docs: Update FAQ with sync features and troubleshooting

- Updated sync question with built-in rclone sync options
- Clarified cloud data question (optional encrypted sync)
- Added sync recovery to vault loss question
- Updated security answer for local-first with optional sync
- Added new FAQs for sync status check and troubleshooting

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: arimxyer

docs/04-troubleshooting/faq.md

@@ -38,20 +38,26 @@ For automated backups, you can use cron with the backup command or copy the vaul
 
 **Q: Can I sync my vault across machines?**
 
-A: Yes, but carefully:
-```bash
-# Option 1: Symlink to cloud storage
-ln -s ~/Dropbox/vault.enc ~/.pass-cli/vault.enc
+A: Yes! Pass-CLI has built-in cloud sync via rclone:
 
-# Option 2: Configure vault_path to point to cloud storage
-echo "vault_path: ~/Dropbox/vault.enc" > ~/.pass-cli/config.yml
+```bash
+# Option 1: Enable sync on existing vault
+pass-cli sync enable
+# Follow prompts to configure remote (e.g., gdrive:.pass-cli)
 
-# Option 3: Manual copy (requires keeping in sync)
-cp ~/.pass-cli/vault.enc ~/Dropbox/vault.enc
+# Option 2: Connect to existing synced vault on new device
+pass-cli init
+# Select "Connect to existing synced vault" when prompted
 
-# Warning: Conflicts if editing on multiple machines simultaneously
+# Option 3: Set up sync during new vault creation
+pass-cli init
+# Select "Create new vault", then enable sync when prompted
 ```
 
+Sync automatically pulls on first use and pushes after write operations. See [Sync Guide](../02-guides/sync-guide.md) for full details.
+
+**Note**: Requires [rclone](https://rclone.org) installed and configured with at least one remote.
+
 ---
 
 **Q: How do I change my master password?**
@@ -82,20 +88,23 @@ You'll be prompted to enter 6 words from your 24-word recovery phrase to verify
 
 **Q: Is my data sent to the cloud?**
 
-A: No. Pass-CLI:
-- [OK] Works completely offline
-- [OK] Never makes network calls
-- [OK] Stores everything locally
-- [OK] No telemetry or tracking
+A: By default, no. Pass-CLI:
+- ✅ Works completely offline by default
+- ✅ Stores everything locally
+- ✅ No telemetry or tracking
+- ✅ Optional cloud sync (you control if/when enabled)
+
+If you enable cloud sync, your **encrypted** vault is synced to your configured rclone remote. Your master password and decrypted credentials never leave your device.
 
 ---
 
 **Q: What happens if I lose my vault file?**
 
 A:
-- If you have backup: Restore from backup
-- If no backup: All credentials lost, must start over
-- Prevention: Regular backups essential
+- **If sync enabled**: Run `pass-cli init` and connect to your synced vault
+- **If you have backup**: Restore with `pass-cli vault backup restore`
+- **If no backup or sync**: All credentials lost, must start over
+- **Prevention**: Enable cloud sync or create regular backups
 
 ---
 
@@ -121,9 +130,9 @@ pass-cli list --format json | jq '.[] | .service'
 
 A: See [Security Architecture](../03-reference/security-architecture) for full details:
 - AES-256-GCM encryption
-- PBKDF2 key derivation (600,000 iterations as of January 2025)
+- PBKDF2 key derivation (600,000 iterations)
 - System keychain integration
-- No cloud dependencies
+- Local-first with optional encrypted cloud sync
 - Limitations explained in security doc
 
 ---
@@ -148,3 +157,40 @@ A: Individual credentials cannot be recovered:
 
 ---
 
+**Q: How do I check if sync is working?**
+
+A: Use the doctor command:
+```bash
+pass-cli doctor
+```
+
+This shows sync status including:
+- Whether sync is enabled
+- rclone installation status
+- Remote configuration
+- Any connectivity issues
+
+---
+
+**Q: Sync failed - what should I do?**
+
+A: Sync failures are non-blocking (your local vault still works). To troubleshoot:
+
+```bash
+# Check sync configuration
+pass-cli doctor
+
+# Verify rclone can reach your remote
+rclone lsd your-remote:.pass-cli
+
+# Check rclone config
+rclone config
+
+# Manual sync (if needed)
+rclone sync ~/.pass-cli your-remote:.pass-cli
+```
+
+See [Sync Troubleshooting](../02-guides/sync-guide.md#troubleshooting) for more details.
+
+---
+