# Backup & restore

> Export everything, back up on a timer to places you choose, keep devices in sync, and control what Android's own backup may take.

URL: https://wmkeyboard.pages.dev/privacy/backup/
Section: Privacy & security

WM Keyboard backs itself up three ways. One is a config file you export and
move yourself. One is an automatic backup, on a timer, to places you choose.
The third is Android's own backup system, off until you turn it on. All of
them exist so a reinstall or a new phone doesn't mean retyping every setting
and rebuilding every theme. Separately, [sync](#sync-between-devices) keeps
two or more devices the same while you use them all.

  privacy/backup-restore-screen — Backup & restore: pick what to include, then export or import a file.

## Exporting a config file

Open **Backup & restore**, then **What goes in an export**. Each section is
its own switch:

| Section | Default | What it covers |
|---|---|---|
| Settings | On | Every keyboard preference |
| Include API keys | Off | Translate, GIF, search and AI keys (only shown while Settings is on) |
| Themes | On | Your custom themes, including their background images |
| Dictionary | Off | Words and next-word patterns the keyboard learned from you |
| Clipboard | Off | Saved clipboard history (text only; images and files stay local) |
| Snippets | On | Your saved text snippets |
| Sticker packs | Off | Your own sticker packs, stickers and all (but not the photos you cut them out of) |
| Icon packs | Off | Your own icon packs, images and all. Backups made before 0.6.6 restored the pack names with no icons in them; restoring one of those now brings the icons back too |
| Custom word lists | On | Word lists you imported for any language |
| Addon repositories | On | The repository addresses you added, so a restore can reinstall from them |
| Emoji history | On | Your recent emoji, your favourites and the skin tone you last picked for each |
| Typing statistics | On | Your daily typing counts and your all-time speed |
| Vocabulary | On | Your word lists, imported packs and learning progress. Downloaded packs are left out; they can be downloaded again |
| Swipe style | Off | Where your finger lands when you swipe, the readings you corrected, and the shape you draw each word in |
| Notes | On | Your notes, their tags, and what is in the trash. Locked notes stay out unless API keys are included; see [Notes](https://wmkeyboard.pages.dev/tools/notes/#backups) |
| AI memory | Off | What the AI remembers about you, from AI / Memory. See [AI memory](https://wmkeyboard.pages.dev/tools/ai-memory/) |
| To-do list | On | Your tasks and their steps, done or not. See [To-do list](https://wmkeyboard.pages.dev/tools/todo/#backups) |

Sticker packs and icon packs default off because their images make the file
large, not because there's anything private about them. Turn them on and a
restore on another phone gets working packs rather than empty shells. The
personal ones, dictionary, clipboard and swipe style, default off because
they're your typing history rather than configuration. AI memory is off for
the same reason: its facts come out of your chats. Emoji history and typing statistics
are personal too but default on, since both are small and neither can be
downloaded again if you lose it. The statistics are counts only, never
anything you typed.

Tap **Export to a file** to write a `wmkeyboard-backup-<date>-<time>.wmconfig.json`
file through Android's own save dialog. It goes wherever you choose, not to
any WM Keyboard server. What you pick is remembered. The automatic backup and
sync each have a list of their own, because a file you hand to someone, a copy
for yourself and what your devices share are three different decisions.

The addon repositories section is only the list of repository addresses
you've added, so a restore can point back at them. The addons you installed
*from* those repositories already travel inside their own sections. An
installed theme is in Themes, an installed icon pack is in Icon packs. See
[Installing addons](https://wmkeyboard.pages.dev/addons/installing/) for how that catalogue works.

## Importing a file

  privacy/backup-import-confirm — The import confirmation, listing what a backup file contains before anything is applied.

Tap **Import a file**. A file picker opens, and the app reads your chosen
file before it touches anything. A confirmation dialog lists exactly what's
inside, for example "Themes: 3 custom themes". If the file isn't a WM
Keyboard backup, the app refuses it outright. A passphrase-protected backup
(`.wmconfig.enc`) asks for the passphrase first, then shows the same
confirmation once it opens.

