Sync & Backup

Optional encrypted backup to your own Google Drive. Upload domains when you choose, list remote hosts in All Hosts, and Keep only what you need on this device — Zync never keeps a copy in its infrastructure.

How sync works

Zync sync is local-first. Your workspace lives on your machine by default. When you enable sync, Zync uploads encrypted domain records to Google drive.appdata — a hidden app folder in your Google account, not ordinary Drive files you browse by hand.

Your cloud account — OAuth connects to your Google account; Zync does not host workspace data.
Encrypted before upload — Google encryption uses a collection key unlocked by a passphrase (local vault passphrase policy or a custom sync passphrase) and optional recovery key.
Manual upload and restore — There is no background auto-sync scheduler yet; you upload and restore domains explicitly from the Sync & Backup workspace.
Selective hosts — You can list hosts that exist on Drive in the sidebar and Keep individual hosts onto this device without replacing your whole local list.

Not a live shared secrets broker

Treat provider records as encrypted backups for your own devices. Host records do not carry plaintext passwords or key file paths — secrets live in Vault credentials when you use vault-backed auth. Review restore previews when you run a broader restore.

Open Sync & Backup

Open Sync & Backup from the sidebar (or Vault → Sync). From there you can:

Connect or disconnect Google Drive via OAuth.
Set up or unlock Google encryption (passphrase / recovery key) so Zync can encrypt and decrypt provider records.
Upload or Restore each domain (hosts, tunnels, snippets, settings, vault credentials) when you want — Sync on / off per domain.
Run a connections restore preview for scoped host + related data restore when you need a bulk operation.

Multi-location hosts (All Hosts)

After Google is connected and encryption is unlocked, the sidebar All Hosts list can show hosts that live on this device, only on the provider, or both — merged by a stable host identity (not by re-creating a new id every time).

All / Local / Remote — Filter the catalog when a provider is connected.
Refresh — Reloads the encrypted host inventory from Drive (requires encryption unlocked).
Keep — Saves that host onto this device (and referenced vault credentials when available).
Keep and open — Keep, then open a session. Jump-host chains are restored when needed so connect can succeed.

See Connections for adding hosts manually, folders, and privacy options.

What gets synced

Domain	What is stored on Drive
Hosts & folders	Host metadata (name, host, user, port, folders/tags) — not plaintext passwords or local key paths
Tunnels	Port forwarding rules
Snippets	Global and host-scoped commands
Settings	Selected workspace preferences
Vault credentials	Encrypted credential records (separate from host metadata; needs local vault to use)

Google OAuth

Official Zync builds use Google's installed/desktop OAuth flow with scoped access to Drive app data and your account email. Connecting sync requires your consent in the browser — extracting OAuth client metadata from the app binary alone does not grant access to anyone's Google data.

Disconnect or revoke flows clear stored provider tokens where implemented. See Security for passphrase, recovery, and operator guidance.

Roadmap

Additional cloud providers for personal multi-device sync and an optional self-hosted team backend are planned. Today ships with Google Drive only; team hosting is not available yet.

Troubleshooting

OAuth fails on custom builds — Release builds need a real GOOGLE_CLIENT_ID (see README). Dev builds without it cannot complete Google sync.
Wrong encryption passphrase — Provider records cannot be decrypted without the passphrase (or recovery key) that unlocked the collection that encrypted them. After a full local wipe, the same passphrase alone is not enough if the collection key was regenerated without a Drive key-wrap backup.
Sidebar still says unlock — Unlock Google encryption in Sync & Backup, then refresh All Hosts / Remote. Sync status and the host list share the same readiness state.
Remote list empty after connect — Confirm encryption is unlocked, then use the refresh control next to All / Local / Remote.
Restore preview looks unexpected — Cancel and pick a narrower restore scope, or Keep individual hosts from All Hosts instead of a bulk restore.
Concurrent vault/sync operations — Wait for in-progress upload or restore to finish before starting another.

Full architecture: VAULT.md on GitHub.