Backups we can't read: what iCloud and Google Drive still see

Clypy does not keep your clipboard history on our servers. Sync works device to device, and the relay that helps it along stores nothing. That leaves an obvious hole: lose every device, and you lose the history.

Backups close it. Since 0.5.0, Clypy can keep encrypted snapshots of your history in your own iCloud or Google Drive, sealed with a key that we never hold. This post explains how they work, and lists plainly what the cloud provider can still see and where backups stop.

Where they live

Backups go to storage you already have, never to ours.

• iCloud, on a Mac, iPhone or iPad, in Clypy's private database inside your own iCloud account.
• Google Drive, on every platform, in Drive's hidden app data folder. Clypy asks Google for access to that folder only, so it cannot see any of your other files, and the backups do not clutter your Drive.

Each device keeps its three newest snapshots and never touches another device's. A new snapshot never overwrites an old one: the oldest is deleted only after the new one is safely saved.

How a backup is sealed

All of your paired devices share one encryption key. It is created on your first device, handed over when you pair another, and never leaves your devices. Sync uses it, and so do backups.

A backup is one file in three parts:

1. A short header in plain text, so a backup can be listed before it is opened.
2. A manifest of your clips, collections and library settings, sealed with AES-256-GCM under that key, with a fresh nonce each time.
3. Your pictures, copied byte for byte in the encrypted form they are already stored in. The sealed manifest records each picture's size and SHA-256 hash, so one that was swapped or damaged is refused on restore.

There is no password to choose, so there is no weak password to guess. The key is a random 256-bit key, not something derived from a phrase you typed.

The recovery key

A key that never leaves your devices has an obvious problem. A phone you replace, or a computer you set up from scratch, starts with a new key and cannot open a single one of your old backups.

The recovery key solves that. It is your devices' key, written out for a person to keep:

CLYPY-RK1-XXXX-XXXX-…

It carries a checksum, so a mistyped or cut-off copy is refused rather than accepted. It ignores spaces, line breaks and capital letters, so a copy your notes app wrapped across two lines still works. On a computer, Clypy shows it in Settings, Backup, only after the same Touch ID, Windows Hello or system password check that reveals a concealed clip.

Keep it in your password manager. With it, anyone who has your backups can read them. Without it, and with no paired device left, nobody can, including us. Removing a device changes the key, so save the new recovery key afterwards; backups made before the change still open, because Clypy keeps the old keys.

What the provider can see

The contents are sealed. The header is not, on purpose: it is what lets Clypy list your backups and show you what each one holds before you pick one to restore. It contains:

• which kind of device made the backup, and when
• that device's name and id
• how many clips, collections and pictures it holds, and how many were left out
• which key sealed it, as an id rather than the key itself

So Apple or Google can tell that a laptop called "Work MacBook" backed up 3,800 clips last Tuesday. They cannot tell what any of those clips say. If a device name gives away more than you would like, rename the device in Clypy before you back up.

What goes in, and what stays out

A backup holds your clips, your collections, and library settings such as saved searches and pinned order. Pictures are included unless you turn off Back up images, which makes backups much smaller.

Left out: anything Clypy marked sensitive, which covers passwords, tokens and other secrets, along with Trash, expired clips and app preferences.

One thing goes in that you might not expect. Clips marked This device only are included, encrypted like everything else, because a backup of a device should be able to restore that device. When you restore one, it stays local-only on the device that restored it. If a clip must never leave the machine in any form, mark it sensitive as well: sensitive keeps it out of backups, and This device only keeps it out of sync.

When backups happen

This depends on the device, and it is the limit most worth knowing.

• Phones back up once a day by themselves once you switch a provider on, with a catch-up shortly after you open the app. If one fails, Settings says why.
• Computers back up when you click Back up now. There is no schedule on desktop yet, so a computer's latest backup is as recent as the last time you clicked.

An iPhone's iCloud backup also has a size limit. It still uses an older format, a single file of a few tens of megabytes, so pictures that do not fit are left out, and Clypy tells you how many. Google Drive backups use the newer format and have no such limit.

Restoring

Restoring is always something you start. Pick a snapshot, then either merge it into your current library or replace the library with it. Replace rolls back if it fails or you cancel. Clips you already have, clips you deleted for good, and clips older than your history setting are skipped.

Computers and phones keep their backups apart. A computer's backup restores on any of your computers, but a computer will not restore a phone's backup, and a phone will not restore a computer's. To move history between a phone and a computer, pair them and let sync carry it.

What is free

Making cloud backups is part of Clypy Pro. Everything else is free, and stays free if your license lapses: restoring and deleting the backups you already made, the recovery key, and on a computer, exporting your history to a .clypy file and importing it again. That file is the same encrypted format, so it opens only with your recovery key or on a paired device. A lapsed license never strands a backup.

Why we rebuilt them

Clypy had backups before 0.5.0. Each one was a single encrypted document holding the whole library, pictures included, which is still how an iPhone's iCloud backup works today. Then a real library of 3,846 clips and 266 MB of pictures tried to build one on a computer, and the app's web view climbed to 3.9 GB of memory doing it.

The format described above exists because of that library. The clips are sealed as one small manifest, and native code copies the pictures into the file one at a time, already encrypted, without them ever passing through the web view.

Backups are the one place Clypy puts your history in someone else's cloud, so we wanted them to be the dullest possible thing for that cloud to hold. For the rest of the design, read our security architecture.