Local-first manager. Unlock with a passphrase to encrypt/decrypt records end-to-end in your browser — the gateway and device only ever see ciphertext.