# Where your data is kept

What Blabb keeps in its folder, what is in each part of it, and why copying those files to another machine does not make them readable.

Everything Blabb keeps is under one folder:

```
%LocalAppData%\Blabb
```

Paste that into File Explorer's address bar to open it. There is nothing outside it — no registry
sprawl, no files in Documents, nothing in a roaming profile.

## What is in there

The parts worth knowing about:

| Path | Contents |
| --- | --- |
| `config.json` | Your settings |
| `history.db` | Your dictation history, encrypted row by row |
| `glossary_log.jsonl` | Your saved words, and the corrections Blabb has learned from your edits |
| `secrets.dat` | Your licence and credentials, encrypted with Windows DPAPI and integrity-checked |
| `db_key.dat`, `hmac_key.dat`, `key_version.dat`, `key_rotation_date.dat` | The encryption keys and their bookkeeping — themselves protected by Windows DPAPI |
| `logs\` | Daily rolling logs — 14 files kept, 50 MB cap each |
| `audit\` | Audit records with a cryptographic chain of custody |

A note on each of the interesting ones.

### history.db

Every dictation you have kept, encrypted a row at a time rather than as one big blob. How long
entries survive is up to you — the **Keep dictation history** setting runs from *Don't save* to
*Forever*, and is set to **1 week** out of the box. See
[Privacy settings](/docs/configuration/privacy-settings/).

### secrets.dat

Your licence key and anything else that must not be read by another program on the machine. It is
encrypted with Windows DPAPI and carries an integrity check, so tampering is detected rather than
silently accepted.

### logs\

What Blabb was doing, in order, so an unexplained failure can be explained. Protected health
information is masked before anything is written. See
[Logs and getting help](/docs/common-issues/logs-and-support/).

### audit\

A tamper-evident record of security-relevant events. Each record is chained to the one before it,
so a record cannot be removed or altered without breaking the chain.

## Why copying the files elsewhere does not work

The keys that decrypt this data are tied to your Windows user account on this machine. So if
someone copies `history.db` or `secrets.dat` to another PC, or opens them under a different Windows
account, they get an unreadable file — the data is there, and the key that makes sense of it is not.

That is the property worth understanding, and it has one practical consequence: **your history and
your licence do not travel.** Backing up the folder to another machine gives you files that machine
cannot read. Set Blabb up fresh on a new PC and activate it with your licence key.

> [!WARNING]
> Anyone signed in as *you* on *this* PC can read this data — that is the same boundary Windows
> uses for the rest of your files. Encryption at rest protects against a stolen disk or a copied
> file, not against someone using your unlocked session.

## Next

- [Deleting your data](/docs/privacy/deleting-your-data/) — removing any of the above
- [Privacy settings](/docs/configuration/privacy-settings/) — retention, crash reports, and the
  delete button