Opening a `.wmconfig.json` file from a file manager works the same way. It
launches the same confirmation dialog rather than importing silently.

Each section behaves differently once you confirm, and the difference matters
more than the in-app dialog's one-line summary suggests:

| Section | On import |
|---|---|
| Settings | **Merges.** Only the preferences named in the file are overwritten; everything else on the device is untouched. |
| Themes | **Replaces.** Your entire custom-theme list is swapped for what's in the file: custom themes you made since the backup are gone. |
| Dictionary, clipboard, snippets | **Replaces.** The on-device copy is overwritten by what's in the file. |
| Sticker packs, icon packs, custom word lists | **Replaces.** The whole local collection is cleared and rebuilt from the file. |
| Addon repositories | **Merges.** Incoming addresses are added to your existing list rather than replacing it (duplicates are skipped). |
| Emoji history | **Replaces.** The counts in the file overwrite the ones on the device. |
| Typing statistics | **Replaces this device's counts** when the file was made on this device. A file from another device adds that device's counts next to the ones here, so nothing you typed on either one is lost. |
| Vocabulary | **Replaces.** Your own word lists and progress are rebuilt from the file; packs downloaded from the catalogue are untouched, since the bundle never carried them. |
| Swipe style | **Replaces.** All three files come from the bundle, and a keyboard already running picks them up rather than saving its own copies back over them. |
| Notes | **Replaces,** keeping the locked notes already on the phone when the file was made without them. A keyboard already running reloads the file rather than saving its own list over it. |
| AI memory | **Replaces.** The saved facts on the phone are swapped for the ones in the file, and the chats pick them up at once. |
| To-do list | **Replaces.** The list comes from the file, and a keyboard already running reloads it rather than saving its own over it. A task-app sync that is set up keeps its own record on the phone. |

If the file includes API keys, the dialog warns you before you confirm; see
[Secrets stay out by default](#secrets-stay-out-by-default) below.

Settings import is rollback-safe. After writing, the keyboard re-reads its
own settings to make sure they still parse. If a hand-edited file breaks
that, the whole write is undone and you see "The app could not apply the
settings. Your settings did not change." rather than ending up with a
half-applied preference set. The other sections in a full-config bundle still
apply even if the settings portion rolls back.

## Secrets stay out by default

Every secret is excluded from an export unless you turn on **Include API
keys**, which only appears while the Settings section itself is included.
That's more than the tool keys: Translate, KLIPY, GIPHY, Brave, Tavily, Unsplash,
Pexels, every AI provider key including Grok, DeepSeek, Brave and the
OpenAI-compatible one, the Hugging Face token, and the passwords and tokens
for your backup locations (WebDAV, S3, SFTP, SMB, NFS, Synology, QNAP, FTP,
Git, IMAP, Dropbox, OneDrive, Box, pCloud, MEGA, iCloud Drive, Proton Drive)
plus your backup passphrase.

[AI history](https://wmkeyboard.pages.dev/tools/ai/#history) never travels, with or without that switch,
and there is no section for it to travel in. The two settings that control it
do, because they're configuration. The records themselves are your own
writing, and an off-by-default log of it is the last thing that should ride
along in a file you mail to yourself. The learned dictionary has a section of
its own but it's off by default, for the same reason.

Leave **Include API keys** off and the file is safe to store in a synced
folder or hand to someone else. Turn it on and the keys sit in the file as
plain text. The app warns you after export: "The app exported the backup with
your API keys in it. Keep that file as safe as a password." An incoming file
with keys in it gets a warning before you confirm the import, because those
keys will overwrite the ones already set on the device.

This redaction is specific to the file you export yourself. It doesn't apply
to Android's own backup below. Turn that on and it copies your saved API keys
along with everything else, because the whole settings store travels there as
one piece.

