Getting help.

Yes. Your collection, its photographs and its documents are encrypted on your computer. Not hidden, not password-protected — encrypted. Without your passphrase or recovery key they are unreadable to anyone, including us. Two things are not encrypted: your settings and the error log, which hold no collection. And a document you print waits unencrypted in the app's own temporary folder, so your browser can open it, until you quit the app or it next starts.

Most people picture a locked filing cabinet. That is the wrong picture, because a filing cabinet can be pried open and then someone reads your papers.

This is different. Your collection is stored as scrambled nonsense. Someone who takes your laptop, pulls the drive out and reads the raw file gets random characters. There is no lock to pick, because the information itself is scrambled.

Your passphrase is the only thing that unscrambles it.

You. That is the entire list.

Not us — there is no "us". No cloud account, no server, no company holding a copy.

Not anyone on the internet. The app is built so it cannot make a network connection. Not "we promise not to" — the ability is switched off at the engine level, for every kind of request and for the window itself.

Not someone using your unlocked laptop. The app locks when you press Lock, and by itself after the idle time you choose in Settings (unless you set it to Never). Locking throws away the key until you type your passphrase again.

Not Apple, not iCloud, not any backup service — unless you copy a file there yourself, choose a folder there for automatic backups, or a backup of your whole computer (Time Machine, for example) copies it along with everything else. A backup goes there encrypted either way.

Whoever has it gets scrambled nonsense. Your watches, values, serial numbers, photos and documents are all inside the encrypted data, and it does not open without your passphrase.

This is the good case. Your computer is gone; your collection record is not exposed.

If you also lost your recovery key, your collection is gone. Permanently. Nobody can recover it — not you, not us, not anybody.

That sounds harsh, and it is the same fact that makes a stolen laptop survivable. Any back door that could let you back in could let someone else in too. So there isn't one. No email reset, no security questions, no support line.

It is what saves you if you forget your passphrase. Your collection has two independent ways in — your passphrase and this key — and either one opens it. That is its purpose: with the recovery key, a forgotten passphrase is an inconvenience. Without either one, it is over.

Yes, write it down. By hand, on paper. Put it where your important documents live — a safe, a safe-deposit box, with your attorney. Not in a note on the same laptop. Make TWO copies and keep them in separate places, so that if one is lost or destroyed the other can still unlock an encrypted backup. The key opens a backup; it is the backup that holds the collection.

Can I keep it in a password manager as well? Yes. When Watch Vault Archive shows your recovery key, "Optional — save a digital copy" lets you copy it into the password manager you already use. Watch Vault Archive does not upload or store that copy. It is for your own recovery: keep your sealed written copy as well, because password-manager access may not pass to the person handling your estate. If you replace your recovery key, update the password-manager entry and save new encrypted backups, and keep the previous key until you no longer need any backups made with it. (How the copy is handled on the clipboard is in the Security Overview.)

There is deliberately no Print button. Printing does not go straight to paper: the operating system spools the job to disk first, so printing would leave your recovery key sitting unencrypted on the very computer it exists to protect — and office and network printers often keep a copy of the job on their own storage, which you cannot check or erase. Writing it out by hand avoids both, and outlasts them: this has to still be readable in twenty years, and printer ink fades.

Setup hides the key and asks you to type one block of it back before it will finish, so a key you meant to save but did not actually write down cannot slip past. Replacing it later goes through exactly the same steps, for the same reason.

It is shown during setup. You cannot RECOVER a recovery key you have lost — but while you can still get into your collection you can REPLACE it, which issues a new one: Settings → Passphrase & recovery key → "Replace recovery key". From then on the app no longer accepts the old key, but backups saved before the change, and the earlier versions kept on this computer, still open with it, or with the passphrase you had then. Only the lock around the key that encrypts your watches changes, not the key itself, so the old key together with one of those earlier copies can also read copies made after the change. Keep the old key until you have replaced or intentionally removed those backups. Earlier versions can be deleted in Data → Earlier versions. It asks you to present either your passphrase or your current recovery key before anything is created, so it is a way to renew a key you still have (or one you think may have been seen), not a way back in after both credentials are gone.

Being unlocked is not enough on its own. It once was, and that was wrong: anyone at your unlocked laptop could mint themselves a working key while killing the one in your safe — and you would not find out until the day you needed it.

Yes, whenever you like. Settings → Passphrase & recovery key → "Change your passphrase".

It asks you to confirm it is you first — with either your current passphrase or your recovery key. That is deliberate: being unlocked is not proof that you are the owner — an unattended laptop is enough — and because nobody can reset a passphrase here, someone changing it while you were away would not merely read your collection, they would close it permanently.

If you have forgotten the passphrase you are trying to replace, choose "Forgot passphrase? Use recovery key." in that dialog and enter your recovery key instead.

The change itself is instant. Your passphrase never encrypts your watches directly; it wraps the key that does. Changing it re-wraps that key and rewrites none of your data, so it takes the same moment whether you own three watches or three hundred.

Your recovery key is unaffected and keeps working. From then on the app no longer accepts your old passphrase. Backups made before the change, and the earlier versions kept on this computer, still open with your old passphrase or recovery key. Backups made after it carry the new passphrase, but the key that encrypts your watches is the same one, so the old passphrase together with one of those earlier copies can also read later backups. Earlier versions can be deleted in Data → Earlier versions.

It is worth acting on, and you will only be asked once.

The strength check runs when a passphrase is set. If yours was chosen in an older version, before that check existed, it was never measured — so the first time it is measured is on an ordinary unlock, which is when you may see the message.

We do not ask you to change your passphrase on a schedule, and we never will. Forced expiry pushes people towards small edits of the same password, and here it carries a real risk: there is no reset, so a change made under protest and then forgotten costs you the collection. We would rather tell you once, plainly, when a passphrase actually measures as weak, and leave the decision with you.

Being straight about the limits:

• Malware running on your computer while your collection is unlocked. If something has taken over your computer while you are logged in, encryption at rest does not help.
• A passphrase written on a sticky note attached to the laptop.
• Someone watching you type it.
• You deleting your own data with no backup.

Encryption stops a file being read. It cannot stop the ordinary ways people lose things.

No, and you should not have to. You do not need to read a line of code to check it — open a network monitor (the Security Overview, §8, says which processes to watch), use the app through a normal session, saving and exporting along the way, and watch your collection stay where it is. Nothing carries a watch, a value, a photograph or your passphrase anywhere. An app that asks you to take security on faith is not worth taking on faith, so we built the claim to be checkable at runtime, by anyone, in a few minutes.

Two things worth telling apart while you watch. Your COLLECTION is air-gapped — that is absolute, and it is what the monitor proves. The APPLICATION is a different question: bought from an app store, it may talk to that store about the paid unlock — whether you own it, what it costs, and a purchase or restore you confirm. That exchange carries none of your collection and cannot, because the part of the app holding your collection has no network access at all.

One more thing a careful Mac owner may notice. The App Store edition lists Apple's "outgoing connections" permission. It is there because the web engine that draws the app's window will not start in Apple's App Store sandbox without it, not because the app uses it: the part of the app holding your collection still cannot connect anywhere, and the network monitor above shows exactly that. The Security Overview explains it in full.

Settings, and the Help menu on a Mac, have links to our websites and to support email. They open your own browser or mail app; the app itself still connects to nothing, and nothing from your collection goes with them.

Five things. Most owners use two or three of them:

• Insurance documentation
• Knowing whether you are up or down, honestly
• Estate planning
• Tracking the hunt — grails and watches you are chasing
• Simply knowing what you own

If a watch is stolen or lost, your insurer asks what you had, what it was worth, and what proof you have.

