---
title: "Keep secrets out of device backups · Agent Wranglers"
url: https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/backup-exclusions
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep secrets out of device backups

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Data on the device](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: MOB-22
- Level: Recommended
- Chapter: [Data on the device](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device)
- Rule: Exclude tokens, keys and caches of personal data from cloud backups and device transfers. Keep what the person made, so a new phone restores it.
- How: Both systems back up app data by default. Android Auto Backup is on for apps that target Android 6 and later. On Android 12 and later, list exclusions in `dataExtractionRules` for both `cloud-backup` and `device-transfer`. Keep a `fullBackupContent` file too for Android 11 and lower. Files in `noBackupFilesDir` and the cache folder are never backed up. On iOS, mark caches with `isExcludedFromBackup`, and give Keychain items a `ThisDeviceOnly` class. After a restore, the app asks the person to sign in again, as [keep tokens and keys in the Keychain or Keystore](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/keychain-keystore) expects.
- Check: Back up a signed-in test device and restore it to a second device. The app on the second device asks for a sign-in, and the person's own drafts are there.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### XML example

```xml
<data-extraction-rules>
  <cloud-backup>
    <exclude domain="sharedpref" path="session.xml"/>
    <exclude domain="database" path="cache.db"/>
  </cloud-backup>
  <device-transfer>
    <exclude domain="sharedpref" path="session.xml"/>
  </device-transfer>
</data-extraction-rules>
```

### Plain text example

```swift
var values = URLResourceValues()
values.isExcludedFromBackup = true
var cacheURL = cacheDirectory.appendingPathComponent("feed-cache.sqlite")
try cacheURL.setResourceValues(values)
```

### Kotlin example

```kotlin
val deviceKeyFile = File(context.noBackupFilesDir, "device-key.bin")
deviceKeyFile.writeBytes(sealedDeviceKey)
```

## Sources

- [OWASP MASWE-0006, Sensitive Data Not Excluded From Backup](https://mas.owasp.org/MASWE/MASVS-STORAGE/MASWE-0006/)
- [Apple, isExcludedFromBackup](https://developer.apple.com/documentation/foundation/urlresourcevalues/isexcludedfrombackup)
- [Android, Back up user data with Auto Backup](https://developer.android.com/identity/data/autobackup)

## Related rules

- [Keep tokens and keys in the Keychain or Keystore](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/keychain-keystore) in Mobile apps

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/backup-exclusions">Agent Wranglers mobile apps playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Check that requests come from your app](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/app-attestation)
- Next: [Keep personal data out of device logs](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/no-personal-data-in-device-logs)
- [Data on the device](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device)