77Fox77Fox is a Windows desktop app (with a web console) that syncs your prompts, references, finance and task data between devices by encrypting each sync bundle with AES-256-GCM on your device and writing it into your own Google Drive. The data key is managed through your Google authorisation and is never sent to the 77Fox account service, so there is no second sync password to remember and 77Fox has no means of decrypting what you upload. 77Fox servers hold only account, device, entitlement, short-lived verification events and encrypted mail connection settings.
This guide explains what that design protects against, what it deliberately refuses to do, and what happens in the failure cases that matter: a damaged bundle, two devices editing the same record, and the wrong account.
Who holds the data
| Data | Where it lives | Who can read it |
|---|---|---|
| Prompts, references, finance, tasks, workspace, plugins, AI news, extension settings | Your machine; with sync on, encrypted bundles in your own Google Drive | You, on your devices |
| Data key | Managed through your Google authorisation | Not sent to the 77Fox account service |
| Account, device, entitlement records | 77Fox servers | 77Fox, for sign-in and plan checks |
| Verification-code events | 77Fox servers, briefly | Retained normally for no more than five minutes; message bodies are not written to disk, databases or logs |
| Mail app passwords or IMAP authorisation codes | 77Fox servers, encrypted with AES-256-GCM | Needed to fetch email verification codes |
Each Google account uses an isolated profile directory and its own sync key, invisible to other accounts on the same machine.
Encryption before upload
Sync bundles are encrypted with AES-256-GCM before they leave your device. GCM provides both confidentiality and an integrity tag, which is what lets the app detect a damaged or tampered bundle rather than silently loading it. Because the key is derived through your Google authorisation, signing in on a new device is enough to pick your data up; there is no extra passphrase, and nothing for the account service to store.
Every sync is a complete snapshot
Each sync produces one complete, unalterable snapshot and then switches over to it as a whole. There is no half-written intermediate state, so losing the network, shutting down or quitting suddenly cannot leave half your data behind.
Data is stored in separate areas (prompts, finance, workspace, plugins, AI news, extensions). Any area that has not changed reuses last time's result instead of uploading again, which keeps routine syncs light. Every area carries a check value that is verified before the data is used.
Break the circuit, do not overwrite
This is the most important behavioural guarantee. The moment a check suggests data may be damaged, sync stops and switches to read-only rather than pushing possibly corrupt content to the cloud. Recovery is deliberate: it requires publishing a verified recovery copy, and the web console intentionally offers no recovery-publish entry point.
If cloud data is detected as belonging to a different account, the overwrite is blocked outright and you are asked to sign out and back in. The intent is explicit: stop and ask rather than silently overwrite.
Local-first merging
A complete, usable copy always lives on your device, so offline use is unaffected. When two devices edit the same thing, merges keep conflicts as records instead of picking a winner for you. Sync progress is visible, requests fired at the same time are merged to avoid duplicate uploads, and error states can be retried.
Threat model
| Scenario | What happens |
|---|---|
| Someone obtains your Google Drive files | They hold AES-256-GCM ciphertext without the key |
| 77Fox servers are compromised | No prompt, finance or task content is there to take; only account, device, entitlement, short-lived verification events and encrypted mail settings |
| A bundle is corrupted in transit or on disk | The check value fails, sync turns read-only, nothing corrupt is pushed |
| Two devices edit the same prompt | Both changes survive as records; nothing is overwritten |
| You sign in with the wrong Google account | The overwrite is blocked and you are asked to sign out and back in |
| You delete your 77Fox account | Sessions and devices are revoked and verification queues and encrypted mail settings are cleared; local data and your Drive files stay under your control and are removed separately |
Tokens and sessions
Desktop, web and the browser extension each use a token storage boundary appropriate to their environment, and sensitive tokens are kept out of ordinary persistent storage. The account service uses short-lived access tokens, refresh-token rotation, least privilege and isolated server file permissions.
Where the boundary is different: shared canvas
One feature is a deliberate exception. Shared canvases, where up to 20 people draw, edit text and arrange media together, use the 77Fox cloud so that guests can join by link, and media on a shared canvas counts against the creator's plan storage. Private canvases stay local with optional personal Google Drive sync. If a canvas must stay inside the encrypted boundary, keep it private.
FAQ
Can 77Fox read what I sync?
No. Bundles are encrypted with AES-256-GCM before upload, the data key is managed through your Google authorisation and never sent to the 77Fox account service, and the data itself lives in your own Google Drive.
Do I need a separate sync password?
No. The data key is managed through your Google authorisation.
Could a sync error corrupt my data?
No. When a check finds a problem, sync stops and turns read-only instead of writing to the cloud. Recovery requires publishing a verified copy.
Is sync a paid feature?
No. Encrypted sync is part of the free core; the pricing page lists it among the features included at every level, and the free core stays free.
If I delete my 77Fox account, is my Google Drive data gone?
No. Deleting the cloud account revokes sessions and devices and clears verification queues and encrypted mail settings. Local data and your Drive sync files remain under your control and are deleted separately.