The app prints a scheduled property inventory — every watch, reference, serial number, market value and insured value — to hand to an insurer or attach to a claim. It flags anything worth more than it is insured for.

You can also attach the actual paperwork: invoices, warranty cards, appraisals, all encrypted alongside the record.

Yes, and it keeps two numbers apart on purpose:

ON PAPER

what your collection might be worth today, based on values you typed in. An estimate. Not money.

SOLD OR LOST

what actually happened when a watch left. The sale price minus selling fees (or, for a lost or stolen watch, the insurance payment, which is nothing if it wasn't insured), minus what the watch cost you to buy: the price, any auction premium, tax, duties and shipping, less any duty refunded. Servicing is not in it. Servicing is a cost of owning a watch rather than of buying one, so it is shown separately, on the watch's own panel and in the sales, gifts and losses report.

Both figures are the plain arithmetic: what you paid, what it is worth or what you received, and — shown separately — what servicing has cost you.

There is no inflation-adjusted version of your gain, and that is a decision rather than an omission. The app carried one for a while. It was correct and it was useless: it did not change whether a watch was worth keeping, selling, insuring or servicing, and on anything bought recently it restated the same figure twice. A number that has to be explained before it can be used has not earned its place here.

Inflation is still used, on the watch rather than on you. A model that listed for $72 in 1968 is shown in current money beside its current market value, because otherwise the comparison is between two different kinds of dollar. That is a fact about the watch. What your own money would be worth in a different year is a question for an accountant, not a collection register.

For dollars, from actual U.S. Consumer Price Index data — the Bureau of Labor Statistics series CUUR0000SA0 — annual averages from 1913 to the last complete year, plus the most recent published month as the point everything converts to. The note under each figure names both ends, so you can check the arithmetic against any CPI table. A dollar price from before 1913, where that series begins, is carried to 1913 at an estimated 2.5% a year, and the note says which part is estimated.

Every dollar figure on a watch converts to that same point. That matters more than it sounds: a launch price converts to the same point whichever year it came from, so the historical figures on two different watches can be read against each other, which is the one thing a valuation panel exists to let you do.

For the other currencies the app assumes each currency's average over roughly the last twenty-five years and says "estimate" beside it. That rate does not hold further back, so a launch price from before 2000 in another currency is shown as recorded, not converted, and the note says why. That is not laziness: the euro did not exist before 1999 and Singapore's index does not run to 1950, so a table claiming to reach back that far would be a reconstruction presented as a measurement.

A single average was used for dollars too until it became clear that no single rate can be right about more than one era. Measured against real CPI, 1950 to 2025 compounds at 3.5% a year, 2007 to 2025 ran at 2.5%, and 2020 to 2025 at 4.5%. A rate that fits a watch bought in 2007 understates a 1953 watch by half.

Figures are stamped with the year of the data, not "today" — "in 2026 money" rather than "in today's money". When a copy of this app is a few years old, that label stays honest instead of quietly aging into a wrong claim.

One limitation worth stating: CPI measures a general basket of consumer goods. It answers "what would that money buy now", never "what did watches do". The second question is what market value is for, and only you can answer it.

The unglamorous part. If something happens to you, whoever handles your affairs needs to know what these watches are, what they are worth, which go to a named person and which can be sold.

The estate register prints exactly that, grouped by your instructions.

Yes. Mark a watch as "Wishlist" and it sits in your collection as part of the hunt — but it is excluded from every financial total and from the insurance schedule and the estate register, because you do not own it.

When you buy it, enter the purchase date and the app marks it Owned automatically. A price on its own does not, because a watch you are hunting often carries its asking price.

Because everything it stores is encrypted, and that passphrase is the key. There is no "set this up later" — later would mean storing your collection unprotected in the meantime.

Use the "Generate a strong passphrase" button unless you have a reason not to. It gives you seven ordinary words — something along the lines of metal-digit-tape-singer-punch-panel-white. That is far harder to guess than the usual name-and-year with a symbol stuck on each end, and far easier to remember than a jumble of characters.

If you would rather type your own, the app scores it as you go and turns down the genuinely weak ones. Since nobody can reset it for you, that check is the only chance to catch a poor choice before it matters.

Yes, in the template's columns.

Data → Advanced — bulk import & export → "Download spreadsheet template (.xlsx)" gives you an .xlsx with the twenty columns it reads and one example row to replace: Maker / brand, Model, Reference no., Dealer / source, MSRP / Asking price, Purchase price, the case sizes and materials, the dial, the movement and power reserve, and Watch ID. Every column is formatted as text, so a reference number beginning with a zero keeps it. Leave the header row as it is; blank cells are fine, and only Maker / brand or Model is required. Sizes in millimetres can be written 40.5, 40,5 or 40.5mm; each is stored as 40.5.

Data → Advanced — bulk import & export → "Import watches (.xlsx, .csv)" reads .xlsx and .csv alike — there is no need to convert anything. Before a single row is imported it shows you every column in your file, which field it will go into, any column it did not recognize, any price it cannot read as one amount (such as "5k"), which it leaves out, and how many watches will be updated, filled in or added.

A new watch with a purchase price is added as Owned; one without is added as Wishlist, so it is not counted in your totals until you record what you paid. Prices on new watches are recorded in your collection's currency, and the preview says which.

IMPORTING YOUR OWN EXPORT DOES NOT DUPLICATE IT. The last column, "Watch ID", is how a row is recognized as a watch you already hold. Export your collection, change some prices in a spreadsheet, import it back, and those watches are updated rather than added a second time. An update only changes what is in the sheet's columns. Photographs, documents, service history and everything else on the record are left exactly as they were.

A row with no Watch ID that has the same maker and reference as a watch you already hold fills in that watch's blank fields and changes nothing you have recorded. Any other row is added as a new watch.

One caution if you are using .csv rather than the template: spreadsheet programs drop a leading zero from a number as you type it, so a reference of 0123 becomes 123 in your file before this app ever sees it. Use the .xlsx template and that cannot happen.

No. Maker and model are enough to save a watch. Everything else can be added whenever you get to it.

The fields that matter most for insurance are serial number, market value and scheduled (insured) value.

They answer three different questions, and a watch can be all three at once:

PERSONAL RATING

how much do I love this? (the 1-5 stars)

GRAIL

is this one of the ones I chased?

IF ASKED TO SELL

would I let this one go: Not for sale, Open to offers, or For sale?

Why they are separate: a watch that has appreciated past what you would pay today can be five stars, a grail, and for sale all at the same time. One combined field could not say that.

"If asked to sell" records your intention and nothing else: it sets no price and changes no total. Choose Not for sale to say a watch is staying, or leave it blank on the watches you would rather not answer for — most owners fill it in only for the few that could actually leave.

In the register, the stars have their own column and filter, both called Stars. The ten scores in a watch's Ratings section are a separate set of opinions, ranked in Insights under Your ratings.

Grail is one you are evaluating, or one you chased and landed.

Holy grail is the unattainable one — the someday watch.

A watch you do not own yet, but are hunting or evaluating.

It shows in your collection with a WISHLIST tag, but never appears in a money total, an insurance schedule or an estate register. It is a placeholder for the hunt, not an asset.

"For sale", under "If asked to sell", is an intention. You still own it, and it is still counted in your collection.

Status "Sold" is a fact. It is gone, it leaves your held totals, and it moves into what you made or lost on watches you've sold.

A watch you traded in is "Traded". It is counted exactly as a sale, with the trade-in allowance you were given standing as its price.

On purpose, and it tells you when it happens.

Enter a sale date or price and it marks the watch Sold. Enter loss details and it marks it Lost. Enter a purchase date on a Wishlist watch and it marks it Owned.

Without this, a watch you had clearly sold would still be counted in your market value, cost basis and insurance coverage — making every total wrong with nothing on screen to warn you.

