Who holds the data
The boundary first. Ordinary app data is never uploaded to 77Fox servers. Prompts, finance and tasks stay on your machine and, with sync enabled, are written into your own Google Drive. 77Fox servers hold only account, device, entitlement, short-lived verification events and encrypted mail connection settings.
Each Google account uses an isolated profile directory and its own sync key, invisible to other accounts.
Encryption happens before upload
Sync bundles are encrypted with AES-256-GCM before they leave your device. The data key is managed through your Google authorization and is never sent to the 77Fox account service, so you need no separate sync password — and 77Fox has no means of decrypting what you upload.
Every sync is a complete snapshot
Each sync produces one complete, unalterable snapshot and then switches over to it as a whole, so there is no half-written intermediate state. Losing the network, shutting down or quitting suddenly cannot leave half your data behind.
Data is stored in separate areas — prompts, finance, workspace, plugins, AI news, extensions — and any area that has not changed simply reuses last time's result instead of uploading again. That is why routine syncs are light.
Every area carries a check value, verified before the data is used.
Break the circuit, don't overwrite
This is the most important behavioural guarantee in the whole design. The moment a check suggests data may be damaged, sync stops and switches to read-only rather than pushing possibly corrupt content to the cloud. Recovery is deliberate: it requires publishing a verified recovery copy.
If cloud data is detected as belonging to a different account, the overwrite is blocked outright and you are asked to sign out and back in. The intent is explicit: stop and ask rather than silently overwrite.
Local-first merging
Local-first means a complete, usable copy always lives on your device and offline use is unaffected.
When two devices edit the same thing, merges keep conflicts as records instead of picking a winner for you. How far a sync has progressed is visible, requests fired at the same time are merged to avoid duplicate uploads and duplicated work, and error states can be retried.
Tokens and sessions
Desktop, web and the browser extension each use a token storage boundary appropriate to their environment, and sensitive tokens are kept out of ordinary persistent storage. The account service uses short-lived access tokens, refresh-token rotation, least privilege and isolated server file permissions.
Deletion and withdrawal
You can permanently delete your cloud account from Settings → Account. Deletion immediately revokes sessions and devices and clears verification queues and encrypted mail settings. Local data and the data in your Google Drive stay under your control and are removed separately — deleting your 77Fox account does not delete your Drive sync files.
Canvas
Pen, eraser, text, arrows and nodes that link to each other, plus images and videos dropped or pasted in, put ideas, storyboards and references on one canvas. Undo and redo keep 200 steps and the history panel jumps back to any of them; a screenshot copies to the clipboard or saves as PNG; a whole canvas exports as a .77foxcanvas file and imports again; the minimap in the corner shows the full board and the current viewport. Create, duplicate and rename canvases at will. Private canvases stay on your machine and can be synced per canvas to your own Google Drive.
Sign in as the creator to share one canvas. Set an editing password and copy the link with its password in one click. Guests open it, get the password filled in and enter a nickname to edit. You can also share a password-free view link and revoke access at any time. Private canvases stay local with optional personal Google Drive sync. Shared canvases use the 77Fox cloud; media counts against the creator’s plan storage.
Messages and group calls
The Windows desktop app lets you start voice calls from Messages, by email or in a workspace, with up to six people and more added mid-call; the web console handles messages only.
Incoming-call rules and more about calls are on the workspaces page.
Data backup and restore
Make a full backup or choose only the data you want; related data comes along automatically. Before a restore, you see what will be added, what conflicts and what a replace would remove, then choose Merge or Replace. Merge keeps both sides and lets this device win on conflicts; Replace only overwrites the data you selected. A recovery point is saved first, so a failed restore puts everything back the way it was.
A full backup includes business content, all recordings and media, and each prompt's text, versions, categories, tags and media are backed up and restored together. The desktop app can back up all business data; the web console backs up only what the browser holds, up to 128 MB per backup. Accounts and MCP credentials aren't included, so you set them up again on a new device; local models and caches are managed separately.
API keys don't travel with backups either. To move them, use the API key vault's encrypted export and import it on the new computer.