diff --git a/apps/mobile-app/android/app/src/main/AndroidManifest.xml b/apps/mobile-app/android/app/src/main/AndroidManifest.xml
index 9bfd1b083..a825572ed 100644
--- a/apps/mobile-app/android/app/src/main/AndroidManifest.xml
+++ b/apps/mobile-app/android/app/src/main/AndroidManifest.xml
@@ -12,7 +12,7 @@
       <data android:scheme="https"/>
     </intent>
   </queries>
-  <application android:name=".MainApplication" android:label="@string/app_name" android:icon="@mipmap/ic_launcher" android:roundIcon="@mipmap/ic_launcher_round" android:allowBackup="true" android:fullBackupContent="@xml/backup_rules" android:dataExtractionRules="@xml/data_extraction_rules" android:theme="@style/AppTheme" android:supportsRtl="true" android:usesCleartextTraffic="true" android:localeConfig="@xml/locales_config" android:networkSecurityConfig="@xml/network_security_config">
+  <application android:name=".MainApplication" android:label="@string/app_name" android:icon="@mipmap/ic_launcher" android:roundIcon="@mipmap/ic_launcher_round" android:allowBackup="false" android:fullBackupContent="false" android:dataExtractionRules="@xml/data_extraction_rules" android:theme="@style/AppTheme" android:supportsRtl="true" android:usesCleartextTraffic="true" android:localeConfig="@xml/locales_config" android:networkSecurityConfig="@xml/network_security_config">
     <meta-data android:name="expo.modules.updates.ENABLED" android:value="false"/>
     <meta-data android:name="expo.modules.updates.EXPO_UPDATES_CHECK_ON_LAUNCH" android:value="ALWAYS"/>
     <meta-data android:name="expo.modules.updates.EXPO_UPDATES_LAUNCH_WAIT_MS" android:value="0"/>
diff --git a/apps/mobile-app/android/app/src/main/res/xml/backup_rules.xml b/apps/mobile-app/android/app/src/main/res/xml/backup_rules.xml
deleted file mode 100644
index 3b3bb8923..000000000
--- a/apps/mobile-app/android/app/src/main/res/xml/backup_rules.xml
+++ /dev/null
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  Backup rules for Android API < 31 (Android 11 and below).
-  Excludes sensitive credential identity data from device backups.
-
-  The credential_identities file stores user metadata (usernames, email addresses, service names)
-  that should not leave the device, matching iOS ASCredentialIdentityStore behavior which
-  explicitly excludes its data from device backups.
-
-  Security rationale:
-  - Contains sensitive user information (though no passwords)
-  - Should remain device-local for privacy
-  - Can be re-synced from vault on new device
--->
-<full-backup-content>
-    <!-- Exclude the credential identity store from backups -->
-    <exclude domain="sharedpref" path="credential_identities.xml"/>
-</full-backup-content>
diff --git a/apps/mobile-app/android/app/src/main/res/xml/data_extraction_rules.xml b/apps/mobile-app/android/app/src/main/res/xml/data_extraction_rules.xml
index 1fca8d9a5..eea7b1db4 100644
--- a/apps/mobile-app/android/app/src/main/res/xml/data_extraction_rules.xml
+++ b/apps/mobile-app/android/app/src/main/res/xml/data_extraction_rules.xml
@@ -1,24 +1,17 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   Data extraction rules for Android API 31+ (Android 12 and above).
-  Excludes sensitive credential identity data from cloud backups and device transfers.
+  Disables all cloud backups and device transfers.
 
-  The credential_identities file stores user metadata (usernames, email addresses, service names)
-  that should not leave the device, matching iOS ASCredentialIdentityStore behavior which
-  explicitly excludes its data from device backups.
-
-  Security rationale:
-  - Contains sensitive user information (though no passwords)
-  - Should remain device-local for privacy
-  - Can be re-synced from vault on new device
+  AliasVault is an end-to-end encrypted vault app. All app data — including the encrypted
+  vault database, Keystore-wrapped encryption keys, authentication tokens, and key derivation
+  parameters — is security-sensitive and device-bound. So backups are disabled entirely.
 -->
 <data-extraction-rules>
     <cloud-backup>
-        <!-- Exclude credential identity store from cloud backups -->
-        <exclude domain="sharedpref" path="credential_identities.xml"/>
+        <exclude domain="root" path="."/>
     </cloud-backup>
     <device-transfer>
-        <!-- Exclude credential identity store from device-to-device transfers -->
-        <exclude domain="sharedpref" path="credential_identities.xml"/>
+        <exclude domain="root" path="."/>
     </device-transfer>
 </data-extraction-rules>