From 275d726996c507ee7e37b6a846fea08f7d0d1001 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 19 Jun 2026 09:35:27 +0000
Subject: [PATCH] Add explicit backup/data-extraction excludes as
 defense-in-depth

allowBackup is already false, but backup_rules.xml and
data_extraction_rules.xml were empty stubs. Add explicit <exclude>
entries for the sharedpref, database and DataStore (file/datastore)
domains so the signer's secret material can never leave the device
via cloud backup or device-to-device transfer even if backups were
ever enabled.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CX7WR4DwXfEyMW55r9jLjn
---
 app/src/main/res/xml/backup_rules.xml         | 22 +++++++++------
 .../main/res/xml/data_extraction_rules.xml    | 28 ++++++++++++-------
 2 files changed, 32 insertions(+), 18 deletions(-)

diff --git a/app/src/main/res/xml/backup_rules.xml b/app/src/main/res/xml/backup_rules.xml
index fa0f996d..3b24291e 100644
--- a/app/src/main/res/xml/backup_rules.xml
+++ b/app/src/main/res/xml/backup_rules.xml
@@ -1,13 +1,19 @@
 <?xml version="1.0" encoding="utf-8"?><!--
-   Sample backup rules file; uncomment and customize as necessary.
+   Backup rules used for fullBackupContent on devices older than API 31.
    See https://developer.android.com/guide/topics/data/autobackup
    for details.
-   Note: This file is ignored for devices older that API 31
-   See https://developer.android.com/about/versions/12/backup-restore
+
+   Amber sets android:allowBackup="false", so backups are already disabled.
+   These explicit excludes are defense-in-depth: even if backups were ever
+   enabled, the signer's secret material (encrypted keys, per-account
+   SharedPreferences, Room databases and DataStore files) must never leave
+   the device.
 -->
 <full-backup-content>
-    <!--
-   <include domain="sharedpref" path="."/>
-   <exclude domain="sharedpref" path="device.xml"/>
--->
-</full-backup-content>
\ No newline at end of file
+    <!-- Encrypted keys / settings live in SharedPreferences (prefs, prefs_<npub>). -->
+    <exclude domain="sharedpref" path="." />
+    <!-- Per-account apps/permissions, logs and history Room databases (amber_db_<npub>, etc.). -->
+    <exclude domain="database" path="." />
+    <!-- DataStore preferences (secure_datastore_<npub>, app_datastore). -->
+    <exclude domain="file" path="datastore" />
+</full-backup-content>
diff --git a/app/src/main/res/xml/data_extraction_rules.xml b/app/src/main/res/xml/data_extraction_rules.xml
index 9ee9997b..d8df61e6 100644
--- a/app/src/main/res/xml/data_extraction_rules.xml
+++ b/app/src/main/res/xml/data_extraction_rules.xml
@@ -1,19 +1,27 @@
 <?xml version="1.0" encoding="utf-8"?><!--
-   Sample data extraction rules file; uncomment and customize as necessary.
+   Data extraction rules for cloud backup and device-to-device transfer
+   on API 31+.
    See https://developer.android.com/about/versions/12/backup-restore#xml-changes
    for details.
+
+   Amber sets android:allowBackup="false", so cloud backups are already
+   disabled. These explicit excludes are defense-in-depth: the signer's
+   secret material (encrypted keys, per-account SharedPreferences, Room
+   databases and DataStore files) must never leave the device through
+   either cloud backup or device transfer.
 -->
 <data-extraction-rules>
     <cloud-backup>
-        <!-- TODO: Use <include> and <exclude> to control what is backed up.
-        <include .../>
-        <exclude .../>
-        -->
+        <!-- Encrypted keys / settings live in SharedPreferences (prefs, prefs_<npub>). -->
+        <exclude domain="sharedpref" path="." />
+        <!-- Per-account apps/permissions, logs and history Room databases (amber_db_<npub>, etc.). -->
+        <exclude domain="database" path="." />
+        <!-- DataStore preferences (secure_datastore_<npub>, app_datastore). -->
+        <exclude domain="file" path="datastore" />
     </cloud-backup>
-    <!--
     <device-transfer>
-        <include .../>
-        <exclude .../>
+        <exclude domain="sharedpref" path="." />
+        <exclude domain="database" path="." />
+        <exclude domain="file" path="datastore" />
     </device-transfer>
-    -->
-</data-extraction-rules>
\ No newline at end of file
+</data-extraction-rules>