Android Backup Rules: Keep Sensitive Data Out of Backups

Inventory data before writing exclusions

List authentication tokens, private user content, cached server responses and device-bound state. Decide which data should survive device replacement and which must be regenerated or reauthenticated. Restoring unusable encrypted data can be a reliability problem even when the ciphertext is not directly readable.

The Android backup documentation distinguishes configuration behavior across Android versions and backup or device-transfer paths. Use the rule format appropriate for the API levels you support rather than assuming one manifest flag covers every transfer scenario.

Keep legacy and newer rules coherent

Apps may need both older fullBackupContent rules and newer dataExtractionRules, depending on supported devices and target behavior. Review cloud backup and device-to-device transfer separately.

An illustrative newer rule fragment excludes a sensitive preferences file from cloud backup:

<data-extraction-rules>
    <cloud-backup>
        <exclude domain="sharedpref" path="session.xml" />
    </cloud-backup>
</data-extraction-rules>

This fragment is not a complete policy. Add the intended device-transfer rules and verify actual filenames and storage domains. A wrong path can make an exclusion ineffective.

Test restoration, not just XML

Create synthetic data, trigger the supported test workflow for your environment, and restore into a clean installation or test device. Confirm which data returns and whether the app handles missing credentials gracefully.

Do not assume Android Keystore keys will be restored alongside encrypted preferences. Design the app to recover safely when protected data exists but its device-bound key does not.

Avoid broad claims from one flag

allowBackup and related settings need to be interpreted with device version, target SDK and transfer behavior. Record the tested combinations. “Backups disabled” is too strong when only one path was inspected.

Inspect the packaged policy

APKLint's manifest and security review can help identify backup-related declarations. The decisive evidence is the packaged rule set plus a controlled restore test. Do not mark a data-handling review complete merely because the manifest contains a restrictive-looking attribute.