Sync & Backup
Back up selected Zync data to your Google Drive with optional encrypted sync.
Zync Sync & Backup is optional and local-first. Your workspace stays on this device unless you choose to upload selected data. Before upload, Zync encrypts the collection and stores it in the hidden drive.appdata area of your Google account. Zync does not keep a hosted copy of your collection.
How sync works
Section titled “How sync works”Open Sync & Backup from the sidebar, connect Google Drive, and set up or unlock the sync encryption. The recommended option reuses the same passphrase text as the Local Vault, while Zync derives and stores a separate provider collection key. You can choose a custom Google Sync passphrase for additional isolation.
Keep the chosen Google Sync passphrase and its provider recovery key safe. The provider recovery key unlocks only that Drive collection. It cannot unlock the Local Vault. Zync uploads neither the raw passphrase nor the raw recovery key.
Current sync actions are explicit. You choose when to upload or restore a domain. There is no background auto-sync scheduler today.
The Google Drive connection uses Google’s installed-app OAuth flow and asks for scoped access to the app-data area and account email. This is your Google account and your storage, not a Zync-hosted workspace.
What can be synced
Section titled “What can be synced”The available domains depend on the current Zync release and the controls shown in the app. They can include:
| Domain | Examples |
|---|---|
| Hosts and folders | Host names, addresses, users, ports, folders, and tags. Local key paths and plaintext passwords are not host metadata. |
| Tunnels | Port-forwarding rules. |
| Snippets | Global and host-scoped commands. |
| Settings | Selected workspace preferences. |
| Vault credentials | Encrypted credential records, when you explicitly back up or restore them. |
AI provider API keys are excluded from individual credential sync and full vault backup exports. They remain local to the device where they are stored.
Remote hosts and selective restore
Section titled “Remote hosts and selective restore”After Google Drive is connected and sync encryption is unlocked, All Hosts can show hosts that are local, remote, or present in both places. The list merges records by stable host identity.
- Refresh loads the encrypted host inventory from Drive.
- Keep materializes a selected host on this device without replacing the whole local list.
- Keep and open keeps the host and then opens its session. Referenced credentials must also be available locally or restored intentionally.
- A broader restore lets you review a scope before applying related host data.
Provider records are locations for the same logical host, not a second unrelated host database. Read Vault to understand how a host can reference a local credential.
What restore changes
Section titled “What restore changes”Before applying a broad restore, Zync downloads the encrypted collection and prepares a preview with counts and conflicts. Choose the domains you intend to restore before applying it.
- Credential restore writes selected encrypted provider records into the current Local Vault.
- Host-only restore can materialize hosts without restoring every credential immediately. A referenced credential can be restored when you intentionally pull or connect it later.
- Newer credential revisions update older local records. Older or identical remote records are skipped.
- A same-revision conflict is not silently overwritten. Review the conflict and decide which record to keep.
- Deletions use revisioned tombstones and apply only when the remote deletion is newer than the local record.
Legacy full-vault restore is a separate disaster-recovery action. It replaces the local vault file and requires the unlock material for that restored vault. Normal provider sync restores records into the current vault instead.
Google sign-in and Public URLs
Section titled “Google sign-in and Public URLs”Drive Sync uses its own Google desktop OAuth flow. It is separate from the GitHub or Google sign-in used for Public URLs. Public URLs sign-in does not grant access to drive.appdata, and Drive Sync does not create a Public URLs account.
Troubleshooting
Section titled “Troubleshooting”The remote list is empty
Section titled “The remote list is empty”Unlock Google encryption in Sync & Backup, then refresh All Hosts. Connecting the provider alone is not enough to read encrypted records.
Restore asks for a passphrase
Section titled “Restore asks for a passphrase”Use the Google Sync passphrase that created the collection. It may use the same text as the Local Vault passphrase, or it may be a custom passphrase. If both the passphrase and provider recovery key are unavailable, the collection cannot be decrypted.
I want one host on another device
Section titled “I want one host on another device”Use the remote host inventory and Keep that host, or use a scoped restore. Avoid copying raw vault files between devices.
OAuth does not complete
Section titled “OAuth does not complete”Google Sync requires a release build with its desktop OAuth configuration and your consent in the browser. If the browser flow fails, check the release notes or rebuild configuration before retrying.