Because it counts what the watch really cost you to buy, not just the price on the invoice. Selling fees come off the sale, and duties and shipping go on to the purchase.

Worked example: a watch bought for $4,000, with $110 of duty and $40 of shipping, sold for $6,500 with $780 in fees. Against the sticker price that looks like a $2,500 win. Sold or lost says $1,570, because the fees come off and the cost of getting the watch to you goes on.

Servicing is not in that number. Two services costing $1,950 in all turn the $1,570 into a $380 loss — and that after-servicing figure is the one to trust for "did I do well on this watch". It is shown on the watch's own panel and in the sales, gifts and losses report, beside the figure above.

The calculated coverage limit for it is below the figure it was compared with. The gap is the difference between the two.

The app measures against Replacement cost where you have entered one, and falls back to Market value where you have not. Q51 explains why those are two different numbers.

It is a comparison of two figures in your own record, not a statement about your policy. If either figure was typed wrongly or has gone out of date, the gap is wrong with it. What a claim pays is set by the policy.

Yes, but you have to tell it. Set the "Coverage limit" field under Market value & insurance: 100%, 125% or 150% of scheduled, or Custom percentage to enter the exact figure written on your policy.

Some specialist policies pay above the scheduled value, 150% of it for example. Without that setting, the app compares against the scheduled figure alone and can show a gap your policy does not have.

That limit is measured one watch at a time. A policy can cap what it pays when several watches are lost together, and that cap is not something the app records. Q61 has more.

It cuts the other way too. A home or contents policy can cap a single watch far below its value unless it is individually scheduled. If yours covers a watch without scheduling it, choose "Home / contents — not scheduled" as its policy type, and the app records it as insured with no per-watch amount rather than measuring it against a figure the policy does not hold.

Set its status to Stolen. The loss fields open directly under Status: the date, police report number, claim number, and what the insurer actually paid you.

Destroyed / discarded and Lost are separate statuses alongside it, so your collection records what actually happened rather than filing all three under one word.

A watch that is damaged but still yours stays Owned: record the damage in Condition & originality, and the repair in its service history.

The insurance payment counts like a sale price, so the claim shows up in what you made or lost. The sales, gifts and losses report labels it as an insurance claim rather than a sale.

PHOTOS are wrist shots and reference images. They are automatically shrunk so a page of twenty watches does not choke. Click any photo to see it full size, with a "Save full size" button.

DOCUMENTS are evidence — invoices, warranty cards, appraisals. Images or PDFs. A PDF is stored exactly as you gave it, and PDFs over 10 MB are refused so a backup does not swell. An image is kept at print quality, 300 dots per inch across a US Letter page, so fine print stays readable; anything larger is scaled down to that. They appear as a list on the watch's detail panel; click one to save the file.

Use Documents for anything you might have to show an insurer.

Two steps:

1. Insurance & Sales → Insurance & Warranty, then one of the three "Insurance schedule" buttons: all watches, insured only, or no coverage recorded. All three open the document for you — that is the document itself, not a PDF yet. It is not saved to Downloads: an unencrypted schedule sitting there is exactly what cloud backup tools copy off the machine, so it goes to a temporary folder instead.
2. When it opens, press Cmd-P (Ctrl-P on Windows) and choose "Save as PDF" from the PDF menu at the bottom-left (Windows: choose "Microsoft Print to PDF" as the printer).

The three versions exist because this document is meant to be handed to an insurance agent, and "insured only" or "no coverage recorded" lets you do that without showing them the size of your whole collection. "Insured only" is a confirm-what's-on-the-policy document; "no coverage recorded" is a get-quotes-on-these document, without revealing what is already insured elsewhere.

The app explains this on screen when you save the document.

Because it has no way to. The window this app draws in cannot print, and it has no engine for making a PDF, so the last step has to happen somewhere that does — your browser.

What the app can do, and now does, is write the document out and open it for you, so all that is left is the keystroke. It writes to a temporary folder rather than Downloads, because an unencrypted schedule sitting in Downloads is exactly what cloud backup software copies off the machine.

It is this app turning one watch's record into something you would actually want to read — and, if you like, print and keep.

Open a watch, and at the bottom of its panel, on the left, you will see "Open Folio". It opens the watch on a page of its own: the photograph first, with your own note about why it matters to you right under it if you wrote one, then how you came by it, what it is, how original it is, how it is running, where it is kept and what should happen to it, and the rest of your photographs. Anything you have not recorded is left out rather than printed empty, so a watch you know little about produces a shorter page, not a page full of blanks.

The panel behind it is the record: every field, including what you paid. The folio is the document made from it, which is a different thing and deliberately holds less.

It opens in your browser, ready to print or save as a PDF. Press Cmd-P (Ctrl-P on Windows) and choose "Save as PDF".

The page is called "Watch folio" with the date and time, not the watch's name. Your browser keeps the name of every page it opens in its history, and may copy that history to your other devices, so the watch's name stays inside the page. Type it in when you save the PDF if you want it in the file's name.

Yes — it was written for that. It is the one document here meant for you and for whoever inherits the collection, rather than for an insurer or a buyer.

What it never contains: what you paid, what it is worth now, what it is insured for, who insures it, your policy number, what you sold it for, the case or movement serial number, and the access code for wherever it is kept. None of that is a setting you can switch on. The document was built without them because it has no gate in front of it — unlike the sales dossier, it does not ask who is about to receive it.

It also claims nothing on your behalf. There is no certificate, no authentication, no guarantee. Where it reports originality, it is printing the assessment you recorded; where it reports how the watch is running, it is reading your own timing entries. Nothing in it was issued by a manufacturer or an appraiser, and it does not pretend otherwise.

To print it: it opens in your browser, so press Cmd-P (Ctrl-P on Windows). Untick "Headers and footers" in the print dialog first, or your browser stamps its own date, page numbers and the file path onto every page.

Yes. Archive → Collection folio. Give it a title, choose the watches, and it renders them as one document with a title page.

"Every watch I own" puts in the whole collection. "Let me choose" opens the list to tick them however suits the collection you have in mind. The list groups by category, by what should happen to it, by complication or by rotation, whichever you pick, and each group has a select-all — so "the ones I have marked to keep in the family" is two clicks, and so is "my divers". "Show" narrows the list to one of those answers when a long collection makes the groups hard to see.

"Arrange watches by" sets the order of the book: by maker, by date bought, by year made, or as your collection list is sorted. Nothing is ordered by value.

Only watches you still hold are offered. A folio describes the collection as it stands, so anything sold, given away, lost or still being hunted is left out. A watch with no answer on the axis you are grouping by is not listed either — group by what should happen to it and you see the watches that have one — and the panel says how many that leaves out.

There are two depths. "A page each" gives the photograph, the name, the year and whatever you put in "Why this watch matters to you" — the last field on a watch — and nothing else. Leave that field empty and the page is a photograph and a name, which the panel tells you before it builds the book. It is not the same as Notes, and Notes is never printed. "The whole folio for every watch" gives each one its full page — history, specification, photographs. The first is the default because this document is meant to be handed to somebody, and a specification table between two photographs changes the subject.

Nothing is saved. There is no list of your collections to manage, and naming one does not create anything inside the app. The document you save is the collection — which is the point: it opens on any computer, needs nothing of ours, and cannot fall out of step with a collection that changed after you made it.

It withholds more than a single-watch folio does, on purpose. No purchase price, no current or insured value, no serial numbers — and also nothing about where a watch is kept, what you have decided should happen to it, or who inherits it. A folio about one watch is read by you or your executor, so it names those. A collection is made to be handed to another collector, who should not learn your succession plan along with the photographs.