## Automatic backup

Exporting by hand only helps if you remember to do it. **Automatic backup**
writes the same kind of file for you on a schedule, by default while your
device charges and sits on Wi-Fi, to the **locations** you choose. Add as many
as you like, of any kind, on the Backup & restore screen:

| Location | What it needs | Works without Google |
|---|---|---|
| **Folder** | A folder you pick, anywhere with a files app behind it: your device, an SD card, Drive, Dropbox, Nextcloud, OneDrive | Yes |
| **WebDAV** | A Nextcloud, ownCloud, Seafile, Koofr, pCloud, Yandex Disk, kDrive, Hetzner Storage Box, 4shared or other WebDAV folder, and a login. Nextcloud can sign in through the browser | Yes |
| **S3** | A bucket on Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, Google Cloud Storage, DigitalOcean, Hetzner, Scaleway, OVHcloud, Akamai, Storj, IDrive e2, MinIO, Garage or anything else that speaks S3, and an access key pair | Yes |
| **SFTP** | An SSH server, and a password or a private key | Yes |
| **Windows share (SMB)** | A shared folder on a Windows computer or a NAS, and a login. Encrypted unless you turn it off | Yes |
| **FTP** | An FTP server, a login, and TLS unless you turn it off | Yes |
| **Git repository** | A private repository on GitHub, GitLab, Gitea or Forgejo (Codeberg included), and an access token | Yes |
| **Email (IMAP)** | A mail account, and usually an app password. Each backup is one email in a folder of its own | Yes |
| **Google Drive** | A one-time permission, for a hidden folder of the app's own or for a folder you can see in My Drive. Either way the app can see nothing else | No, needs Play services |
| **Dropbox** | Signing in. The app gets a folder of its own under Apps | Yes |
| **OneDrive** | Signing in. The app gets a folder of its own under Apps | Yes |
| **Box** | Signing in through the browser, and a folder | Yes |
| **iCloud Drive** | Your Apple Account, its password, and a code from your Apple device about once a month | Yes |
| **Proton Drive** | Your Proton account, signed in once. Files are encrypted on the phone | Yes |
| **MEGA** | Your MEGA account, signed in once. Files are encrypted on the phone | Yes |
| **pCloud** | Your pCloud account, signed in once | Yes |
| **Synology** | Your Synology NAS: Synology Drive or any shared folder, and your DSM account | Yes |
| **QNAP** | A shared folder on your QNAP NAS, and your QTS account | Yes |
| **NFS** | An NFS export on your network that allows this phone | Yes |

None of these send anything to a WM Keyboard server. There is no account with
us, and nothing of yours passes through anything we run. **Test the
connection** in each location's sheet tells you straight away whether it
works, rather than after the first night's backup fails.

**You choose which locations get backups.** On the Automatic backup screen,
**Back up to** has a tick box for each location. Each backup is built and
checked once, then copied to every ticked location. One that fails says so on
its card, and the others still get their copy.

**Two conditions guard the scheduled job, and you own both.** **Only while
charging** is on by default, so a backup waits for the charger. **Only on
Wi-Fi** is on by default too, so it waits for a connection Android doesn't
count as metered. Most backups are small. One carrying sticker packs or icon
packs is not, and it goes out every interval, which is why Wi-Fi is the
default. Turn it off and a backup uploads over mobile data as soon as it's
due. The Wi-Fi toggle only appears while a ticked location needs a
connection. A **Folder** is storage on your own device, so it backs up offline
either way. Picking its folder opens on the folder the location already has, or
on the last folder you picked for a backup location, not wherever your last
of the phone's memory one backup may take: an eighth of what the app may use,
and never under 16 MB. When the sticker packs, icon packs and imported word
lists would push the file past it, an automatic run leaves out the largest of
them first, one at a time, until the rest fits, and backs up everything else.
The message after the run names what it left out. A manual export never does.

