panel sorts the book.

Only watches you still hold are offered. A folio describes the collection as it stands, so anything sold, given away, lost or still being hunted is left out. A watch with no answer on the axis you are grouping by is not listed either — group by disposition and you see the watches that have one — and the panel says how many that leaves out.

There are two depths. "A page each" gives the photograph, the name, the year and whatever you put in "Why this watch matters to you" — the last field on a watch — and nothing else. Leave that field empty and the page is a photograph and a name, which the panel tells you before it builds the book. It is not the same as Notes, and Notes is never printed. "The whole folio for every watch" gives each one its full page — history, specification, photographs. The first is the default because this document is meant to be handed to somebody, and a specification table between two photographs changes the subject.

Nothing is saved. There is no list of your collections to manage, and naming one does not create anything inside the app. The document you save is the collection — which is the point: it opens on any computer, needs nothing of ours, and cannot fall out of step with a collection that changed after you made it.

It withholds more than a single-watch folio does, on purpose. No purchase price, no current or insured value, no serial numbers — and also nothing about where a watch is kept, what you have decided should happen to it, or who inherits it. A folio about one watch is read by you or your executor, so it names those. A collection is made to be handed to another collector, who should not learn your succession plan along with the photographs.

One figure does appear in the fuller depth, where you recorded it: what the model cost at launch. That is a published fact about the watch rather than anything about you.

A sample watch appears in a collection folio exactly as your own watches do, because it counts exactly as they do. Opening a single-watch folio on one is the easiest way to see what a folio looks like before you have written one of your own, and removing the sample collection removes them from every figure and every document at once.

No. Your collection lives on this computer only. Moving it to another computer means exporting an encrypted vault file and taking it there yourself.

This is by design. Sync requires either:

1. A server holding the master copy (which we reject — our product is that nothing of yours sits on somebody else's server), or
2. Resolved changes across devices (which breaks the air-gap, requires a server for conflict resolution).

So we chose: no sync, which means you own the only copy, encrypted and offline. The trade is you cannot access from multiple devices without moving files around. Most collectors do that once or twice a year, not constantly.

But my Mac or PC syncs folders on its own. Does that pull in my collection?

No — and this is checkable rather than something you have to take on trust. Your collection is stored in the application's own data folder:

macOS~/Library/Application Support/app.watchvaultarchive.desktop/

Windows%APPDATA%\app.watchvaultarchive.desktop\

The folder-sync features built into both desktop systems are scoped to a fixed, published set of folders, and neither path above is in it:

• Apple's iCloud Drive "Desktop & Documents Folders" covers exactly ~/Desktop and ~/Documents. Nothing else, and nothing anywhere under ~/Library.
• Microsoft's OneDrive "Known Folder Move" covers Desktop, Documents and Pictures. Microsoft's own documentation states the folder set cannot be extended by Group Policy.

Neither reaches the collection, and neither can be configured to. Both vendors document their own scope; links are below.

Three honest caveats, because the picture is not "nothing can ever leave":

1. Files you EXPORT are the case that actually matters. They go to your Downloads folder, and people naturally move backups into Documents — which is covered. An encrypted vault file is fine there; it is unreadable without your passphrase or recovery key wherever it lands. A plain JSON export is readable by anyone who opens it. The app asks you to acknowledge this before writing that file.
2. Whole-disk backup tools (Backblaze, CrashPlan, Carbonite and the like) work on a different principle: they copy everything on the drive except an exclusion list, so they DO capture the collection file. What they capture is ciphertext — useless without your passphrase or recovery key. That is exactly why the collection is encrypted at rest rather than merely kept somewhere out of the way.
3. On Windows the path above is the roaming profile directory. That is untouched by OneDrive, but on a computer joined to a corporate domain, classic Windows roaming profiles can copy it to a company server at sign-in and sign-out. If this is a managed work computer, assume your employer's tooling can reach the file — still as ciphertext, but worth knowing.

Verify rather than take our word for it:

Apple https://support.apple.com/en-us/109344

Microsoft https://learn.microsoft.com/en-us/sharepoint/redirect-known-folders

No. Market values are what you type in. A price feed would require a network connection, and this app does not make network connections.

Really. See "What if I forget my passphrase?" above. It is a deliberate feature, not a missing one.

No. The app produces an accurate record of what you paid and what you got back. What that means for your taxes is a conversation with your accountant — collectibles are often treated differently from other assets.

Watch Vault Archive is deliberately desktop-only, for reasons built into the product, not limitations we're working around.

A watch collection is something you review occasionally — a few times a year — to check provenance, look up documentation, confirm insurance coverage, or plan for sale or inheritance. That use case is not "check my phone constantly" — it's "sit down at my computer for an hour and manage the details."

