Who holds the data
The boundary first. Ordinary app data is never uploaded to 77Fox servers. Prompts, finance and tasks stay on your machine and, with sync enabled, are written into your own Google Drive. 77Fox servers hold only account, device, entitlement, short-lived verification events and encrypted mail connection settings.
Each Google account uses an isolated profile directory and its own sync key, invisible to other accounts.
Encryption happens before upload
Sync bundles are encrypted with AES-256-GCM before they leave your device. The data key is managed through your Google authorization and is never sent to the 77Fox account service, so you need no separate sync password — and 77Fox has no means of decrypting what you upload.
Every sync is a complete snapshot
Each sync produces one complete, unalterable snapshot and then switches over to it as a whole, so there is no half-written intermediate state. Losing the network, shutting down or quitting suddenly cannot leave half your data behind.
Data is stored in separate areas — prompts, finance, workspace, plugins, AI news, extensions — and any area that has not changed simply reuses last time's result instead of uploading again. That is why routine syncs are light.
Every area carries a check value, verified before the data is used.
Break the circuit, don't overwrite
This is the most important behavioural guarantee in the whole design. The moment a check suggests data may be damaged, sync stops and switches to read-only rather than pushing possibly corrupt content to the cloud. Recovery is deliberate: it requires publishing a verified recovery copy.
If cloud data is detected as belonging to a different account, the overwrite is blocked outright and you are asked to sign out and back in. The intent is explicit: stop and ask rather than silently overwrite.
Local-first merging
Local-first means a complete, usable copy always lives on your device and offline use is unaffected.
When two devices edit the same thing, merges keep conflicts as records instead of picking a winner for you. How far a sync has progressed is visible, requests fired at the same time are merged to avoid duplicate uploads and duplicated work, and error states can be retried.
Tokens and sessions
Desktop, web and the browser extension each use a token storage boundary appropriate to their environment, and sensitive tokens are kept out of ordinary persistent storage. The account service uses short-lived access tokens, refresh-token rotation, least privilege and isolated server file permissions.
Deletion and withdrawal
You can permanently delete your cloud account from Settings → Account. Deletion immediately revokes sessions and devices and clears verification queues and encrypted mail settings. Local data and the data in your Google Drive stay under your control and are removed separately — deleting your 77Fox account does not delete your Drive sync files.