One figure does appear in the fuller depth, where you recorded it: what the model cost at launch. That is a published fact about the watch rather than anything about you.

A sample watch appears in a collection folio exactly as your own watches do, because it counts exactly as they do. Opening a single-watch folio on one is the easiest way to see what a folio looks like before you have written one of your own, and removing the sample collection removes them from every figure and every document at once.

No. Your collection lives on this computer only. Moving it to another computer means saving an encrypted backup and taking it there yourself.

This is by design. Sync requires either:

1. A server holding the master copy (which we reject — our product is that nothing of yours sits on somebody else's server), or
2. Resolved changes across devices (which breaks the air-gap, requires a server for conflict resolution).

So we chose: no sync, which means you own the only copy, encrypted and offline. The trade is you cannot access from multiple devices without moving files around. Most collectors do that once or twice a year, not constantly.

But my computer syncs folders on its own. Does that pull in my collection?

No — and this is checkable rather than something you have to take on trust. Your collection is stored in the application's own data folder:

On a Mac: inside the app's own sandbox container, ~/Library/Containers/app.watchvaultarchive.desktop/Data/Library/Application Support/app.watchvaultarchive.desktop/ (a copy downloaded from outside the App Store uses ~/Library/Application Support/app.watchvaultarchive.desktop/ instead)

On Windows: a "Watch Vault Archive" folder in your user folder, %USERPROFILE%\Watch Vault Archive\ — outside AppData, so uninstalling and reinstalling the app leaves it in place.

The folder sync built into your computer's operating system covers a fixed, published set of folders, and that data folder is not in it:

• Apple's iCloud Drive "Desktop & Documents Folders" covers exactly ~/Desktop and ~/Documents. Nothing else, and nothing anywhere under ~/Library.
• On Windows, Microsoft's OneDrive "Known Folder Move" covers Desktop, Documents and Pictures. Microsoft's own documentation states the folder set cannot be extended by Group Policy.

None of these reaches the collection, and none can be configured to. Each vendor documents its own scope; links are below.

A few honest caveats, because the picture is not "nothing can ever leave":

1. Files you EXPORT are the case that actually matters. In the Mac app every export opens the Save dialog, so it goes where you choose; on Windows a spreadsheet or other export goes to your Downloads folder. People naturally keep files in Documents — which is covered. An encrypted backup is fine there; it is unreadable without your passphrase or recovery key wherever it lands. A JSON export saved without a password is readable by anyone who opens it. The app offers to lock it with a password first, and asks you to acknowledge this before writing it unlocked.
2. Whole-disk backup tools (Backblaze, CrashPlan, Carbonite and the like) work on a different principle: they copy everything on the drive except an exclusion list, so they DO capture the collection file. What they capture is ciphertext — useless without your passphrase or recovery key. That is exactly why the collection is encrypted at rest rather than merely kept somewhere out of the way.
3. On Windows the folder above sits in your user profile, outside Desktop, Documents and Pictures, so OneDrive's folder backup leaves it alone. But on a computer joined to a corporate domain, classic Windows roaming profiles can copy the profile, this folder with it, to a company server at sign-in and sign-out. If this is a managed work computer, assume your employer's tooling can reach the file — still as ciphertext, but worth knowing.

Verify rather than take our word for it:

Apple https://support.apple.com/en-us/109344

On Windows, Microsoft: https://learn.microsoft.com/en-us/sharepoint/redirect-known-folders

No. Market values are what you type in. A price feed would require a network connection, and this app does not make network connections.

Really. See "What if I forget my passphrase?" above. It is a deliberate feature, not a missing one.

No. The app produces an accurate record of what you paid and what you got back. What that means for your taxes is a conversation with your accountant — collectibles are often treated differently from other assets.

Watch Vault Archive is deliberately desktop-only, for reasons built into the product, not limitations we're working around.

A watch collection is something you review occasionally — a few times a year — to check provenance, look up documentation, confirm insurance coverage, or plan for sale or inheritance. That use case is not "check my phone constantly" — it's "sit down at my computer for an hour and manage the details."

A mobile app designed for that would be a different product: frequent access, summaries instead of full records, cloud sync so you can check one watch detail from anywhere.

The privacy trade-off makes sense for this product *because* you are sitting at your computer. It does not make sense for a mobile app, because mobile sync requires one of:

• A server holding your master copy (breaks our core promise)
• Cloud sync with conflict resolution (breaks the air-gap)
• Local-only mode on each device (defeats the point of mobile)

If we built a mobile app under the same security model, it would be separate data silos: phone has this version, computer has that version, no way to reconcile without leaving the device or trusting a server.

A proper mobile experience requires compromising on the architecture. Rather than do that, we are building this as a desktop application that does one thing properly: manage a complete, secure, offline record of a physical collection.

If you want an app for your iPhone, iPad or Mac, Watch Vault Tracker is a separate app from the same publisher that records which watch you wore. It has its own storage on that device and never connects to Watch Vault Archive. A list of watches can be carried between the two as a file you hand over yourself: watches only, never wearing records. Q62 explains how.

Stop. Do not create a new passphrase — that starts a fresh empty collection.

Your collection lives in the application's own data folder, not inside the app itself, so moving the app or reinstalling it does not remove your collection. If you are being asked to set a new passphrase, the app is not finding that folder — most often because you are signed in to a different user account on the computer, or because a restore or a migration to a new computer skipped it.

Check you are in the same user account you set it up in. If your collection was created on another computer, it is still there: finish setup on this one, then bring it across from your encrypted backup file. The last setup screen offers "Restore from a backup" beside the sample and empty-collection choices, and it is always available afterwards at Data → Backups → "Restore from a backup". Setting up here does not touch a collection kept anywhere else.

The setup screen offers this same guidance — "Already have a collection?", under the Continue button.

Your data has not been deleted. The app is not finding it.

On the lock screen, choose "Use recovery key instead" and enter the recovery key from setup. Capitals, spaces and dashes do not matter.

Once you are in, set a new passphrase you will remember: Settings → Passphrase & recovery key → "Change your passphrase". It asks you to confirm it is you: choose "Forgot passphrase? Use recovery key." and enter the same key again. The passphrase you have forgotten is not needed at any point. Your recovery key keeps working afterwards, unchanged.

If you have neither, see "What if I forget my passphrase?" above. There is genuinely nothing that can be done.

Data → Backups → "Save an encrypted backup". On a Mac it asks where to save it: an external drive, a cloud folder, anywhere you like. That produces a single encrypted file holding everything: watches, photos, documents, owner details. Data → Backups → "Automatic backup" can also save one for you on a schedule (see "Can the app back up my collection automatically?").

Keep it somewhere other than this laptop. It is encrypted, so a USB stick or a cloud drive is fine — without the passphrase or the recovery key it is unreadable to whoever holds it. Every backup opens with your passphrase or your recovery key. Saving one yourself asks for one of them first. A passphrase you change later does not reach a backup already saved: it opens with the passphrase in use when it was saved, or your recovery key.

Two things worth doing:

• Store the backup file and your recovery key in different places. Together in one folder means a single loss takes both.
• Back up again after any significant change. The last backup is the only one that counts.

Use an encrypted backup for this, not "Export full archive (.json)". That export exists for moving data into another tool. Saved without a password it is readable by anyone who opens it — including anything that syncs or backs up the folder you leave it in. Locked with a password, it opens only with that one password, which nobody can recover; your recovery key opens every backup. An encrypted backup is the one that is safe to put on a cloud drive. See "Does it sync to my phone or to the cloud?" above.

Not by renaming files. Use one of these instead.

IF IT WAS AN IMPORT OR AN UPDATE that went wrong: Data → "Earlier versions" holds your collection as it was before it, and "Restore" brings it back inside the app. See "Is anything kept if an import or an update goes wrong?"

