Manual›Keep safe

Keep safe · Local by design

Safety, privacy, backups, and recovery

The app protects its own transactions aggressively. It does not replace a backup, encrypt readable metadata, or make the only copy of your source footage safe.

Where your data lives

The local metadata catalogue is:

~/Library/Application Support/After2AMManager/library.json

It contains channel, strategy, planning, episode, file-location, media, template, asset, and workflow metadata. Episode media lives in the storage folders you choose and is not embedded in this JSON file.

Readable JSON is not encrypted storage

macOS account permissions protect the file from other normal users, but the contents are readable. Enable FileVault and use encrypted backup destinations when titles, notes, schedules, or file locations are sensitive.

Protections that are always on

Atomic catalogue writesA coherent document replaces the previous catalogue in one operation.
Verified generationsThree recent decodable catalogue generations are retained.
Verified media importsHidden partial copies receive SHA-256 verification before commit.
Staged episode creationAn incomplete workspace never appears as the finished folder.
Verified archive and restoreExact inventory and every digest are checked before source removal.
Path and identity checksManaged paths, symlinks, manifests, and mounted volume identity are validated.

Build a backup plan around the app

  1. Keep original camera media untouched. Do not erase cards or source disks merely because import reports success.
  2. Back up the catalogue. Include the Application Support folder in a regular independent backup.
  3. Back up Primary storage. The catalogue knows where a file should be; it cannot recreate lost media.
  4. Back up Archive storage. An archive moves the working folder; it does not create redundancy by itself.
  5. Test restore. Periodically recover both metadata and representative media to a safe location.

Catalogue recovery

Before normal replacement, the app verifies and retains recent catalogue generations under library-backups. If the main catalogue is unreadable, the app first makes a collision-safe, byte-verified library.corrupt-*.json rescue copy.

If that rescue copy cannot be created, the original remains untouched and metadata writes fail closed. The app will not silently replace irreplaceable unreadable bytes with sample data.

Treat “Changes may not be saved” as blocking

This global banner means the in-memory view and the durable catalogue may differ. Stop making production assumptions based on recent edits.

  1. Choose Retry save. Resolve a temporary disk, permission, or capacity problem first when known.
  2. Choose Reveal library. Preserve the current catalogue and its containing folder.
  3. Preserve newly written media. A verified copy can exist even when its catalogue entry could not be saved.
  4. Do not quit until the situation is understood. Never assume the latest visible change is durable while the warning remains.

Interrupted operation recovery

Hidden import, thumbnail, episode, and transfer staging items left by an old interrupted process are not silently deleted. After a 24-hour grace period, they move beneath the affected root to: 

After2AM Recovery/Interrupted Operations/

Review recovered items before disposal. Script drafts use their own Recovery Drafts folder and are presented through the script editor’s conflict-aware recovery flow.