Travel Mode
Cross a checkpoint without carrying your sources
A phone searched at a border gives up everything on it: the names, the interviews, the places. nTilia’s Travel Mode makes sure that, when you are checked, your sensitive notes are no longer in your pocket, without losing them.
Page updated
In short
Travel Mode is a feature of nTilia, the offline notes app for field work. Before a risky crossing (checkpoint, border, search), it sends an end-to-end encrypted copy of your notebook to a safe recipient, your newsroom or a desk, then removes from the phone everything you did not choose to carry. When you are checked, the app only shows a logistics notebook. And even if you are forced to reopen it, the notebook only comes back after 24 hours, or with your recipient’s approval.
Video · Travel Mode in 72 seconds
Captioned video: a copy goes to a safe recipient, the phone empties itself, and even under duress the notebook only comes back after 24 hours or the recipient’s approval.
The problem: encryption is not enough against a search
Encrypted notes apps protect your data on servers and against theft. They do not protect you from the person holding out a hand and demanding your phone’s passcode. At a checkpoint, refusing is not always an option, and an unlocked note reads like any other.
The only protection that holds is not having the sensitive data on the device when you are checked. But erasing everything yourself means losing the story. Travel Mode solves both: the copy goes somewhere safe first, then the phone is emptied.
How it works, step by step
Everything is prepared calmly, well before the barrier. On the day, a single action is left.
1. Turn on the vault
The vault encrypts the whole notebook stored on the phone (AES-256-GCM, key derived from your phrase with PBKDF2). It is free and required for Travel Mode: destroying its key makes whatever remains on disk unreadable.
2. Name a safe recipient
Another nTilia account, your newsroom or a desk. Whenever the notebook changes, they get an end-to-end encrypted copy (at most every 10 minutes, the last 3 kept). They open it with their vault; you, with the file and your phrase.
3. Choose what you carry
Tick the harmless missions: the hotel, the permit, public contacts. Everything else, the interviews and the names, will leave the device.
4. Turn on Travel Mode
A last copy goes to the recipient, then unticked missions are removed from the phone and hidden in your cloud. The vault locks. If needed, hide your public journal too.
5. At the checkpoint
They take your phone and open nTilia: a logistics notebook, nothing else. If they make you press “Restore”, nTilia answers that deactivation takes effect in 24 hours, or once your recipient approves it.
6. Somewhere safe
You request deactivation; your recipient is told by e-mail and in the app. They confirm through another channel that you are safe, approve, and you restore the notebook from the cloud or from their copy.
Where your notes are, at each moment
It comes down to one rule: the last copy must never be only in your pocket.
| Moment | On the phone | In your nTilia cloud | With the safe recipient |
|---|---|---|---|
| Before leaving | The whole notebook, encrypted by the vault | The whole notebook | An encrypted copy, updated on every change |
| Travel Mode on | Only the ticked missions | Everything, but hidden except ticked missions | Their copy, intact |
| After “Empty” | Nothing, and the device is signed out | Everything, hidden | Their copy, intact |
| After “Burn” | Nothing, and the device is signed out | Destroyed (the already-public journal stays) | Their copy, intact |
| Back somewhere safe | The notebook returns after deactivation | Readable again (or refilled from the copy) | Their copy, which brought everything back |
The actions, and what each one does
Each action has a precise role. Mixing them up is the main mistake to avoid.
| Action | What it does | When to use it | Plan |
|---|---|---|---|
| Turn on Travel Mode | Copy to the recipient, then removes unticked missions from the phone and hides them in the cloud. | Before any risky crossing, with a network. | Pro |
| Recross | Empties the device again to match the current boxes. While the mode is on, missions can only be removed, not added. | Before another crossing, without leaving the mode. | Pro |
| Evacuate a .ntilia | Shares an encrypted file of the whole notebook (to a colleague, a messaging app), then empties the device. | No network, and a trusted contact within reach. | Pro |
| Empty this device | Destroys the vault key, erases nTilia from the phone, turns the mode on for the account, then signs the device out. The cloud stays, hidden. | The checkpoint comes too early, but the cloud is your copy. | All |
| Burn everything | Like Empty, and also destroys your private cloud. The recipient’s copy and the public journal are not touched. | Last resort, once the copy off you already exists. | All |
| Empty or burn remotely | From another device, or by your recipient: every device on the account erases itself the next time it connects. | Phone seized or out of sight. | All |
| Hide the journal | Profile, articles, feeds, sitemaps and the fediverse return “not found” for everyone but you. | When reading your articles could expose you. | All |
| Prepare to leave | Syncs and leaves a ZIP of the mission on the phone. It is not a checkpoint action. | Expected network outage, never before a search. | All |
Built to hold under duress
A mode you can turn off with one finger protects nothing: someone just has to make you turn it off. nTilia closes those doors on the server, where the seized device cannot change anything.