FOR ANYTHING ELSE: Data → "Earlier versions" also keeps a copy once a week while the app is open, if anything changed; restore the one from before the mistake. Or restore your latest encrypted backup: Data → Backups → "Restore from a backup".

THIS IS PROBABLY NOT YOUR PROBLEM IF: the app opened and your watches are missing, or it opened empty, with no message on screen. That combination does not happen on its own — a real problem shows itself, with a dialog naming what went wrong. If nothing was shown, look again before assuming data is gone.

The app also keeps the version from just before your last save, as a file named "register.vault.prev" beside your collection. Renaming it back does not undo a save: the app keeps a second copy of your collection in its own database and always opens the newer of the two, so it would put the newer version straight back. (Until 20 October 2026 this answer gave steps for renaming it; they do not work.) That file is encrypted exactly like the live one, with the same passphrase, and erasing your collection removes it too.

No, and it only happens once. An earlier version stored full-size camera images, which made the app slow. It is shrinking them for display. Files you attached under Documents are untouched.

Watch Vault Archive is published by Aveneg Technologies, LLC.

It was built for collectors who could not find anything that handled provenance, insurance schedules and estate records properly, which is why it does the unglamorous things well and none of the flashy things at all.

For bugs, questions or suggestions, email support@watchvaultarchive.com. For a bug, it helps to say which version you have (shown at the bottom of the app), which kind of computer you use, and what you did just before it happened.

Never send your passphrase, your recovery key or a backup file — nobody at Aveneg Technologies needs them, and nobody will ask for them. A screenshot can show your collection, so check it before you attach one.

For anything commercial, see the next question.

The licence covers one person's own use: tracking your own collection.

Using it inside a dealership or auction house, bundling it with a product or service, or anything at volume beyond individual use, is outside that. Email legal@watchvaultarchive.com and say what you have in mind.

While the sample watches are loaded, yes — it counts exactly like a watch you entered yourself. Once you add a watch of your own, the samples are gone and nothing fictional is left in your figures.

It is the first of the sample watches: a fictional record — an "Aveneg Meridian" — with every field filled in, so you can see what a finished entry looks like without having to guess. Aveneg is not a watch manufacturer and the Meridian is not a real model; every figure in it is invented.

While they are loaded, the samples are included in the held count, market value, cost basis and profit figures, in the insurance schedule and the estate register, and in spreadsheet exports. They are left out of your encrypted backup and of "Export full archive" — a backup is what you would restore from, and a restore that quietly puts fictional watches back into a real collection is worse than one that starts empty. Earlier versions held the fictional record apart from all of those, and that was the wrong choice: a watch visible on screen but missing from the total underneath it makes the total impossible to trust. It is labeled instead — COMPLETE EXAMPLE in the watch list and again at the top of its detail panel — so any figure you do not recognize can be traced back to it.

Sample watches cannot be edited. They are there to be read rather than filled in, which is what makes the next part safe.

The moment you save your first watch of your own, the app asks once whether to clear the samples. Choose "Save & Clear Demos" and they go as that watch is saved; choose Cancel and nothing is saved yet. It asks because a collection holding your watches alongside fictional ones produces figures that are part invention — and because samples disappearing unannounced is worse than a question. You are asked only that once, on the first watch. From then on your totals describe only what you entered.

Importing your own watches clears them too. That one is not a second question — the confirmation you approve before the import says the samples will go, so it is part of what you are agreeing to rather than something that happens afterwards.

The complete example itself stays available. "View example watch record" in Data opens it whenever you want, as something to look at: it is shown rather than added, so it never joins your collection and never reaches your totals, your insurance schedule or any document you generate.

That the example fills every field is enforced by an automated check that runs before every release, so it cannot quietly fall behind as new fields are added.

Insurance & Sales → Sales, gifts and losses → "Sales dossier". Pick the watch, pick how much to disclose, choose the photographs and documents, and you get a zip file to send.

Three levels, because trust rises through a sale and disclosure should rise with it:

LISTING

a public copy for eBay or Chrono24. Specifications and photographs only. No serial numbers, no documents, and nothing you recorded about this watch's own condition.

INTERESTED BUYER

for someone asking real questions. Adds partial serial numbers, service and pressure-test history, warranty terms, your notes on replaced parts, and any documents you tick.

SALE / HANDOVER

for the person actually buying it. Full serial numbers, every document you tick, and the rest of what the record holds: timing results, prior owners and the provenance you wrote.

A watch carries two numbers, and they are treated alike. The case number is stamped outside; the movement number is stamped on the movement itself and is usually the one that dates the watch. Either one identifies your watch to a stranger, so publishing one while withholding the other would furnish a cloned listing just as well. Both follow the same rule at every level above.

What is NEVER included, at any level: what you paid, either MSRP figure, your replacement cost, your insured value, your insurer or policy number, your deductible, your appraiser, where you keep the watch, your private notes, who you have left it to in your will, and any loss or claim history.

Two of your own written fields are treated differently, and the difference is worth knowing. Notes never leaves, at any level. The provenance you wrote — where the watch came from and who had it — goes out in the sale/handover copy only, because by then it is part of what the new owner is being handed.

That list is not a setting you can switch off, and it is not a filter applied at the end. The dossier is built from a list of fields that are allowed OUT. A field reaches a buyer because it is named on that list. Adding a new field to the app does not add it to a dossier.

Three things worth knowing:

PHOTOGRAPHS START TICKED; UNTICK ANY YOU WANT TO KEEP BACK. A photograph can show the serial number, on a caseback or between the lugs, at a level that hides it from the summary. Each one is shown, so you choose by looking.

DOCUMENTS ARE TICKED ONE BY ONE. There is deliberately no "attach everything" button. Hiding the serial in the summary achieves nothing if the warranty card you attached alongside it shows the serial in full, and only you know which of your documents shows what.

PHOTOGRAPHS OF DOCUMENTS ARE CLEANED ON THE WAY OUT. A photo taken on a phone carries hidden information — where it was taken, when, and on what camera. Sent to a stranger, that can say where your collection is kept. Image documents are re-encoded when they go into a dossier, which removes it. The copy inside your collection is untouched. PDFs cannot be cleaned this way, so if you include one the app tells you so before it saves.

Before anything is written you get a summary naming the level, the serial treatment and the photograph and document counts, and you have to confirm. Open the zip before you send it — what is inside is what the other person will see.

The timing log now records a full six-position bench test — dial up, dial down, crown up, crown down, 12 up, 6 up — instead of a single rate. Nothing about an existing entry changes: a reading you logged before this still shows exactly as it did, and editing it does not force you to fill in positions you never measured.

What the six numbers give you that one never could:

• AVERAGE RATE and AVERAGE AMPLITUDE are calculated only from the positions you actually filled in — leave two blank and the average is over four, not six.
• POSITIONAL SPREAD is the gap between your best and worst position, the number that actually tells you something is wrong: a watch can average a clean +2 s/d while swinging from +15 to -11 across positions, and the average alone hides exactly that. It only appears once two positions are entered — never shown as "0" for a single reading, because that would read as "measured six ways, perfectly consistent" when what really happened is "checked once."
• MAX BEAT ERROR is the worst position, not an average of all six — a beat error problem in one position is the one worth knowing about, and averaging it away would hide it.
• FLAT → VERTICAL shows how much amplitude drops from the two flat positions to the four vertical ones, once both are measured. That drop is the number a watchmaker actually reads off a timegrapher; the average alone throws it away.

LIFT ANGLE is recorded per reading, not just once on the watch, because a timegrapher does not measure amplitude directly — it calculates it from the lift angle you told it. If you correct the watch's lift angle later, older readings keep the value that was true when they were taken, so an old amplitude stays interpretable instead of silently meaning something different.