A mobile app designed for that would be a different product: frequent access, summaries instead of full records, cloud sync so you can check one watch detail from anywhere.

The privacy trade-off makes sense for this product *because* you are sitting at your computer. It does not make sense for a mobile app, because mobile sync requires one of:

• A server holding your master copy (breaks our core promise)
• Cloud sync with conflict resolution (breaks the air-gap)
• Local-only mode on each device (defeats the point of mobile)

If we built a mobile app under the same security model, it would be separate data silos: phone has this version, computer has that version, no way to reconcile without leaving the device or trusting a server.

A proper mobile experience requires compromising on the architecture. Rather than do that, we are building this as a desktop application that does one thing properly: manage a complete, secure, offline record of a physical collection.

If you want a mobile app to look up a specific watch (serial, insurance, photos), that is a different product category and may happen later — but it would be separate, with its own storage and sync, not a mobile version of Watch Vault Archive.

Stop. Do not create a new passphrase — that starts a fresh empty collection.

Your collection lives in the application's own data folder, not inside the app itself, so moving the app or reinstalling it does not remove your collection. If you are being asked to set a new passphrase, the app is not finding that folder — most often because you are signed in to a different user account on the computer, or because a restore or a migration to a new computer skipped it.

Check you are in the same user account you set it up in. If your collection was created on another computer, it is still there: finish setup on this one, then bring it across from your encrypted backup file. The last setup screen offers "Restore from a backup" beside the sample and empty-collection choices, and it is always available afterwards at Data → Your backup → "Restore from a backup". Setting up here does not touch a collection kept anywhere else.

The setup screen offers this same guidance — "Already have a collection?", under the Continue button.

Your data has not been deleted. The app is not finding it.

On the lock screen, choose "Use recovery key instead" and enter the recovery key from setup. Capitals, spaces and dashes do not matter.

Once you are in, set a new passphrase you will remember: Data → Passphrase & recovery key → "Change your passphrase". It asks you to confirm it is you: choose "Forgot passphrase? Use recovery key." and enter the same key again. The passphrase you have forgotten is not needed at any point. Your recovery key keeps working afterwards, unchanged.

If you have neither, see "What if I forget my passphrase?" above. There is genuinely nothing that can be done.

Data → Your backup → "Save an encrypted backup". That produces a single encrypted file holding everything: watches, photos, documents, owner details.

Keep it somewhere other than this laptop. It is encrypted, so a USB stick or a cloud drive is fine — without the passphrase or the recovery key it is unreadable to whoever holds it. Either one opens a backup, so an executor holding only the printed recovery key can restore everything.

Two things worth doing:

• Store the vault file and your recovery key in different places. Together in one folder means a single loss takes both.
• Back up again after any significant change. The last backup is the only one that counts.

Use the encrypted vault for this, not "Export full archive (.json)". The plain export exists for moving data into another tool, and it is readable by anyone who opens it — including anything that syncs or backs up the folder you leave it in. The encrypted vault is the one that is safe to put on a cloud drive. See "Does it sync to my phone or to the cloud?" above.

Usually yes — but read the next paragraph first, because the commonest reason people go looking for this is not actually this.

THIS IS PROBABLY NOT YOUR PROBLEM IF: the app opened and your watches are missing, or it opened empty, with no message on screen. That combination does not happen on its own — a real problem shows itself, with a dialog naming what went wrong. If nothing was shown, look again before assuming data is gone; only use the steps below if a save genuinely wrote the wrong thing.

How it works: every time the app saves, it renames the file it is about to replace to "register.vault.prev" and writes the new one beside it. So the version from immediately before your last save is still on disk.

To go back one step, you need the folder your collection lives in. Open Data and press "Check the file on this computer" — the dialog it opens names the exact file. Quit the app first, then, in that folder:

1. Rename "register.vault" to "register.vault.bad".
2. Rename "register.vault.prev" to "register.vault".
3. Open the app.

Step 1 is what makes this reversible: if the older version turns out to be the wrong one, rename the two files back and you are where you started. Keep the .bad file until you are certain, then delete it.

Do it in that order. Do NOT delete "register.vault" instead of renaming it, and do not drag "register.vault.prev" straight over the top of it — on most systems that replaces the current file with no warning, which is the one mistake this procedure exists to avoid.

Only ONE previous version is kept — the next save replaces it. This is a safety net for a save that went wrong, not a version history, and it is no substitute for exporting encrypted vault files you keep somewhere else.

