Cloud Sync

Pia Cloud Sync keeps your conversations in sync across all your devices. With end-to-end encryption (E2EE), your device encrypts the content you sync before uploading it.

How It Works

1. You sign in to your Pia account
2. With E2EE on, your conversations are encrypted on your device before upload
3. The server stores their content encrypted; what it needs to sync them, such as timestamps and order, stays readable
4. Your other devices download and decrypt locally

No chat leaves this device before you sign in. Chats stay local until there is an account to sync them to.

Signing in uploads the chat history you built up beforehand, so a conversation you had before connecting an account travels with you. An installation that signed in under a version of Pia older than this keeps those earlier chats on that device only.

Clearing out old chats asks the server first

Which chats are old enough to remove is settled with Pia Cloud rather than from what one device happens to know:

• Opening a chat tells Pia Cloud you still want it. Reading a conversation used to count as using it on that device alone, so an old chat you kept coming back to still looked untouched to your other devices.
• A device that cannot reach the server clears nothing at all, rather than guessing.
• Importing an archive counts as opening those chats, so an import is not cleared out shortly afterwards for looking old.

See Assistant Chats & History for the retention setting itself.

One feature leaves the encrypted plane, and only when you say so

Background assignments hand work to your Pia server to run without you. Whatever runs that work has to read it, so the prompt and the records you pick are sent in plain text and held on the server while the run lasts. Nothing else syncs that way, it never happens without an explicit affirmation naming every record, and the answer comes back as an ordinary encrypted chat.

What the Account screen is for before you sign in

Settings → Account is where a Pia account is connected to this installation, so on a fresh install it exists precisely so you can decide whether to have one. Until you sign in it shows the sign-in options and nothing else — there is no separate profile, licence key or registration to fill in.

You do not need an account to use Pia. Chats, personas, memory, todos, reminders, Optimize and speech all work with no account at all, using an AI provider you configure yourself with your own API key. Signing in adds three things, and only these:

• Sync — your chats, personas, todos and settings on more than one device. Your memory vault is not synchronised; it stays on this device.
• Pia Cloud as a provider — using the server’s models instead of bringing your own API key. This is also what image attachments need.
• Server-delivered features — plugins, managed personas published by an administrator, and background assignments.

If none of those matter to you, leaving Account signed out is a perfectly normal way to run Pia, and nothing you create leaves your machine.

Signing In

1. Open Settings → Account
2. Sign in using one of these options:
   • Email and password — enter the credentials from your Pia account
   • Google — click the Google button to sign in with your Google account
   • Microsoft — click the Microsoft button to sign in with your Microsoft account
   • Sign in with Entra ID — if your organization uses Microsoft Entra ID, click this option to sign in with your work account

A loading spinner appears while Pia connects to the server.

Signed in with Microsoft using a work or school account, and Microsoft asked for permissions or showed an access request instead? See Signing In with Microsoft at Work.

Tip

Don’t have an account yet? Click Create Account to open the Pia website and sign up. If you forgot your password, click Forgot Password to reset it.

Your Account

Once signed in, you’ll see an account card with your name, email, and how you signed in.

Below that, Pia shows your sync status — when you last synced and how many items are stored in the cloud.

• Click Sync Now to manually push and pull changes. A progress indicator shows the sync in action.
• Click Sign Out to disconnect your account from this device. This also removes your end-to-end encryption key from the device. When you sign back in, Pia takes the key back from the server without setup. That works only if you have already confirmed the approving device on this computer; a device approved under an older version of Pia asks you to confirm it first (see Adding a Second Device). If another device approved this one, Pia may ask once for your recovery code — for example when that device has since been removed.

Your credits

If your server limits how many credits you can use, a Credits card appears below your account card. It shows only the limits your team has set, in this order:

• This week — how much of your own weekly allowance you’ve used.
• Free team pool this week — credits your team didn’t use last week, shared by everyone on a first-come, first-served basis. Pia spends these before your own allowance.
• Top-up credits — extra credits your team bought. Pia uses them once your own weekly allowance is gone, and they don’t expire.
• Last 24 hours and Last hour — what you’ve used in those rolling windows.
• Whole team, this week and Whole team, last 24 hours — what the whole team has spent against its shared cap.

A limit shows how much is used; the pool and the top-up credits show how much is left. The weekly rows also say when they reset.

If the free tier is paused, the card says so above the rows. If your team has no credit limits, or your server doesn’t report them, there is no card.

Exporting your data and deleting your account

• Click Export data to save everything your account holds as a ZIP archive. Pia asks where to put it. If you use end-to-end encryption, the encrypted content stays encrypted in the archive.
• Click Delete account to delete your Pia account. The dialog explains what happens: your access ends at once, and the server removes the data stored in the account when its deletion period has passed — on Pia Cloud, 14 days later.

