# App Jam backups and saved data

Host0.5 has separate hosted design and saved-data backups. Both default on, with global and per-app opt-outs and explicit cloud-copy deletion. Data is encrypted on the user's device; the native credential vault, account tokens and recovery key are excluded. A new device needs the user's account and saved recovery kit. Never ask the person to paste that kit/key into chat. Backup is saved-copy recovery, not live cross-device data synchronization.

Design copies include installed or locally kept experience packages and personal app preferences. Data copies include granted native records, captured photos, native experience state and supported iPhone mini-app localStorage/IndexedDB. Downloadable caches/offline basemap downloads, browser cookies/session storage, CacheStorage and OPFS are excluded. Unsupported selected data causes an explicit failure rather than a partial-success claim. The current prototype fails auto-increment IndexedDB stores; use stable UUID record keys for new apps. Preserve existing database identities; never delete or replace someone's database merely to make a backup pass.

The prototype has100MiB per account and three completed copies per app/runtime/type; plain snapshots are bounded24MiB. Uploads are staged and appear complete only after integrity-checked atomic commit. Failed/interrupted uploads do not replace the last completed copy. Backups run while App Jam is open/online and resume across launches. Background iOS execution is not guaranteed.

Recovery and storage management are user controls under Settings. Source-reading tools export app definitions and assets only, not browser state, records, photos or vaults. There is no agent MCP backup-content read method. A baseline web app still has no native bridge; backup is an internal host operation.

For personal data, prefer native shared tables when agents need authorized record access, or IndexedDB for rich mini apps. Declare offline support honestly in `offline:{mode:'full'|'partial'|'none',summary}` and required API connections in `credentialRequirements`. A declaration does not connect a provider or make the app work offline; verify actual local assets, stored state, permission failures and network fallbacks. Old packages with no declaration display unknown support.