Two things worth knowing:

• It is encrypted exactly like the live file, with the same passphrase. It is not a plaintext copy and it is no weaker than the collection itself.
• Erasing your collection removes it too. That is deliberate: an erase that quietly left a complete copy behind would make "erase" meaningless.

No, and it only happens once. An earlier version stored full-size camera images, which made the app slow. It is shrinking them for display. Files you attached under Documents are untouched.

Watch Vault Archive is published by Aveneg Technologies, LLC.

It was built for collectors who could not find anything that handled provenance, insurance schedules and estate records properly, which is why it does the unglamorous things well and none of the flashy things at all.

For bugs, questions or suggestions, email support@watchvaultarchive.com.

For anything commercial, see the next question.

Watch Vault Archive is commercially licensed software: a paid licence per user, covering personal use for tracking your own collection.

Using it inside a dealership or auction house, bundling it with a product or service, or anything at volume beyond individual use, is a separate conversation. Email legal@watchvaultarchive.com and say what you have in mind.

While the sample watches are loaded, yes — it counts exactly like a watch you entered yourself. Once you add a watch of your own, the samples are gone and nothing fictional is left in your figures.

It is the first of the sample watches: a fictional record — an "Aveneg Meridian" — with every field filled in, so you can see what a finished entry looks like without having to guess. Aveneg is not a watch manufacturer and the Meridian is not a real model; every figure in it is invented.

While they are loaded, the samples are included in the held count, market value, cost basis and profit figures, in the insurance schedule and the estate register, and in every export. Earlier versions held the fictional record apart from all of those, and that was the wrong choice: a watch visible on screen but missing from the total underneath it makes the total impossible to trust. It is labeled instead — COMPLETE EXAMPLE in the watch list and again at the top of its detail panel — so any figure you do not recognize can be traced back to it.

Sample watches cannot be edited. They are there to be read rather than filled in, which is what makes the next part safe.

The moment you save your first watch of your own, the app asks once whether to clear the samples. Choose "Save & Clear Demos" and they go as that watch is saved; choose Cancel and nothing is saved yet. It asks because a collection holding your watches alongside fictional ones produces figures that are part invention — and because samples disappearing unannounced is worse than a question. You are asked only that once, on the first watch. From then on your totals describe only what you entered.

Importing your own watches clears them too. That one is not a second question — the confirmation you approve before the import says the samples will go, so it is part of what you are agreeing to rather than something that happens afterwards.

The complete example itself stays available. "See a complete record" in Data opens it whenever you want, as something to look at: it is shown rather than added, so it never joins your collection and never reaches your totals, your insurance schedule or any document you generate.

That the example fills every field is enforced by an automated check that runs before every release, so it cannot quietly fall behind as new fields are added.

Insurance & Sales → Sales & Disposition → "Sales dossier". Pick the watch, pick how much to disclose, and you get a zip file to send.

Three levels, because trust rises through a sale and disclosure should rise with it:

LISTING

a public copy for eBay or Chrono24. Specifications and photographs only. No serial numbers, no documents, and nothing you recorded about this watch's own condition.

INTERESTED BUYER

for someone asking real questions. Adds partial serial numbers, service and pressure-test history, warranty terms, your notes on replaced parts, and any documents you tick.

SALE / HANDOVER

for the person actually buying it. Full serial numbers, every document you tick, and the rest of what the record holds: timing results, prior owners and the provenance you wrote.

A watch carries two numbers, and they are treated alike. The case number is stamped outside; the movement number is stamped on the movement itself and is usually the one that dates the watch. Either one identifies your watch to a stranger, so publishing one while withholding the other would furnish a cloned listing just as well. Both follow the same rule at every level above.

What is NEVER included, at any level: what you paid, either MSRP figure, your replacement cost, your insured value, your insurer or policy number, your deductible, your appraiser, where you keep the watch, your private notes, who you have left it to in your will, and any loss or claim history.

Two of your own written fields are treated differently, and the difference is worth knowing. Notes never leaves, at any level. The provenance you wrote — where the watch came from and who had it — goes out in the sale/handover copy only, because by then it is part of what the new owner is being handed.

That list is not a setting you can switch off, and it is not a filter applied at the end. The dossier is built from a list of fields that are allowed OUT. A field reaches a buyer because it is named on that list. Adding a new field to the app does not add it to a dossier.

Two things worth knowing:

DOCUMENTS ARE TICKED ONE BY ONE. There is deliberately no "attach everything" button. Hiding the serial in the summary achieves nothing if the warranty card you attached alongside it shows the serial in full, and only you know which of your documents shows what.