The safe recipient’s role
The safe recipient is another nTilia account: an editor, a desk, a trusted person who is not crossing with you. They have no access to your cloud. They only receive end-to-end encrypted copies of your notebook, which they can open with their own vault.
In their settings, an “Accounts that trust you” section lets them act when you no longer can:
- approve your deactivation request, after checking through another channel that you are safe;
- empty your devices remotely, or destroy your private cloud;
- hide your public journal (only you will be able to restore it).
Encryption: what is encrypted, and why not everything
On the phone, the vault encrypts the whole notebook at rest, on every plan. Device-only notes are never synced. Copies sent to the safe recipient are end-to-end encrypted: neither nTilia nor anyone else can read them.
Sync to the nTilia cloud is not end-to-end encrypted, and that is deliberate: an article published in the journal has to be readable by everyone, which is impossible if it is end-to-end encrypted. Publishing stays optional: what you don’t publish can stay on the device, encrypted by the vault.
What Travel Mode does not do
- nTilia is not the whole phone: Signal, the camera roll, maps and downloaded files remain searchable. Long PIN, biometrics off, and a manual check before the line.
- It is not a forensic wipe. The vault makes whatever remains on disk unreadable: its strength depends on your phrase.
- A device that stays offline is not reached by a remote wipe.
- What already travelled stays out of reach: Zenodo DOIs, journal subscribers, sites that picked up an article.
- Without a copy off you, Burn destroys the story too. Check the copy has left before burning.
Checklist before you leave
- Vault on, with a long phrase you know by heart (it must not be on the phone).
- Safe recipient named, who has opened their vault at least once.
- First copy received by the recipient (shown in your settings).
- Logistics missions ticked, sources unticked.
- Device-only notes evacuated or switched to synced notes.
- Public journal reviewed: should it be hidden during the trip?
- Outside nTilia: long PIN, biometrics off, camera roll, Files, messaging apps and maps checked.
Frequently asked questions
What is nTilia’s Travel Mode?
A feature that removes your sensitive notes from the phone before a risky crossing, after handing an end-to-end encrypted copy to a safe recipient. When you are checked, the phone only shows what you chose to carry.
How is it different from an encrypted notes app?
Encryption protects against theft and servers, not against someone demanding that you unlock. Travel Mode makes sure the sensitive note is no longer on the device when it is searched, and that nobody can make you bring it back on the spot.
What happens if I am forced to turn Travel Mode off?
Deactivation only takes effect after 24 hours, unless your safe recipient approves it, and they are notified. You cannot hand over the notebook on the spot, even if you wanted to.
What if they keep my phone?
From another device, or through your recipient, you can empty or burn the account remotely. The phone erases itself as soon as it gets a network. If it stays offline, nothing reaches it: empty it before the line.
What is the difference between Empty and Burn?
Both erase the phone, destroy the vault key and sign the device out. Empty keeps your cloud, hidden: it is your copy. Burn also destroys the private cloud; only the recipient’s copy remains.
Does my public journal stay online?
Yes, by default, even after Burn. You can hide it: pages, feeds and sitemaps then return “not found”, and it cannot be restored while Travel Mode is on.
Do I need a paid plan?
Travel Mode and the safe recipient are included from Pro. The vault, Empty, Burn, remote wipe, hiding the journal and reimporting a copy are free: protecting yourself is never paywalled.
Can my recipient read my notes?
Yes, that is their role: they receive a copy they open with their vault, so they can give it back to you. They have no access to your cloud and cannot turn the mode off without your request. Choose someone you trust.
Does Travel Mode work without a network?
Full activation needs a network. Without one, evacuate a .ntilia file to a trusted contact, or use Empty: the mode turns on for the account, and sign-out follows, at the first signal.
Travel Mode and safe recipient: from Pro. Vault, Empty, Burn, remote wipe and hidden journal: on every plan.