Safe Method to Use Encrypted Cloud Backups on GrapheneOS?

jhonnmick

Hello everyone,

I’m looking for advice on setting up a secure, privacy-respecting cloud backup solution on a Pixel 6a running GrapheneOS (fully de-Googled).

My ideal setup would:

Use end-to-end encryption before upload
Work with a provider that supports WebDAV, S3, or self-hosted options
Be restorable without needing Google Services

I’ve explored Syncthing and Restic (with Termux), but I’m curious if there are better tools or workflows the community has found success with.

I'm also open to backup tools that integrate with Seedvault (even partially) or suggestions for scheduling backups automatically without a constantly running background service.

Thanks in advance for your insights. I appreciate the incredible work that’s gone into GrapheneOS.

— jhonnmick

Murcielago

Unfortunately I can't answer all your questions, but I have an idea for this part:

My ideal setup would:
Use end-to-end encryption before upload

Maybe Cryptomator is something for you? It's also available on Accrescent.

DirtyDan

Murcielago just to be aware, the variants from each app source (play store, f-droid, cryptomator f-droid repo, accescent) can differ with which clouds they work with.
https://cryptomator.org/android/

https://docs.cryptomator.org/android/setup/

I also do not believe a license bought through play store can be transferred to an app installed from elsewhere and vice versa. So choose wisely. I think the main F-Droid variant also requires a separate license.

Also, it's $20 per license now?? I could've sworn they just increased it from $10 to $15. The price increases plus the games they're playing with requiring new licenses for each variant is not cool. Especially for custom Android users, they know that we're always talking about new ways to install apps and they're taking advantage of that...they're basically creating a subscription model with extra steps.

Cyanide77

Nextcloud self hosted.. Supports E2EE
Also useful for your calendar and contacts needs..

(Also usable as your seedvault backup target from GOS)

chisc

I've since switched entirely to seedvault+WebDAV, but back in my LineageOS days I had the following setup:

Seedvault backed up apps to local storage (/sdcard/.SeedVaultAndroidBackup)
Restic was used to back up my entire /sdcard
Restic was scheduled every 4 hours by termux (see: termux, termux-api and termux-job-scheduler)
Rclone was used to access the encrypted restic repository hosted on a cloud provider. Rclone supports various providers (google drive, dropbox, S3, sftp, etc)
For non-restic backups (i.e. my termux home dir), rclone additionally supports encryption if you don't want to trust the remote host.

Other than the double-barrelled backup (seedvault -> restic) this worked pretty well. I experimented with root and adb backup shell scripts, but eventually seedvault improved enough I was happy to get rid of all the extras.

jhonnmick

Thanks everyone — really appreciate all the input! Cryptomator and Nextcloud (especially with E2EE and Seedvault support) sound promising, and I’ll definitely look deeper into the licensing differences. Also love the Restic + Termux + rclone workflow — that kind of layered approach with WebDAV or S3 looks like a strong fit for my needs. Great to see multiple options that respect privacy and don't rely on Google Services.