PHOTOGRAPHS OF DOCUMENTS ARE CLEANED ON THE WAY OUT. A photo taken on a phone carries hidden information — where it was taken, when, and on what camera. Sent to a stranger, that can say where your collection is kept. Image documents are re-encoded when they go into a dossier, which removes it. The copy inside your collection is untouched. PDFs cannot be cleaned this way, so if you include one the app tells you so before it saves.

Before anything is written you get a summary naming the level, the serial treatment and the document count, and you have to confirm. Open the zip before you send it — what is inside is what the other person will see.

The timing log now records a full six-position bench test — dial up, dial down, crown up, crown down, 12 up, 6 up — instead of a single rate. Nothing about an existing entry changes: a reading you logged before this still shows exactly as it did, and editing it does not force you to fill in positions you never measured.

What the six numbers give you that one never could:

• AVERAGE RATE and AVERAGE AMPLITUDE are calculated only from the positions you actually filled in — leave two blank and the average is over four, not six.
• POSITIONAL SPREAD is the gap between your best and worst position, the number that actually tells you something is wrong: a watch can average a clean +2 s/d while swinging from +15 to -11 across positions, and the average alone hides exactly that. It only appears once two positions are entered — never shown as "0" for a single reading, because that would read as "measured six ways, perfectly consistent" when what really happened is "checked once."
• MAX BEAT ERROR is the worst position, not an average of all six — a beat error problem in one position is the one worth knowing about, and averaging it away would hide it.
• FLAT → VERTICAL shows how much amplitude drops from the two flat positions to the four vertical ones, once both are measured. That drop is the number a watchmaker actually reads off a timegrapher; the average alone throws it away.

LIFT ANGLE is recorded per reading, not just once on the watch, because a timegrapher does not measure amplitude directly — it calculates it from the lift angle you told it. If you correct the watch's lift angle later, older readings keep the value that was true when they were taken, so an old amplitude stays interpretable instead of silently meaning something different.

Enter one position fully — rate, amplitude, beat error — before moving to the next, rather than all six rates and then all six amplitudes. That matches how a timegrapher is actually used: reposition the watch once, read what it shows, move on.

Condition asks how worn a watch is. Originality asks how much of it is still the watch that left the factory — and on anything vintage that is usually the larger half of the value.

CASE is the big one. A case with its original sharp edges is worth substantially more than the same reference after a polish, because polishing removes metal permanently and softens the lines the factory cut. "Lightly polished" is the honest answer for most watches that have been serviced a few times.

DIAL separates a factory service dial from a redial. They are not the same event: a service replacement is documented and legitimate, while a third-party repaint is neither, and lumping them together would flatter the second. A redial can halve the value of an otherwise good watch.

HANDS treats "relumed" as its own answer, because the hands are still the originals — only the luminous material is new.

BEZEL INSERT and CRYSTAL ask whether the part is the one it was born with. For the crystal in particular, a replacement is ordinary maintenance and not a fault; almost every watch over twenty years old has had one.

MATCHING NUMBERS is the paperwork question: whether the case, the movement and the factory archive agree. On most modern watches it does not arise, which is what "Not applicable" is for.

UNKNOWN IS A REAL ANSWER, and it is the right one far more often than people expect. Unless you bought the watch new, or you have owned it its whole life, you cannot know whether a previous owner had the case polished in 1994. Every one of these fields starts blank and every one offers "Unknown" on purpose. Guessing turns something you do not know into a claim on a document a buyer or an insurer may later read, which is the opposite of what this collection is for. Leave it blank or say Unknown and you have lost nothing — blank fields are simply left out of the sales dossier.

Market value is what the watch would SELL for. Replacement cost is what an equivalent one would COST to buy. Those are different questions, and an insurance claim turns on the second.

They come apart in both directions. A steel sports model with a waiting list at the dealer might list at 11,800 and trade at 18,500 — list price is a number nobody can actually buy at, so replacing the watch really costs the secondary-market price. Run the other way, a watch bought at a discount and now trading below retail sells for less than it would cost to walk into a shop and buy another.

Only you can judge which applies, because it depends on whether you could realistically be sold one at list price. That is why Replacement cost is a field you fill in rather than a figure the app calculates.

Leave it blank on the watches where the two are about the same, which is most of them. Where it is filled in, the underinsured warning, the shortfall totals and the insurance schedule all measure your cover against it instead of against market value.

Market value is still what drives the collection's worth and unrealized gain, since those are resale questions. Replacement cost is used only for coverage.

Each figure carries its own date — Market value last checked for one, Replacement cost last checked for the other. They are separate on purpose: you might look up what a watch would sell for without re-checking what replacing it would cost, and the coverage warning tells you which of the two it used and how old that figure is.