Enter one position fully — rate, amplitude, beat error — before moving to the next, rather than all six rates and then all six amplitudes. That matches how a timegrapher is actually used: reposition the watch once, read what it shows, move on.

Condition asks how worn a watch is. Originality asks how much of it is still the watch that left the factory — and on anything vintage that is usually the larger half of the value.

CASE is the big one. A case with its original sharp edges is worth substantially more than the same reference after a polish, because polishing removes metal permanently and softens the lines the factory cut. "Lightly polished" is the honest answer for most watches that have been serviced a few times. "Heavily polished" is for a case where it has gone further, with the lugs thinned or the bevels rounded off.

DIAL separates a factory service dial from a redial. They are not the same event: a service replacement is documented and legitimate, while a third-party repaint is neither, and lumping them together would flatter the second. A redial can halve the value of an otherwise good watch. Two further answers keep that line honest. "Relumed" is for the original dial with only its luminous material redone — the same distinction the hands make. "Aftermarket" is for a dial that is not the original and did not come from the factory, which is not a repaint of anything.

HANDS treats "relumed" as its own answer, because the hands are still the originals — only the luminous material is new.

BEZEL INSERT and CRYSTAL ask whether the part is the one it was born with. For the crystal in particular, a replacement is ordinary maintenance and not a fault; almost every watch over twenty years old has had one.

BRACELET and CLASP ask the same question of the parts most often swapped. "Associated" is the auction trade's word for one that is correct for the model and its period but is not the one this watch left the factory with — honest, and different from a factory service part or an aftermarket one. The clasp is asked separately because clasps wear out and are replaced on their own, so an original bracelet can carry a clasp that is not. A watch with no bracelet — on a strap of any kind, or kept as a head only — answers "No bracelet".

MATCHING NUMBERS is the paperwork question: whether the case, the movement and the factory archive agree. On most modern watches it does not arise, which is what "Not applicable" is for.

UNKNOWN IS A REAL ANSWER, and it is the right one far more often than people expect. Unless you bought the watch new, or you have owned it its whole life, you cannot know whether a previous owner had the case polished in 1994. Every one of these fields starts blank and every one offers "Unknown" on purpose. Guessing turns something you do not know into a claim on a document a buyer or an insurer may later read, which is the opposite of what this collection is for. Leave it blank or say Unknown and you have lost nothing — blank fields are simply left out of the sales dossier.

Market value is what the watch would SELL for. Replacement cost is what an equivalent one would COST to buy. Those are different questions, and the coverage comparison uses the second wherever you have recorded it.

Some insurance policies use the words "market value" to mean what it would cost to replace the watch. In this app that figure is Replacement cost. Market value here always means what the watch would sell for.

They come apart in both directions. A steel sports model with a waiting list at the dealer might list at 11,800 and trade at 18,500 — list price is a number nobody can actually buy at, so replacing the watch really costs the secondary-market price. Run the other way, a watch bought at a discount and now trading below retail sells for less than it would cost to walk into a shop and buy another.

Only you can judge which applies, because it depends on whether you could realistically be sold one at list price. That is why Replacement cost is a field you fill in rather than a figure the app calculates.

Leave it blank on the watches where the two are about the same, which is most of them. Where it is filled in, the coverage gap, the shortfall totals and the insurance schedule all measure your coverage limit against it instead of against market value.

Market value is still what drives the collection's worth and what it has gained on paper, since those are resale questions. Replacement cost is used only for coverage.

Each figure carries its own date and its own source — and the replacement figure carries a reference too, since it often comes from an appraisal with a document number. They are separate on purpose: you might look up what a watch would sell for without re-checking what replacing it would cost, and the coverage warning tells you which of the two it used and how old that figure is.

Two different questions, deliberately side by side. Health is mechanical — what the readings and the interval say. Warranty is financial — who would pay for it.

HEALTH. A hollow green ring means nothing is due: the service interval has not run out. It is not a claim that the watch runs well, because nobody has timed it. A filled green mark is the stronger statement — it was put on a timegrapher and read in spec. It carries no word; hold the pointer over it for the rate, the standard and the date it was measured.

Amber means a reading has moved, or the rate is outside the standard you measured it against, or the interval is nearly up, or the interval has run out while every reading is still clean. Red means a reading outside the usual band, or the interval has run out with a reading that has moved, a rate outside the standard, a falling trend, or nothing measured at all.

The word beside the mark names which of the two it is. A maintenance schedule reads Due soon or Overdue; a measurement reads Borderline or Needs attention. Those four words mean the same thing everywhere in the app — in this column, in the watch record, in the form while you are editing, and on the printed service record.

Where no full service is recorded, the schedule counts from your purchase date, says so, and marks the result Estimated — the app cannot know when a watch was last serviced before you owned it. You never need to record a service that did not happen in order to see when one is due; if there is no purchase date and no service date, the record tells you which one to add.

Amber also watches for decline. If the amplitude has fallen by fifteen percent or more across tests spanning eighteen months — with the latest reading the lowest of the series, below 285 degrees, and no service in between — the column says Borderline even though every individual reading still clears the absolute thresholds. A mainspring or oil going soft shows up as a slope long before it shows up as a bad number, and the tooltip prints both readings so you can judge the slope yourself.

The worst signal wins, with one exception. A watch reading +1 s/d that is eight years past its interval is amber, not green and not red: degraded oil does not have to show up in the rate, so a good reading never clears an overdue watch, but a clean one is not the same as a measured fault.

The service clock runs for every kind of movement, quartz included: a quartz watch wants its seals and battery seen to on a schedule too. Watches you no longer own are blank.

WARRANTY. A hollow green ring while it is active. Amber and “Expiring” inside the last sixty days. Red for the final fortnight, which is when a free repair is about to become a paid one. Muted “Expired” once it has ended.

Expired is not the same as blank. Blank means you never recorded a warranty; Expired means there was one and it has run out, which is precisely when the watch stops being the brand's problem and can go to an independent watchmaker instead.

While it is still active, one thing is worth knowing. The dates here are counted from what you entered, not from the manufacturer's records. Some brands refuse warranty work if the watch has been opened or serviced outside their authorized network.

The watch's value was last checked more than two years ago, or carries no check date at all. A figure of unknown age is one you cannot stand behind either, so both count.

The date is the date on the newest entry in Valuation history (Market value & insurance). Add an entry with the date you last looked the value up, even if it was years back.

Only watches you currently own appear here. Ones you have sold, gifted or lost never do, nor do watches on your wishlist, nor a watch with no market value recorded at all.

Record it in Valuation history, in Market value & insurance. Enter the date you checked it, the figure and where it came from, then press Add. Every valuation is kept there, newest first, and each one can be edited or deleted, the same way as a pressure test.

The entry with the latest date is the current market value, whenever you entered it, and it is marked Current. That is the figure the totals, insurance comparisons and documents use. If you add an older valuation you have just found, it takes its place in the list and the current value stays where it was. If you delete or correct the newest entry, the current value follows.

If you checked the value and it has not changed, add it again with today's date. That records the check, and the date shown beside the current value moves with it.

An entry with no date is kept and listed, but it never replaces a dated one, because it cannot be placed in time. It is the current value only when nothing in the list carries a date.

Replacement cost works the same way, with one addition: its entries carry a reference as well as a source, because a replacement figure often comes from an appraisal that has a document number on it.

It tells you which figure the comparison used, and how old that figure is.

The app measures your cover against Replacement cost where you have entered one, and falls back to Market value where you have not. Those can be very different numbers, so the line names the one it actually used rather than leaving you to work it out.

