Recover your Inbox and restore purchases

On a compatible primary phone, export the encrypted recovery package after local identity confirmation. It contains root and phone receiver material, never Source private keys or a plaintext message database. Save the separate recovery code securely; it is not inside the file.

Import the package and enter the recovery code. The client verifies it without changing the working configuration on failure. New root and receiver keys must be saved locally before committing the migration. After successful rotation, old phone and browser sessions stop working and pending requests from before recovery are cancelled.

Export an updated recovery package.

Only still-retained ciphertext addressed to the recovered phone keys can be read. Already-expired history cannot be promised. An old backup cannot take over an Inbox whose root has already rotated. Sources keep their own keys; reconnect when migration or authorization requires it.

The original store can restore a valid entitlement without restoring any message keys. If all keys and backups are lost, support cannot decrypt your Inbox. Starting fresh requires an explicit service switch if the entitlement has an active Inbox; it does not silently reactivate or decrypt the old one.

Android supports the existing recovery format and single-primary-phone model. Migration rotates the root/phone and revokes the previous phone; it does not add a second primary Inbox. Bidirectional physical iPhone/Android migration and minimum installed iPhone compatibility are still being verified. Purchase restore queries only the current store and does not supply old encryption keys.

Existing legitimate Inbox rights from another store stay associated with that Inbox; they are not automatically converted into a purchase in the new store.