Two different questions, deliberately side by side. Health is mechanical — what the readings and the interval say. Warranty is financial — who would pay for it.

HEALTH. A hollow green ring means nothing is due: the service interval has not run out. It is not a claim that the watch runs well, because nobody has timed it. A filled green mark is the stronger statement — it was put on a timegrapher and read in spec, and the rate it read is shown beside it.

Amber means a reading has moved, or the rate is outside the standard you measured it against, or the interval is nearly up. Red means past the interval, or a reading outside the usual band.

The word beside the mark names which of the two it is. A maintenance schedule reads Due soon or Overdue; a measurement reads Borderline or Out of spec. Those four words mean the same thing everywhere in the app — in this column, in the watch record, in the form while you are editing, and on the printed service record.

Where a watch has never been serviced, the schedule counts from your purchase date and says so. You never need to record a service that did not happen in order to see when one is due; if there is no purchase date and no service date, the record tells you which one to add.

Amber also watches for decline. If the amplitude has fallen by fifteen percent or more across tests spanning eighteen months — with the latest reading the lowest of the series, below 285 degrees, and no service in between — the column says Borderline even though every individual reading still clears the absolute thresholds. A mainspring or oil going soft shows up as a slope long before it shows up as a bad number, and the tooltip prints both readings so you can judge the slope yourself.

The worst signal wins. A watch reading +1 s/d that is eight years past its interval is red, because degraded oil does not have to show up in the rate — a good reading is not evidence that the oil is still there.

Quartz watches are blank: there is no overhaul clock to run out. So are watches you no longer own.

WARRANTY. A hollow green ring while it is active. Amber and “Expiring” inside the last six months. Red for the final fortnight, which is when a free repair is about to become a paid one. Muted “Expired” once it has ended.

Expired is not the same as blank. Blank means you never recorded a warranty; Expired means there was one and it has run out, which is precisely when the watch stops being the brand's problem and can go to an independent watchmaker instead.

While it is still active, one thing is worth knowing. The dates here are counted from what you entered, not from the manufacturer's records. Some brands refuse warranty work if the watch has been opened or serviced outside their authorized network.

The watch's value was last checked more than two years ago, or carries no check date at all. A figure of unknown age is one you cannot stand behind either, so both count.

You set that date yourself, under Market value & insurance → Market value last checked. Enter the date you last looked the value up, even if it was years back.

Only watches you currently own appear here. Ones you have sold, gifted or lost never do, nor do watches you are still seeking, nor a watch with no market value recorded at all.

It tells you which figure the comparison used, and how old that figure is.

The app measures your cover against Replacement cost where you have entered one, and falls back to Market value where you have not. Those can be very different numbers, so the verdict names the one it actually used rather than leaving you to work it out.

The date is the one belonging to THAT figure, never the other one. If the comparison used replacement cost, the date shown is Replacement cost last checked — not the date you last looked up what the watch would sell for.

Where it reads "has no check date", the figure has never been dated. The arithmetic is still correct; you just have no way to tell whether it rests on something current or on something from years ago. Filling in the date is what clears it.

No. It is the same comparison as the underinsured one, stated in the other direction.

The underinsured verdict states how far your cover falls below that figure. This one states how far it sits above. Both are the same subtraction, and both are shown in ordinary text rather than a warning color.

The app has no idea whether cover above replacement cost is deliberate. Agreed-value policies, appreciating pieces and riders set high on purpose all look identical from here. Whether that gap is right is between you and your insurer — the app only puts the two figures you recorded side by side.

A policy of yours renews within sixty days. The line names the insurer, the date, how many watches are on that policy, and what they add up to — scheduled against replacement cost.

Renewal is usually the only point in the year when a scheduled value can be changed, so it is the one moment those two figures are worth reading together. Dismiss hides it until you next open the app; it is never dismissed permanently, because it only appears once a year.

If the watches on one policy carry different renewal dates, it says so rather than choosing one for you. The app cannot know which is right.

What your collection was made of, on any date it changed.

Group by Category or Brand, and measure by count, cost basis or market value. Count is what you collect. Cost basis is where your money went. Market value is where it is now. The timeline steps through the dates watches actually arrived or left, so every stop is a real change rather than an arbitrary month.

None of it is stored. It is read back from the purchase and disposal dates already on your watches, which means it can never disagree with them, and correcting an old purchase date corrects the history with it.

Two things worth knowing. Brands are grouped ignoring capitals and spacing so one stray keystroke does not split a maker in two, and the spelling shown is your own. And the market value view can only include watches whose value carries a date — an imported collection has none until you edit it — so it says how many are missing rather than quietly showing you a smaller collection.