Turning **Only while charging** off is worth knowing about for the opposite
reason. A phone that's only ever charged in the car may never be plugged in
at the end of an interval. A backup that never finds a charger never runs,
and nothing tells you so.

**The app keeps a few backups and deletes the oldest.** You choose how many. It
never deletes the newest one, and it never deletes an older backup until the
new one has been written, read back and checked. A backup that fails halfway
costs you the new copy and never an old one. Each backup's name says which
device and which installation made it, and each device counts and deletes
only its own, so several phones can share one Dropbox without eating each
other's backups.

**Backups can carry a passphrase.** Set one and the file is encrypted, and
you need the passphrase to restore it. The app stores that passphrase on your
device, because a backup that runs while you're asleep has nobody to type it.
So it protects the file where it lands, in a cloud folder for instance, and
not against a person holding your unlocked device. Write it down. Without it,
a backup cannot be restored. The same passphrase protects the sync files.
The file is sealed with AES-256-GCM under a key derived from the passphrase
by PBKDF2-HMAC-SHA512, 210,000 rounds over a random salt kept on this
device. It is sealed in 64 KiB pieces, each with its own tag, so a backup of
any size is made and opened a piece at a time instead of all at once in the
keyboard's memory. Each piece is numbered and the last one is marked, so a
file that was cut short, edited or reordered fails to open rather than
restoring part of a backup. Backups made by older versions, sealed in one
piece or keyed with PBKDF2-HMAC-SHA256, still restore. An encrypted backup or
sync file made by this version doesn't open in versions before it.

With the frequent backup on, **What goes in a backup** shows one list with two ticks per row, Main and Frequent, instead of a list for each.

**API keys are your call.** **What goes in a backup** has its own **Include
API keys** switch. Without a passphrase, the switch strongly suggests turning
one on first and asks you to confirm, because anyone who can open the location
could read the keys. It doesn't refuse.

**Some locations send a credential with every upload.** WebDAV sends your
password on every request, so a WebDAV address on plain `http` is refused
outright. A Git server typed as `http://` gets a warning, because the token
crosses in the clear, and so does IMAP with security set to None. SFTP is
always encrypted, and remembers the server's key from the first connection:
a server that later shows a different key is refused, because that is what a
machine in the middle looks like. SMB encrypts the whole session by default
and refuses a server that can't. A Git repository that isn't private is
refused unless you allow it, since its history keeps every backup ever
written to it. FTP without TLS is allowed, because some older servers offer
nothing else, and the screen says plainly what it costs. An S3 endpoint on
plain `http` is allowed too, for the MinIO box on your own network: the
request is signed rather than carrying the secret key, but the signature and
the file both go over the wire in the clear, and the screen says so under the
endpoint field. Turn on a passphrase if you use either. NFS has no
encryption and no password: the server takes the phone's word for the user
id it writes as, and the screen says so. Synology and QNAP send your
password, so a plain `http` address is refused, and a NAS certificate that
no authority vouches for is refused unless you accept it, after which only
that same certificate is.

**Two locations hold only what the phone encrypted.** MEGA and Proton Drive
get files encrypted with keys the service never sees, exactly as their own
apps do it, and Proton signs every key, name and block as well. iCloud Drive
is reached through the interface iCloud.com uses, because Apple publishes
none for Android, and Proton Drive through the one its apps use, which Proton
has not opened to other apps yet. Either can change on the service's side,
and backups there then fail until the app is updated.

**Nothing is backed up while your device is locked.** The parts that matter
most, like your learned words, live in storage that only exists once you've
unlocked the device after a restart. A backup taken before then would be
nearly empty, and rotating that in would push out a real one, so the app
waits.

**You can pause it without turning it off.** **Pause backups** on the
Automatic backup screen stops the scheduled backups for 1 hour, 1 day, 1 week,
or until you resume. Your locations, schedule, passphrase and the backups
already kept all stay as they are, and the status card says the backup is
paused. A timed pause ends by itself. On resume, a backup that came due during
the pause runs at the next scheduled check. **Back up now** still works while
paused. The pause belongs to this phone: it never goes into an export, a
backup or a sync file.

