Backup and restore
Your ledger lives on your device and nowhere else. That is the point of the app, and it has one consequence worth taking seriously: if you lose the device and have no backup file, the data is gone. We cannot recover it, because we never had it.
So the backup is not housekeeping. It is the whole safety net.
Making one
Open Backup & restore in settings. Create backup writes a single file you control, and Last backup tells you how long it has been.
You can put a password on the backup. It is used to derive the encryption key for that file, and it is not stored anywhere — which also means a forgotten password cannot be recovered or reset by anyone, including us. There is a separate Export all data to a file if what you want is a readable copy of your records rather than something to restore from.
Automatic backups, and the trap in the default
Automatic backup runs while you are using the app rather than in the background.
The default destination is storage private to the app. That is the safe default in one sense — nothing else on the phone can read it — and a trap in another: storage private to the app is deleted when the app is uninstalled. A default automatic backup will not survive reinstalling, moving phones, or clearing the app.
Choosing your own folder is the only destination whose files outlive the app. It is also the only one that can stop working without you touching the app — a folder permission revoked by Android, a stale reference on iOS, or a cloud folder that has gone offline. The trade is real in both directions, so check the date on Last backup occasionally rather than assuming.
Choosing a folder is available on Android and iOS.
Moving to a new phone
- Make a fresh backup on the old device and put the file somewhere you can reach from the new one.
- Install the app on the new device.
- Open Backup & restore and restore from the file, supplying the password if you set one.
A restore brings your accounts, transactions, budgets, bills, loans, goals and categories across.
Automatic backup does not switch itself back on. The setting deliberately does not travel with a password that cannot travel with it — restoring onto a new phone must not leave automatic backup apparently running with a secret the new device does not have. Turn it back on and pick a destination.
What a backup leaves behind, on purpose
A few things are not in the file, because carrying them across would be wrong rather than helpful:
- Paired devices and trusted networks. They describe the old phone’s relationships, not the new one’s.
- Senders still awaiting your review. Restoring these would hand the new device a list of questions about messages it does not have.
- The assistant’s search index. It is rebuilt from your records rather than copied.
Your financial records are unaffected by all of these — they are rebuilt or re-answered on the new device.
Restoring is deliberately picky
A restore refuses a file larger than 256 MB, and refuses one whose password settings demand an unreasonable amount of work to open. Both are guards against a malicious file rather than limits you are likely to meet with your own backup.
If you have not set an app PIN
The key to your database is held in the platform’s own secure storage. If you set a PIN, a recovery copy of the key is kept, wrapped by that PIN. Without a PIN there is no second copy — so if the secure storage entry is lost, which can happen when an OS restore moves an app across devices without its keychain, the way back in is your backup file.
Another reason to have one.