Game saves and cloud saves

Library sync does not back up saves. Enable Cloud Saves once for eligible existing and future works. Explicit per-work opt-outs survive upgrades, rebinding and restarts.

Local save backup and ZIP migration#

• Desktop appAvailable in 0.2.8
• WebsiteNot applicable

The classic ZIP archive entry remains available. ZIP import and export use the same validated save engine as cloud saves; old archives are not deleted by this migration. Import validates member names, types, counts, sizes, expansion ratios and encoding before staging verified content. It never extracts directly into the destination. Traversal, duplicate/colliding names, links, scripts and executables are refused. Third-party archives need preview and an explicit encoding when names are ambiguous. Save data is never executed or deserialized to guess compatibility. A completed export appears only after the entire ZIP is safely written.

In a work's Cloud saves section, use ZIP and local / USB migration to select a file, filename encoding and bound destination. Auto accepts UTF-8 or ASCII names; older archives can explicitly use Japanese CP932, Simplified Chinese GBK or legacy ZIP CP437. Inspect the preview and confirm before importing. Changing the file, encoding or destination invalidates the preview. Import preserves extra files and first creates a safety snapshot; it never silently switches to exact restore. Existing backups remain available from Game tools.

Use Export ZIP beside a local or cloud history version to download it for local or USB storage. The export contains readable save content even when the provider snapshot is end-to-end encrypted. The disclosure appears before export; protect the destination and share carefully. Export does not remove the original snapshot or archive.

Cloud saves#

• Desktop appAvailable in 0.2.8
• WebsiteNot applicable
• A sync folder works directly; connecting Google Drive / OneDrive directly needs an OAuth app registration, which the public 0.2.7 build does not include.

Open Settings → Accounts & Sync → Game cloud saves, choose a connected Google Drive, OneDrive or folder destination, review the visible disclosure and enable Cloud Saves. Online fingerprint lookup, contribution and private website status are independent choices. New participation choices are shown enabled; existing explicit privacy opt-outs are preserved. Each can be disabled without disabling local save management. Existing provider authorization need not be repeated.

Eligible works receive discovery, an initial backup, trusted compatible missing-save restoration, checks before launch, stable backups after exit and catch-up after restart. Necessary restoration shows progress and continues launch after verification, without another approval for an ordinary safe restore. Offline/timeout launch is possible only before mutation starts; it cannot bypass Guard, active apply, rollback or crash recovery.

If previously present saves disappear, the work page explains the paused decision. Restore existing nonempty cloud progress, or explicitly keep the local empty state when local saves really are empty. An empty cloud version leads to history so you can choose a nonempty version; it is never presented as recoverable progress. The decision is checked against the displayed cloud head before an asynchronous task proceeds.

Accounts & Sync also shows the private website status index with device source time, website receipt time, reported backup time and stale/cache labels. It is an account-scoped, read-only summary, not live cloud-drive status. Refreshing it cannot restore saves or resolve conflicts. Website unavailability does not block direct provider operations.

Supported and unsupported titles#

Automatic restoration requires sufficient identity, save-compatibility and trusted-location evidence, with integrity state shown separately. A directory name, shared engine, PE string or quick hash alone never authorizes restoration. A changed executable may coexist with supported identity from independent evidence, but it remains a warning and is not promoted as a clean sample. Uncertain evidence stays uncertain. Registry-only saves are not supported.

Finding the saves#

Detect save locations shows locations, source rules, compatibility notes, evidence and a sample of included/excluded files. Low-confidence name-based candidates remain suggestions; they are not automatic write authority. You can choose a specific folder manually. Binding requires an explicit check of this installation, its locations and save-line compatibility; cancel if unsure. This local decision does not promote rule trust or bypass Guard. Normal sync does not ask again.

Save locations stay on this computer#

Absolute paths are resolved and verified locally. Provider manifests may contain portable logical templates such as an install-relative savedata folder, which another computer resolves within its own trusted boundaries. The website status index receives no templates. Community location learning accepts only reviewed generic forms, never private custom names merely because they are relative.

System folders, overly broad roots, GalShelf's own data, provider backing folders and dangerous links are refused. Moving a game requires local revalidation. Multiple installations sharing a save domain cannot race restoration and launch. Removing a binding deletes no cloud history.

Editions and save lines#

A save line represents a compatible save domain. Work identity and save compatibility are separate facts: matching a title alone does not make editions interchangeable. Ambiguous cross-edition restoration requires an explicit decision and preserves both sides.

Versions#

Backups capture stable files, reuse verified content-addressed blobs and publish a verified snapshot. Unchanged contents do not create another generation. Downloads reuse verified local blobs. Programs, scripts and archives are outside save content policy. Limits apply to individual files, snapshot size and file count.