In the Delete account dialog:

1. Click Export data now if you want to keep a copy. After the deletion, an export is no longer possible.
2. Tick I understand that my account and the data stored in it will be deleted.
3. If you sign in with email and password, enter your Password.
4. Click Delete account.

Pia then stops syncing and signs you out. What is stored on this device stays where it is.

End-to-End Encryption

E2EE means the content you sync is encrypted on your device before it leaves, and the server keeps your key only in encrypted form. Some things stay readable to the server. One is what it needs to sync: IDs, timestamps, order, and which column or list an item belongs to. The other is what it creates itself, such as your account, its sign-ins and its logs.

Pia suggests E2EE when you first set it up, and you can turn it on later here.

While you are signed in and syncing without E2EE, Settings → Account shows the notice Your synced data is not end-to-end encrypted, with two buttons:

• Turn on encryption starts the usual setup, the same as the steps below.
• Not now hides the notice. Pia doesn’t remember that choice, so the notice comes back the next time you start Pia.

Enabling E2EE

1. Sign in to your Pia account
2. Scroll to the End-to-End Encryption section
3. Flip the toggle to On
4. Wait for the progress indicator to finish — your device fingerprint appears once setup is complete

A progress indicator appears while encryption is set up. Once enabled, you’ll see your device fingerprint — a short code displayed in a monospace font that uniquely identifies this device. You can use this code to verify your device’s identity when setting up additional devices.

If encryption is already on for your account — because you turned it on from another device, say — Pia doesn’t set it up a second time and shows no new recovery code. This device is then set up like any additional device: by approval from another device or with your recovery code. See The encryption setup banner.

Caution

Once E2EE is set up for your account, you can’t turn it off in Pia. It goes away only together with what you have synced: when an administrator resets your account’s synced data, or when you delete your account.

Adding a Second Device

When you sign in on a new device with E2EE already enabled, Pia walks you through a short onboarding flow to securely share your encryption key.

On your original device, go to Settings → Account and click Check for device requests to approve the new device. The approval dialog shows the new device’s fingerprint, so you can compare it with the one on the new device. It also shows this device’s own fingerprint, which the new device will ask you to check next. You can find that fingerprint at any time under Settings → Account as Device fingerprint.

The new device accepts the key only with the approving device’s signature, which a self-hosted Pia Server hands back from version 1.3.50 on.

On the new device, once the key arrives, Pia shows Confirm the approving device: Approved by: with the name of the device that approved it, and that device’s fingerprint.

• If it is the same fingerprint your other device shows, click It matches. Only then does this device store the key, and both devices can read and write encrypted conversations.
• If it is different, click It doesn’t match. This device then doesn’t accept the key. The approving device may not be one of yours: on your other devices, reject any request you don’t recognize, then set up this device with your recovery code instead.

A device that was approved under an older version of Pia asks for this comparison once, the next time you sign in on it.

Approve a device that asks again only if you set it up again yourself

A device that has been set up again — after a reinstall, for example — asks for approval under the name it had before. Someone who holds only your account’s sign-in can cause exactly that request, with keys of their own under a name you trust, and approving it hands them your key.

The encryption setup banner

On a device that hasn’t been set up yet, a coloured bar sits across the top of the Pia window — on every screen, not just Settings:

End-to-end encryption setup required to sync your data. · Set up now

It means this device is signed in to an account that uses E2EE but doesn’t hold the encryption key yet. Nothing syncs while the bar is up. Your chats, todos and memories still work locally; chats and todos just don’t leave or reach this device.

The bar can also come back on a device that was set up before, when the server lists it as waiting for approval again — for example because its id was registered again with other keys. Set it up again the same way. Such a device no longer offers itself for approval in its own list of device requests.

Click Set up now to open End-to-End Encryption Setup, which offers two ways in:

Choice	Use it when
Approve from another device	You have another device with Pia already set up. It transfers the key to this one. Click Wait for approval, then approve on the other device.
Use recovery code	No approved device is available, or this device lost its key, for example after signing out. Click Enter recovery code, type the code you saved, and click Activate.

While waiting for approval, this device shows Your device fingerprint — a short code. On the other device, go to Settings → Account and click Check for device requests; compare the fingerprint before approving, and approve only a device you are setting up yourself. When the key arrives, this device asks you to Confirm the approving device: compare the fingerprint it shows with the one in the other device’s approval dialog, and click It matches only if they are the same (see Adding a Second Device). Then you’ll see Device activated! and the sync begins.

If you have neither an approved device nor the code, the encrypted data cannot be recovered — see Recovery Code.

Next Steps

Ready to start chatting? Head to Your First Conversation to learn the basics.

For a side-by-side of what leaves your device in each setup, see Where your data goes.