The date is the one belonging to THAT figure, never the other one. If the comparison used replacement cost, the date shown is Replacement cost last checked — not the date you last looked up what the watch would sell for.

The scheduled value is dated too, by its own field, "Scheduled value last checked". The limit is worked out from that figure, and a policy can change it at renewal or in between, so the comparison is only as current as the day you last checked it against the policy.

Where it reads "has no check date", the figure has never been dated. The arithmetic is still correct; you just have no way to tell whether it rests on something current or on something from years ago. Filling in the date is what clears it.

No. It is the same comparison as a coverage gap, stated in the other direction.

A coverage gap states how far your limit falls below that figure. This states how far it sits above. Both are the same subtraction, and both are shown in ordinary text rather than a warning color. This one carries no label in front of it, because the app cannot say that a watch is covered. Q61 explains why.

The app has no idea whether a limit above replacement cost is deliberate. Agreed-value policies, appreciating pieces and riders set high on purpose all look identical from here. Whether that gap is right is between you and your insurer — the app only puts the two figures you recorded side by side.

A policy of yours renews within sixty days, or its renewal date has passed. The line names the insurer, the date, and what the watches on that policy add up to — scheduled value against replacement cost, or market value for a watch with no replacement cost recorded. Where the policy covers a single watch, that watch is named; past one, it says how many there are.

Renewal is usually the only point in the year when a scheduled value can be changed, so it is the one moment those two figures are worth reading together. Dismiss hides it until you next open the app; it is never dismissed permanently, because it only appears once a year.

If the watches on one policy carry different renewal dates, it says so rather than choosing one for you. The app cannot know which is right.

Two sections, one open at a time: Your ratings and Over time.

Your ratings ranks the watches you own by the ten scores you gave them, explained under "How are my watches ranked in Your ratings?".

Over time shows what your collection was made of on any date it changed, and what changed between any two of those dates.

Group by Category or Brand, and measure by Watches or Total cost. Watches is what you collect. Total cost is where your money went. The timeline steps through the dates watches actually arrived or left, so every stop is a real change rather than an arbitrary month.

The timeline has two handles. The right one picks the date shown. The left one picks an earlier date to compare it with: how many watches arrived and left in between, which ones, and how each category or brand changed.

None of it is stored. It is read back from the dates your watches arrived and left, already recorded on them, rather than kept as a second copy that could drift from them, so correcting an old purchase date corrects the history with it.

Three things worth knowing. Brands are grouped ignoring capitals and spacing so one stray keystroke does not split a maker in two, and the spelling shown is your own. Measured by cost, it can only include watches with a price recorded, so it names the ones left out rather than quietly showing you a smaller collection. And a total is in one currency: Total cost counts the watches bought in your main currency, and names each watch bought in another, with its currency, rather than adding different currencies together.

Print / save as PDF and Download spreadsheet act on whichever section is open. Over time's spreadsheet is the table as you have it set: the date, Category or Brand, Watches or Total cost, and the comparison if there is one, with the figures as numbers. Its last rows say what the figures leave out. The watches that arrived and left are in the Collection History spreadsheet, which "Collection History for these dates" opens on the same dates.

Adding a new watch needs a licence. Everything else keeps working, permanently, whether or not you ever buy a licence. This applies to the Mac App Store edition; an edition that offers no way to buy a licence is licensed in full.

For thirty days from the first watch you enter, the app is complete and unlimited — put your whole collection in, however large it is, and use every part of it. After that, adding a watch needs a licence.

What does not change: opening and unlocking your collection, reading it, searching it, editing and deleting the watches already in it, every document the app produces — the insurance schedule, the estate register, the folios, the service and timing record — and every export and backup. None of that is withheld, and nothing you have entered is removed or made unreadable.

A collection restored from a backup opens in full however many watches it holds, whether or not a licence has been bought and whether or not the first thirty days have passed. Someone inheriting a collection can open it, read it, print the estate register and keep it — with no licence and no time limit. They would only need one if they started adding watches of their own.

Yes, two or three at a time. Press Select above the list, tick the watches, and choose Compare in the bar that appears.

They open next to each other: what each one is, what you paid and what it is worth, its insurance, how often you wear it, its servicing, and the photographs and documents on file. A row where they differ is marked. It shows what you recorded side by side and nothing more — it does not rank them or say which to keep.

Any watch can be compared, including one you have sold or lost. Its row shows what it brought in, and the rows that only apply to a watch you still own are left blank.

No. It means the calculated coverage limit is at or above the figure it was compared with, for that one watch, and nothing more.

The app holds two figures you typed and compares them. It does not hold your policy. A policy can cap what it pays when several watches are lost together, apply a deductible, or pay on a different basis from the one you had in mind, and none of that is in the comparison.

One arrangement shows why. Some policies pay above the scheduled value for a single watch but cap a loss of several watches at the total scheduled. Each watch can then show no gap on its own while the collection together is scheduled for less than it would cost to replace. The insurance schedule prints both totals side by side for that reason.

Your policy and your insurer are the only authority on what a claim pays.

As a file you carry yourself. The two apps never connect to each other.

FROM THIS APP TO THE TRACKER: Data → Watch Vault Tracker → "Export for Watch Vault Tracker". The file holds every watch you own or have owned (wishlist entries stay here): its maker, model, reference, category, whether you own it or how it left (sold, traded, gifted, lost, stolen or destroyed), and one photograph. It holds no serial numbers, values, insurance details, documents or notes. Unless you lock it with a password (below), it is a plain, readable file, so delete it once the Tracker has it.

FROM THE TRACKER TO THIS APP: export the watch list from Watch Vault Tracker and open that file with Data → Watch Vault Tracker → "Import from Watch Vault Tracker". That button opens only a file the Tracker made. A watch you already have here is recognised and left exactly as it is. Only a watch this app does not hold is added, with its photograph and its status. You are shown the numbers before anything changes. A file that gives a watch a status this app does not have is refused, and nothing changes.

Where the app cannot tell which watch a line in the file is, such as two of the same model, it asks you and guesses nothing. Wearing records stay in the Tracker and are never part of either file.

Either file can be locked with a password. When you export, the app asks "Lock this file with a password?". Locked, the file opens only with that password, in this app or an up-to-date Watch Vault Tracker. Nobody can recover a forgotten password; export the file again instead. The same choice is offered for "Export full archive (.json)", and "Import watches (.json)" opens a locked one.

Yes. Before any import changes your collection — a backup you restore, a spreadsheet, a watch file or a file from Watch Vault Tracker — the app keeps a copy of your collection as it was. It does the same the first time a new version of the app opens your collection, and once a week while the app is open, if anything has changed. You see it happen: the import screen shows "Step 1 of 2 — Keeping a copy of your collection as it is" before it starts.

The copies are encrypted exactly as your collection is, and stay on this computer. The last two of each kind (every week, before an update, before an import or restore) are listed in Data → "Earlier versions", each with when it was saved, why, and how many watches it holds.

To go back, press "Restore" beside the one you want. Restoring replaces your current collection, and the app says so before it asks for your passphrase or recovery key. It then saves your current collection as an earlier version of its own before restoring, so that step can be undone the same way. The photographs and documents a kept copy refers to are kept as long as the copy is.

Each copy is checked the moment it is made: it must open with your keys, and it must read back exactly as it was written, before it takes the place of an older one. If either check fails, the import does not start and nothing changes. A copy that cannot be opened later says so in the list, and offers no "Restore".

To remove one, press "Delete" beside it. It asks for your passphrase or recovery key, removes that version from this computer for good, and clears the photographs and documents nothing else refers to, so a watch you deleted does not stay behind inside an earlier version. Your current collection is not changed.

A file the app refuses changes nothing, so nothing is kept for it. Erasing your collection removes the kept copies too.

