.env.example

# ── DataVault Encryption Key ──────────────────────────────────────────────────
# 32-byte key encoded as 64 hex characters.
# Used by XChaCha20-Poly1305 to encrypt ALL face images stored in data/vault/
# (portraits, detection screenshots, enrollment photos).
#
# Generate a new key with:
#   python scripts/generate_vault_key.py
#
# If this variable is NOT set, the vault runs in PASSTHROUGH mode:
# images are stored as plain .bin files (development use only).
#
# ⚠️  BACKUP RULES — READ CAREFULLY:
#   1. Back up  data/vault/  and  data/index/  regularly.
#   2. Back up  .env  (contains this key) SEPARATELY from the data folder.
#   3. NEVER store data/vault/ and .env in the same location.
#      If an attacker gets both, they can decrypt all face data.
#
TRACE_VAULT_KEY=your-64-hex-char-key-here

# ── Electron / Packaged App Data Root ────────────────────────────────────────
# When packaging as an Electron app, the Electron main process sets this to
# the OS user-data directory before spawning Python (e.g. %APPDATA%\TRACE-AML).
# In browser / dev mode: leave this UNSET — defaults to "data/" (project root).
# DO NOT set this during normal development.
# TRACE_DATA_ROOT=C:\Users\YourName\AppData\Roaming\TRACE-AML