An offline or full-provider capture is local only when a bounded pending copy exists; it is not captured when local admission also fails. Neither status is a completed cloud backup. Versions show their source device and time.

Comparing with the cloud#

Decisions use actual content and verified ancestry, never modification time or the largest generation number. Identical bundled saves and surviving AppData saves establish a baseline without replacement. Matching a verified older generation can recover a baseline. Missing the latest 16-generation ancestry cache does not itself imply a conflict; deeper verified history is consulted.

Different contents with no provable relationship remain a conflict. A previously known save tree becoming empty needs a recovery/deletion decision; GalShelf does not silently resurrect it or propagate deletion.

Automatic backup and retention#

After the one-time activation, eligible works inherit automatic backup and safe restoration. Per-work controls offer Follow the Cloud Saves default, Enable, and Disable; explicit disable is durable. Stable exit and restart catch-up avoid repeated unchanged backups. Ordinary history defaults to ten generations (configurable); protected conflict, Undo and recovery data are not pruned to disguise a capacity failure.

Capacity and pending protection#

Account usage counts actual unique blobs across lines once, including required overhead. A line's logical total is not the account's physical usage. Admission checks run before uploading or staging. Client prechecks do not reserve atomic quota across devices; provider space may be unavailable or stale.

Adjustable engineering starting limits are 2 GiB for the provider account, each line and local cache; 1 GiB for staging and the pending queue; and 128 pending jobs. These are initial settings, not fixed owner-selected constants or provider plan sizes. Starting reminder bands are 70/85/95 percent used or approximately 10/3/1 comparable backups remaining. Forecasts use the next expected change and disclose uncertainty. Large monolithic saves warn earlier than tiny increments; caps never increase silently.

At a limit, the previous cloud head, unique good copies and protected safety/conflict history remain intact. Review history, explicitly adjust a budget or choose another location. Status distinguishes cloud-protected, local-only and not-captured progress.

Restore#

Ordinary Restore this version overlays a snapshot and preserves extra files. Advanced exact restore first lists the files to remove, requires explicit confirmation and creates a safety snapshot. Deletion is restricted to snapshot-owned save domains and effective filters, never other roots, installation files or exclusions. The preview expires and changes in account, binding or local contents invalidate it.

Before mutation, destinations, filters, file types, sizes, hashes, compatibility and exclusive access are rechecked. Trusted missing directories can be created only inside locally verified boundaries and are journalled. Files are replaced individually; failure or interruption rolls back the previous tree. Historical restoration can become a normal revert without the next automatic pull immediately undoing it.

Undo a restore#

Undo the last restore first protects the current state, then restores the previous safety snapshot. Only directories recorded as created and still empty are cleaned up. Changed or forged recovery targets are rejected.

Conflicts between computers#

When both sides changed or their relationship is uncertain, keep both and choose explicitly. Keep this device's version publishes a new version while preserving the previous cloud copy. Use the cloud version first protects the local state. There is no modification-time winner. Intentional deletion and a missing first installation are different situations.

Steam Cloud and other launchers#

Choose one restoration authority when another known system can write these saves: GalShelf, after you disable the other system's restoration of the same roots, or Steam/another system, leaving GalShelf automatic backup only. Until a choice is made, automatic restoration is visibly blocked. A generic risk checkbox is not control assignment. GalShelf does not change Steam settings or delete its data for you.

End-to-end encryption#

• Desktop appAvailable in 0.2.8
• WebsiteNot applicable

Provider storage encryption is not end-to-end. Optional end-to-end encryption protects save contents and filenames before upload using your passphrase. Nobody can recover forgotten passphrases. Encryption remains sticky: missing configuration or keys cannot silently switch future backups to plaintext. Windows protects a cached derived key; forgetting it on this device requires unlocking again.

A personally controlled local/USB destination needs a one-time private-location declaration. Shared or third-party-writable folders need authenticated encrypted content for automatic restoration. A drive letter alone does not prove privacy. Encryption never removes path, ownership, ancestry or rollback checks.

On the website#

The private status index receives only work/opaque line/device references, provider kind, reported times, generation, file count, aggregate bytes and coarse status. No saves, manifests, file lists/hashes, templates, private labels, provider credentials or download links enter the index. Source time, receipt time and freshness are distinct; cached reports are not live provider state.

The index cannot decide conflicts, restore saves remotely or delete provider history. Website unavailability does not block desktop-to-provider saves. Hide and delete website save status removes this metadata and disables pending publication without deleting actual saves. See Privacy.

Open Account → Private cloud save status while signed in to see each device’s source and receipt times, report freshness and protection state. Refresh reads the website index only. The page offers a separate confirmed metadata deletion; it never offers save restoration or provider deletion.