Earlier versions are for undoing a mistake on this computer, not a backup. If the computer is lost, they go with it. Your encrypted backup is the copy that is really yours.

Because the file it makes is not encrypted. A spreadsheet, a printed document, or a photograph or document you save from a watch can be read by anyone who opens it, and once it exists, keeping it safe is up to you. Terms section 2 says so, and the box is your acknowledgement of it.

Two files can be locked with a password instead: "Export full archive (.json)" and "Export for Watch Vault Tracker". A locked file is not asked about; saved without a password, it is. A spreadsheet or a printed document cannot be locked, because Excel and your browser could not open a locked one. Your encrypted backups never ask: they are encrypted already.

"Export full archive (.json)" holds everything, so when your collection records an access code, where the sealed access instructions are kept, or physical access directives, it first asks for your passphrase or recovery key, as the sealed legacy folio and the estate register do. It asks once until the app locks, locked file or not.

If you would rather not tick it each time, open "Ask me less often" at the foot of the box and choose until the app locks, 24 hours or 30 days. The box is then not shown for that time, on this computer only, and the same screen still tells you what the file holds. After 30 days at most it asks again; Settings → Unencrypted files, set "Ask before each unencrypted file" to "Every time", ends it sooner.

The sale dossier always asks, because it is made to be handed to someone else. So does your passphrase whenever a watch or the collection is deleted or replaced: that is a lock, not an acknowledgement.

Yes, on a Mac, and every backup is encrypted. (On Windows, use "Save an encrypted backup" for now.) Choose where backups go once, during setup or in Data → Backups → "Choose where backups go": iCloud Drive, Google Drive, Dropbox, an external drive, or any folder the Mac's folder picker shows. From then on, while the app is open and unlocked, it saves an encrypted backup there every week, or every day if you choose, in a folder of its own named Watch Vault Archive Backups. It is the same file "Save an encrypted backup" makes, so it opens with your passphrase or your recovery key, through Data → Backups → "Restore from a backup", which opens in that folder.

Data → Backups says where the backups go and when the last one was written. It does not say whether that folder leaves this computer, because the app cannot know: a folder in iCloud Drive, Google Drive or Dropbox, on an external drive, or one a backup service copies, carries your backups away with it; a folder nothing copies does not. In iCloud Drive they go to your own Apple account, carried by Apple; they do not pass through any server of ours, and we hold no copy. The newest four backups are kept there, and older ones the app wrote are removed; nothing else in that folder, or the folder around it, is touched. The app never chooses a cloud location for you.

Separately, an earlier version of your collection is kept on this computer once a week while the app is open, if anything changed, with nothing to set up (Data → "Earlier versions"; see "Is anything kept if an import or an update goes wrong?"). It is for undoing a mistake, not a backup.

It never runs while the app is closed, and it cannot write to a drive that is not connected. If a backup is not written, the app says so once and shows it in Data → Backups until one succeeds. A backup written automatically counts as your latest backup.

The backups in that folder are yours. Erasing your collection forgets the folder but does not remove them. A passphrase you change later does not reach a backup already written: it opens with the passphrase that was current then, or your recovery key.

Yes, from a rate you give it. Set "Usual tax rate" in Settings → Currency, tax & inflation: the sales tax or VAT where you usually buy, as a number (6.5 for 6.5%). It is optional and starts blank.

Answer "Charged on top" and enter the purchase price, and Tax paid fills in at that rate, with a line under it saying so. If your receipt shows a different figure, as an auction or another state or country often will, type it over the top. From then on the figure is yours and the app leaves it alone.

For "Included in the price" nothing fills in by itself: many pre-owned watches carry VAT only on the dealer's margin, which no rate can work out. If your receipt shows the tax, "Work out at" under Tax paid fills in the tax inside the price.

A figure already recorded on a watch is never changed. The same works for a strap, bracelet or chain bought on its own.

A short record of things that went wrong in the app, kept on your computer so you can send it to us if something is not working. Each entry says what failed and when, with the app's version. Before an entry is kept, quoted text, email addresses and the name of your computer account are taken out, so it should hold no watch details; look at the saved file before you send it. Only the newest 200 entries are kept.

The app never sends it. To get help, open Settings → Error log, press "Save the error log", and email the file to us with a sentence about what you were doing. "Email Support" beside it opens your mail app.

It is on from the start. Turn it off, or clear it, in the same place.

Each watch can hold ten scores of your own, each 1 to 10, in its Ratings section: six for Hardware (Case / Design, Movement, Band / Strap, Durability, Quality, Performance) and four for Ownership (Style, Versatility, Value, Brand). Value is your own score for it, not a price. The 1-5 stars are separate and are not used here.

Insights → Your ratings ranks the watches you own by the average of those scores, to one decimal. Rank by Overall (all ten), Hardware, Ownership or any one score, highest or lowest first. Watches with the same figure are listed by name.

A watch is ranked only when it has every score the ranking counts. Watches with some scores are listed below with how many they have, and watches with none are named, so a missing score never looks like a low one. Watches you have sold, lost or are still looking for are not included.

The buttons above the list pick a band of the scale, such as "8 to 8.9" or "9 and above", each with how many watches are in it. A watch stays in its band until you change its scores. There is no "top 10%": on twelve watches that is 1.2 watches, and it would change every time a watch arrived.

Overall is the average of every score entered. Hardware has six scores and Ownership four, so Overall is not always halfway between the two.

Each watch shows the date its scores last changed, here, when you open the watch, and in Compare. The scores are your opinions: the app ranks them and does not judge them.

With Your ratings open, Print / save as PDF makes "Collection ratings": the ranking as it is set on screen, with each watch's date, then every one of the ten scores for each watch. A score not entered prints as a dash, never a zero.

Download spreadsheet, beside it, saves the same scores as a spreadsheet: every watch you own with a score, whichever band is picked, with Overall, Hardware, Ownership, the date the scores last changed and all ten scores as numbers you can sort and average. A score not entered is an empty cell. It is a record of your scores, not a backup, and it cannot be imported back.

You need two things: one of their encrypted backup files (its name ends .vault.json) and the passphrase or recovery key it was saved with. The collection is not kept anywhere else, so without both nobody can open it, including us.

Install Watch Vault Archive on your own computer. On the first screen choose "Already have a collection?", then "Restore from a backup file". You set a new passphrase for this computer first, and the app shows a new recovery key for it. Write that key down too: it is yours, and it opens what you save from now on. It does not open the backup you were given.

Then choose the backup file and enter the passphrase or recovery key it was saved with: theirs, not the new one. Every watch comes across with its photographs, documents and history, and so do the owner's details, the people to contact and the letter they left. What should happen to each watch is on that watch's own record, and Owner & Succession prints the estate register.

You can open, read, search, print and export all of it for as long as you like, without buying anything. A licence is needed only to add watches of your own.

Yes, in the Mac App Store edition, on a Mac that has Touch ID. In Settings, open Touch ID and choose "Use Touch ID to unlock". The app asks for your passphrase or recovery key, then for your fingerprint. After that the lock screen offers "Unlock with Touch ID", and your passphrase always works too.

Only a finger enrolled on this Mac opens it, never the Mac's login password, so someone who knows that password still needs your passphrase. If a finger is added to or removed from this Mac, Touch ID is switched off until you type your passphrase and switch it on again. Every 14 days the app asks for your passphrase instead of your fingerprint, so you do not forget it: a backup opened on another computer still needs your passphrase or recovery key.

It works on this Mac only. Nothing about your fingerprint reaches the app; macOS checks it and says yes or no. Deleting a watch, erasing and restoring still ask for your passphrase or recovery key. Settings → Touch ID → "Stop using Touch ID" turns it off, and erasing the collection removes it.