### Restoring from a location

Each location's menu has **Restore from** followed by its name. It lists every
automatic backup there, from every device that uses it, newest first, with
"This device" marking this phone's. Pick one and the app downloads it and
shows the same confirmation as importing a file, listing what's inside before
anything changes. An encrypted backup opens with your stored passphrase, or
asks for one when it doesn't. For a Google Drive location in the hidden
app folder this is the only way back: that folder is hidden from every other
app, the Drive app included. Choose **A folder you can see** instead and the
backups are ordinary files in My Drive as well.

Where several people share a location, each backup shows the
[sync group](#several-people-one-location) of the phone that took it, next to
the device name. When the list holds more than one group, chips above it narrow
it to one, starting on your own group.

## Sync between devices

Data / Backup & restore / Sync devices

Sync keeps your devices the same while you use them all: change a setting or
a theme on your phone, and your tablet has it soon after. It uses your
locations, and nothing else. Each device keeps one sync file at every location
you tick under **Sync through**, and reads the files of the others. For each
setting, and for each theme, snippet or learned word, the newest change wins,
and a deletion spreads like any other change.

Typing statistics are different, because they're counts. Each device syncs
its own counts, and About / Statistics adds up every device's. If you
type on your phone and your tablet before they sync, both counts stay.
Syncing again replaces a device's counts; it never adds them a second time.
**Delete all statistics** on one device clears the counts on all of them.

- **When:** **Soon after a change** (about a minute after you stop changing
  things, plus a check every hour and when the app starts), **On a schedule**,
  or **Only when I ask**.
- **What:** **What syncs** has its own list of the same sections a backup
  has. By default that's settings, themes and snippets. Learned words,
  clipboard and the rest are there to turn on. AI memory is the one section
  that isn't on the list: it goes into a backup you choose, or nowhere.
- **Where:** your devices must share at least one ticked location. Tick more
  and the file goes to each, so sync keeps working while one service is down.
- **First sync:** a device that joins takes the settings your other devices
  already agreed on, rather than pushing its own over them. Anything only it
  has goes to the others.
- **Keep on this device:** tick **Toolbar and toolbox**, **Languages and
  layouts** or **Theme** to keep that part different on this device. It isn't
  sent, and your other devices' changes to it aren't taken. Unticking
  **Themes** under **What syncs** stops only your own themes from syncing;
  which theme is in use is a setting, kept apart by **Theme** here.
- **With a paired computer:** pair WM Keyboard on a computer over [KDE Connect](https://wmkeyboard.pages.dev/tools/kde-connect/#pairing-with-wm-keyboard-on-a-computer) and it becomes a location of its own, **Nearby device**, ticked under **Sync through**, with sync turned on. The two hand each other their sync files directly while both are on the same network and the keyboard is open, so no cloud service is involved. **Sync with paired devices**, on by default, decides whether pairing does this.
- **With your private space or work profile:** Android keeps each profile's files apart, so a folder location set up in one profile isn't writable from the other. Add an **Other profile** location in WM Keyboard in both profiles instead, with the same pairing code: tap **Copy the code** in one and **Paste a code** in the other. Adding it ticks it under **Sync through** and turns sync on. The first time, the copy in the private space or work profile takes your main profile's settings, and adds only what the main one doesn't have. While both copies are running, they hand each other their sync files over the phone's own loopback address (127.0.0.1), so nothing leaves the phone, and a private space that was locked catches up the next time you unlock it. Android 17 and later keep apps in different profiles apart: there the location shows a one-time `adb` command to run for each profile, then a restart.
- **Pausing:** **Pause sync** holds the scheduled and automatic syncs back for
  1 hour, 1 day, 1 week, or until you resume, and keeps everything else as it
  is. **Sync now** still works. Resuming syncs straight away.
- **Without a cloud account:** any location your devices can all reach works.
  On a Tailscale network, share a folder from a computer with Taildrive and add
  it on each device as a WebDAV location with the **Tailscale Taildrive**
  service. The files stay on your own computer, and Tailscale encrypts them on
  the way.

