diff --git a/apps/native/android/app/src/main/AndroidManifest.xml b/apps/native/android/app/src/main/AndroidManifest.xml
index 13396e01..5cfe26ab 100644
--- a/apps/native/android/app/src/main/AndroidManifest.xml
+++ b/apps/native/android/app/src/main/AndroidManifest.xml
@@ -1,8 +1,13 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
 
+    <!-- allowBackup=false: keep the plaintext on-device Dexie health DB AND the
+         session token out of Android Auto Backup / `adb backup`, which a
+         device-access adversary could otherwise use to extract them. No user data
+         is lost: the data syncs to Neon Postgres (the device is not the system of
+         record), so a reinstall restores via sign-in + sync. -->
     <application
-        android:allowBackup="true"
+        android:allowBackup="false"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"