Personal-use backup companion
Ember Budget Backups
Purpose
After owner-controlled setup, the app makes consistent snapshots of the private budget database, encrypts them locally with age, and uploads the ciphertext to an owner-private Google Drive folder. Server-side backups run nightly and after imports.
The owner keeps the private recovery identity separately and tests a downloaded backup with a local restore tool. Google authorization and a verified off-host restore are still required before real records can be imported.
Google access
The app requests only drive.file, covering files it creates or the owner explicitly selects. It creates a backup folder, uploads encrypted snapshots, reads backup metadata, and downloads ciphertext to verify hashes. This scope permits managing those files, including deletion; the current worker makes no deletion requests.
Control
Automatic backup deletion is disabled. The owner can revoke Google access and manually remove backups. Revocation does not erase existing copies.