Some settings stay on each device, because they only fit that device: the
keyboard size and position on each screen, one-handed mode, the floating
keyboard, the hardware keyboard, paired KDE Connect computers, the app lock,
and what's installed or downloaded on it. **Sync API keys and passwords** is
off by default, and like the backup switch it strongly suggests a passphrase
first without requiring one. Use the same passphrase on every device, or the
others can't read this one's file, and the screen says so.

Sync settings are never exported, backed up or synced themselves, the pause
and the sync group included. A phone restored from a backup doesn't start
syncing until you turn it on.

### Several people, one location

Two people can use one shared location, such as a family NAS or a shared
Dropbox folder, for their backups and their sync without mixing their
keyboards. Backups were already kept apart: each phone counts and deletes only
its own. Sync needs one more step, because every device merges every other
device's sync file at a location. Give each person a **Sync group** on the Sync
devices screen, the same name on all of that person's devices and a different
name from everyone else's. A device then reads and merges only the files of its
own group, and the others never download them.

Devices with no group sync with each other, as every device did before groups
existed, so nothing changes for a location only you use. When you tick a
location for sync that other devices already use in other groups, the app
lists those groups and asks which one to join. The **Sync group** row shows the
same list when you change it. A device that moves to another group joins it
the way a new device joins: the group's settings win the first sync, and
anything only this device has goes to the group.

A group name is letters, digits and hyphens, up to 12 characters, and capitals
become lowercase. It is a way to keep files apart, not a lock: anyone who can
open the location can read the sync files of every group, unless they're
protected with a passphrase. Give each person their own passphrase when that
matters. A paired computer over KDE Connect is never in a group, because it
belongs to one person already.

## Android's own backup

Separately from exporting a file, you can let Android's built-in backup
system cover the keyboard too (the same mechanism that restores your other
apps after a factory reset or backs up during a phone-to-phone transfer).

Privacy / Android backup / Back up with Android

This is off by default. With it off, Android's backup agent writes nothing
for WM Keyboard at all: not a partial copy, nothing. Turn it on and a backup
made this way restores settings, themes, layouts, snippets, learned words,
sticker and icon packs, and plugins on a new device or after a reinstall.

A few things are always left out of an Android backup, regardless of the
toggle. They're large, and the keyboard can fetch them again: on-device
speech and AI models, downloaded dictionaries, emoji keyword packs, and the
scratch files the camera and document scanner write while you're using them. Clipboard images are excluded too, though the clip text itself
travels. So are the photos your own stickers were cut out of, which the
[sticker editor](https://wmkeyboard.pages.dev/emoji/stickers/#the-sticker-editor) keeps on the phone so
you can edit a sticker again later. The stickers themselves still travel.
None of this is a secrecy decision. It's Android's own backup quota, which is
only a few tens of megabytes per app and drops the whole backup if you exceed
it.

Two more conditions apply only to this path, not to a manual `.wmconfig.json`
export:

- **Encryption-gated.** A cloud backup is only made on a device that can
  encrypt it under your own screen lock. If the device can't, no backup is
  written even with the toggle on.
- **Restore isn't gated by the toggle.** If you ever receive a backup made
  while the switch was on, after a reinstall say, it restores regardless of
  the switch's current state. The reasoning is simple. A restore can only
  replay data an earlier install was allowed to back up, so blocking it on a
  fresh install would discard a backup you already opted into.

## Options

Data / Backup & restore

Reach it from the home screen, or search "Backup & restore" in settings
search. The export switches are the ones described in
[Exporting a config file](#exporting-a-config-file) above, and they're
ordinary stored settings, so what you tick stays ticked when you come back.
The automatic backup and sync keep lists of their own. Field by field,
everything is on [Backup & restore settings](https://wmkeyboard.pages.dev/reference/settings/backup/).

