# Travel Mode — nTilia > A fictional story: a Pro journalist comes back from a sensitive area. At the barrier they search the phone. They find the hotel. Not the sources. Canonical: https://ntilia.com/en/travel A freelance Pro. Three weeks in the field. Léa, at the desk, already has the file. I’m a freelancer, nTilia Pro. Three weeks of interviews in a place where, on the way out, phones get searched — a border post or a makeshift checkpoint, you never know early enough. Léa, at the desk, already has the encrypted file. Tomorrow morning I’ll be in the line. They can open everything: nTilia, Signal, the camera roll. What they should find on my phone: a hotel contact, a permit. What they should no longer find: the names. You don’t improvise that at the barrier. You prepare it before you leave. A fictional story. No country, no armed force named. nTilia does not wipe the phone: Signal, photos, maps, and already-downloaded ZIPs remain searchable. IndexedDB is not a forensic wipe. ## Before leaving. At the barrier. Once somewhere safe. 1. **Léa has the file before I leave** — I name her nTilia account. Whenever the notebook changes, an encrypted snapshot reaches her — she opens it with her vault, I open it with my phrase. This is not a ZIP in Files — that one they’d find in my pocket. 2. **They open nTilia. They see the hotel.** — A hotel note, a permit. Not the interviews. Signal, photos, maps: nTilia did not touch those. I took care of that myself. 3. **Léa sends the file back** — I open it with the vault phrase. The account password is not enough. The same notes come back. ## Too late to evacuate. It depends where the copy is. - **Léa already has it, or a .ntilia is off me** — Burn. Phone and private cloud empty. Her copy is not destroyed. - **Only this account’s nTilia cloud** — Empty, don’t burn. The cloud stays. Somewhere safe: Restore. Burn would also kill the copy I can get back. - **Nothing left this phone** — Choose: the scoop on the device, or an empty device. nTilia does not do both. ## I don’t leave with the names in my pocket Three weeks before I come back, I’m still at the desk. I don’t wait for the barrier. I create two Missions. “Logistics”: the hotel at the crossroads, public contacts, the permit. I check it: that one, I take with me. “Sources”: the interviews, the names. Unchecked. In Settings I type Léa’s nTilia account, at the desk. From the first sync, an encrypted file reaches her; her vault opens it, she can read at the desk without waiting for me. Burn can empty my cloud; her copy, no. I do not tap “Prepare to leave”: that ZIP would sit in Files, still searchable. That’s for a network outage. Not for a checkpoint. The scoop survives if it has already left the phone. ## What doesn’t cross, I remove. It’s still dark. Nobody on the track. This is now, not at the barrier. There’s still a network: I turn on Travel Mode. Notes outside logistics leave this device. The vault locks. If there were no network, I’d share a .ntilia with a colleague who isn’t crossing — then confirm the file is no longer here, before I purge. A ZIP in Downloads is still the scoop in a pocket. I also clear Signal, the camera roll, the maps. nTilia will not do that for me. What’s left is the hotel. The rest is no longer here. ## At the barrier, they find the hotel. The line isn’t moving. They take my phone. They open nTilia. A hotel contact, a permit. Not the names. The journal I’d already published stays online — yesterday’s piece isn’t a secret. Signal, the camera roll, maps, a ZIP forgotten in Files: nTilia didn’t touch those. This is not a factory reset. It’s an empty notebook, not a new phone. They close it. I go through. nTilia is not the phone. ## If it comes too soon, I don’t burn at random. A colleague called me once: too late to send the drop. The rule is where the last copy is. If Léa already has it, or a .ntilia is already off me: Burn. Phone and private cloud empty; her copy, intact. If I only have this account’s nTilia cloud: Empty, not Burn — otherwise I also kill the copy I can restore somewhere safe. If nothing left me: choose. The scoop on the device, or an empty device. nTilia does not do both. Without a copy off me, Burn kills the scoop. ## Léa sends the file back. A room, Wi-Fi, the other side of the barrier. Léa sends me the .ntilia. I open it with the vault phrase — the account password is not enough, and that phrase was not on the phone. The same notes come back, then I push to an empty cloud. The already-public journal was not burned. What doesn’t come back: local version history, the glossary. The story is there. The copy that mattered was already with Léa. ## What I no longer mix up - **Prepare to leave** — Sync + ZIP on this device. For a network outage. The opposite of a checkpoint: the file stays searchable. - **Travel Mode** — Sensitive notes leave the device. Logistics can stay. The off-body copy is already with Léa. From Pro. - **Empty / Burn** — Last resort in the line. Empty leaves the cloud. Burn destroys it — not the drop with Léa. ## Three questions before you go. **No network?** I share a .ntilia with a colleague who isn’t crossing, confirm the file is no longer here, then purge. A download in Files is still the scoop in a pocket. **No recipient?** Travel Mode still empties the device. Burn also kills my cloud — and the scoop, if no .ntilia already left. **What about Signal, photos?** nTilia is not the phone. Long PIN, biometrics off, Files, camera roll, maps: a checklist, not magic. I do that myself, before the line. I don’t disguise a notebook. I take it off the device that will be searched, because a copy this account cannot destroy already exists — with Léa.