diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index da7a80e4c8..d62d8c5ad6 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -36,7 +36,9 @@
 
   <application
     android:name="org.groundplatform.android.GroundApplication"
-    android:allowBackup="true"
+    android:allowBackup="false"
+    android:fullBackupContent="@xml/backup_rules"
+    android:dataExtractionRules="@xml/data_extraction_rules"
     android:icon="@mipmap/ic_launcher"
     android:label="@string/app_name"
     android:roundIcon="@mipmap/ic_launcher_round"
diff --git a/app/src/main/res/xml/backup_rules.xml b/app/src/main/res/xml/backup_rules.xml
new file mode 100644
index 0000000000..5afb70c489
--- /dev/null
+++ b/app/src/main/res/xml/backup_rules.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!--
+  ~ Copyright 2026 Google LLC
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     https://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<!--
+  Backup rules for Android 11 (API 30) and below.
+  Used by android:fullBackupContent in AndroidManifest.xml.
+
+  Excludes all sensitive app data from cloud/adb backup to prevent
+  unauthorized extraction of Firebase auth tokens, survey data,
+  and GPS coordinates from compromised or untrusted devices.
+
+  See: https://developer.android.com/guide/topics/data/autobackup
+-->
+<full-backup-content>
+
+  <!-- Exclude all shared preferences (contains auth state and user prefs) -->
+  <exclude domain="sharedpref" path="." />
+
+  <!-- Exclude local database (contains survey data and GPS coordinates) -->
+  <exclude domain="database" path="." />
+
+  <!-- Exclude internal files (may contain cached tokens or offline data) -->
+  <exclude domain="file" path="." />
+
+  <!-- Exclude external storage files -->
+  <exclude domain="external" path="." />
+
+</full-backup-content>
diff --git a/app/src/main/res/xml/data_extraction_rules.xml b/app/src/main/res/xml/data_extraction_rules.xml
new file mode 100644
index 0000000000..2e66e57a45
--- /dev/null
+++ b/app/src/main/res/xml/data_extraction_rules.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!--
+  ~ Copyright 2026 Google LLC
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     https://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<!--
+    Data extraction rules for Android 12 (API 31) and above.
+    Used by android:dataExtractionRules in AndroidManifest.xml.
+
+    Prevents sensitive app data (Firebase tokens, survey responses,
+    GPS coordinates) from being extracted via cloud backup or
+    device-to-device transfer on Android 12+ devices.
+
+    See: https://developer.android.com/about/versions/12/backup-restore
+-->
+<data-extraction-rules>
+
+  <cloud-backup>
+    <!-- Disable cloud backup entirely for this app -->
+    <exclude domain="root" path="." />
+    <exclude domain="sharedpref" path="." />
+    <exclude domain="database" path="." />
+    <exclude domain="file" path="." />
+    <exclude domain="external" path="." />
+  </cloud-backup>
+
+  <device-transfer>
+    <!-- Disable device-to-device transfer of sensitive data -->
+    <exclude domain="root" path="." />
+    <exclude domain="sharedpref" path="." />
+    <exclude domain="database" path="." />
+    <exclude domain="file" path="." />
+    <exclude domain="external" path="." />
+  </device-transfer>
+
+</data-extraction-rules>