Privacy / Android backup / Back up with Android

- **Back up with Android** (default **off**). Folds the keyboard into
  Android's own backup and phone-to-phone transfer system, subject to the
  exclusions and the encryption requirement covered in
  [Android's own backup](#androids-own-backup) above.

## Moving to a new phone

A backup carries your own RIME words and imported RIME schemas with your personal dictionary, along with which word you picked for each reading on the built-in Chinese and Japanese boards, but nothing that was downloaded. RIME's compiled files stay out too, since RIME builds them again by itself. If the new phone may not reach GitHub, where downloads come from, press **Save downloaded files** on the Backup screen first. It writes one zip with your word lists, RIME's packs, voice and AI models and feature libraries. **Restore downloaded files** on the next phone puts them back. A library goes back in only if its checksum matches what that version of the keyboard expects, so use the same version on both phones. If you restore a backup without those files, the message that follows says how many feature libraries are missing and opens [the page that lists them](https://wmkeyboard.pages.dev/privacy/offline/#feature-libraries).

Themes, sticker packs, icon packs, custom word lists and your own vocabulary
lists all *replace* rather than merge on import. Restore onto a phone that
already has its own customizations in those categories and they're discarded
in favor of what's in the file. Do this on a fresh install where you can, or
go in expecting the overwrite.

1. On the old phone, open **Backup & restore**. Choose the sections you want
   in **What goes in an export**, then tap **Export to a file**.
2. Move that file to the new phone however you like. It's a plain file you
   control, so email, a cable or any file-sync app all work.
3. Install WM Keyboard on the new phone. Open the file from a file manager,
   or open **Backup & restore** and tap **Import a file**.
4. Optionally, turn on Privacy / Android backup / Back up with Android
   for ongoing coverage between manual exports.

If the old phone backs up automatically, you can skip the file. On the new
phone, add the same location, open its menu and choose **Restore from**. To
keep using both phones, turn on sync on each instead, ticking a location they
share.

A manual export is the more complete of the two paths for anything it
includes. It isn't subject to Android's size quota or its encryption
requirement, so a set of sticker packs too large for an Android backup still
moves fine as a file you export by hand.

## Details & edge cases

- **File formats.** Export produces one file type, `.wmconfig.json`, the
  full-bundle format described above. An older, settings-only
  `.wmsettings.json` format still exists and is still accepted on import,
  for backups made by earlier versions of the app. Nothing in the current app
  writes one anymore. Opening either from a file manager prompts you to
  import it. It doesn't install anything the way tapping a theme or plugin
  file does.
- **Theme backgrounds do travel.** A custom theme's background image is
  embedded in the export file and written back to local storage on import,
  so a restore on a different phone gets a working theme with the image
  included rather than just the color settings.
- **A failed write leaves nothing behind.** If the app can't write to the
  file you chose, you get "The app could not write that file." rather than a
  half-written export. An automatic backup goes further. It writes the file
  locally, reads it back and parses it, and only copies it to your locations
  if that worked. Nothing older is deleted until the new one is safely there, so
  a backup that fails halfway costs you the new copy and never an old one.
- **Backups don't cover installed addons directly.** What travels in the
  Addons section is the repository list, not the addon files themselves.
  Those are already accounted for in Themes, Icon packs and the rest. See
  [What are addons?](https://wmkeyboard.pages.dev/addons/overview/) for how repositories and installed
  addons relate.
- **The reference page for every field and default** on the Backup & restore
  screen lives at [Backup & restore settings](https://wmkeyboard.pages.dev/reference/settings/backup/).

See [Network policy](https://wmkeyboard.pages.dev/privacy/network/) for what leaves the device outside of
backups, and [Data collection](https://wmkeyboard.pages.dev/privacy/data/) for what the keyboard learns
from you in the first place.