Backup & restore

Percher backs up the entire platform every night to encrypted off-site storage. The goal is that a corrupted database, a deleted volume, or a lost VPS does not turn into lost user data — restores happen from yesterday's archive, not from scratch.

What we back up

• Every app's /app/data volume (your databases, uploaded files, SQLite, caches)
• Every PocketBase sidecar's pb_data directory (auth, collections, file uploads)
• Platform metadata (apps, users, deployments, env-var ciphertext, custom-domain config)
• Forgejo repositories — the deploy history we keep of every published version
• Caddy TLS certificates so HTTPS keeps working immediately after a restore

Schedule and storage

• Daily, 02:00 UTC
• Encrypted with AES-256 (GPG symmetric); the passphrase is held only off-server
• Uploaded to a separate Hetzner Storage Box in a different datacenter from the production VPS, so a region failure doesn't take both copies
• Retention: 30 days locally on the VPS, 30 days off-site
• If a backup fails, on-call gets a Discord ping and an email to info@percher.app within minutes

How to request a restore

Email support@percher.app with the app name, what was lost, and the approximate time of the incident. Restores are operator-mediated today — there is no self-service restore button yet — and we target a same-day turnaround for paid plans.

What this does not protect against

• Writes between 02:00 UTC and the moment of failure (up to ~24 hours of data could be lost)
• Application-level corruption that you replicated into a backup — if your code wrote bad rows for three days, the restore will faithfully bring those rows back too
• Loss older than the 30-day retention window — once an archive ages out of both local and off-site storage, it's gone

Note: bunx percher delete removes the app immediately and skips any extra snapshot, but the previous night's archive still has both the app metadata and its data volume. If you delete by accident, email support within the 30-day retention window and we can usually recover it.

For sub-daily protection or self-service exports, run your own dump from inside the app — for PocketBase apps that's the built-in/api/backups endpoint in the PB admin UI; for custom SQLite, copy the file out of /app/data on a schedule.