diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index d31383a..ec4d8cd 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -6,7 +6,10 @@
     <application
         android:label="todo"
         android:name="${applicationName}"
-        android:icon="@mipmap/ic_launcher">
+        android:icon="@mipmap/ic_launcher"
+        android:allowBackup="true"
+        android:fullBackupContent="@xml/backup_rules"
+        android:dataExtractionRules="@xml/data_extraction_rules">
         <activity
             android:name=".MainActivity"
             android:exported="true"
diff --git a/android/app/src/main/res/xml/backup_rules.xml b/android/app/src/main/res/xml/backup_rules.xml
new file mode 100644
index 0000000..fafcb7d
--- /dev/null
+++ b/android/app/src/main/res/xml/backup_rules.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Legacy Auto Backup rules (pre-Android 12 / API < 31). An empty
+  <full-backup-content> means "back up the default set" — the app's files dir
+  (the local CRDT DB todo.db), databases, and shared_prefs (sync settings +
+  token). See data_extraction_rules.xml for the rationale on backing up the
+  token for zero-touch recovery.
+-->
+<full-backup-content>
+</full-backup-content>
diff --git a/android/app/src/main/res/xml/data_extraction_rules.xml b/android/app/src/main/res/xml/data_extraction_rules.xml
new file mode 100644
index 0000000..2458ee6
--- /dev/null
+++ b/android/app/src/main/res/xml/data_extraction_rules.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Android Auto Backup rules (API 31+ / Android 12+).
+
+  Empty <cloud-backup> and <device-transfer> elements mean "back up the default
+  set": the app's files dir (which holds the local CRDT DB, todo.db), the
+  databases dir, and shared_prefs (which holds the GitHub sync settings + token).
+
+  Backing up shared_prefs is intentional: it lets a reinstall restore the sync
+  configuration too, so recovery is zero-touch (no re-auth). The token is a
+  narrowly-scoped, contents-only PAT for the single private sync repo, stored in
+  the user's own Google backup. Auto-sync (the app's primary durability path)
+  still covers device loss; this is the secondary, OS-level safety net.
+-->
+<data-extraction-rules>
+    <cloud-backup />
+    <device-transfer />
+</data-extraction-rules>