Release history

1.0

Backup and restore to the NAS.

2.0

Redesign in the style of Samsung's One UI, light and dark.

2.5

Instant camera backup, resumable uploads, Browse NAS, monthly checksum check with Repair, storage forecast, widget, Keystore-encrypted token, certificate pinning.

2.6

Restore key can be remembered behind a fingerprint.

2.7.1

Choose which albums to back up and which to restore.

2.8

Original GPS locations, photo map, verified Free up space, backup reminders.

2.8.3

Photos edited on the phone are sent again as new versions.

2.8.4

Free up space for photos older than a chosen number of years.

2.8.5

Release-signed with its own key instead of a debug build. Key rotation lets it install over earlier versions and keep their settings.

2.8.6

The NAS enforces "no path deletes the last copy": Free up space removes only what the NAS confirms it holds, and the NAS then keeps that copy out of the recycle bin.

Scorecard

• Idea A real need, in a crowded field
• Execution Restore, checks and Android quirks all handled
• Security Split keys, signed requests, pinned certificate
• Maintainability One maintainer; a growing feature set
• Product potential Free rivals backed by large teams

What's strong

• Two keys with different powers. The phone holds a write-only token. Reading the library needs a separate restore key plus an authenticator code. Someone who steals the phone can add photos to the NAS, but can't download them.
• The phone checks the server first. On Wi-Fi, the NAS must sign a random challenge with the token before any photo is sent, so a device at the same address on another network gets nothing. Over the internet the certificate is pinned, and normal Let's Encrypt renewals are still accepted.
• Nothing is deleted on trust. Free up space compares SHA-256 hashes on the phone and the NAS before removing anything, and from then on the NAS refuses to move its copy to the recycle bin; an end-to-end test proves it. Other deletions go to a 30-day recycle bin, and more than 50 at once wait for a person to confirm. Each month a random sample of up to 100 files is checked again.
• Restore was built and tested from the start. Every file's albums are recorded, so a new phone gets Camera, Screenshots and each album back in place with the original dates. It skips what's already there and resumes if interrupted.
• It handles Android's traps. Android strips GPS data from photos unless an app holds a specific permission. Version 2.8 fixed that and back-filled earlier backups. Samsung's battery saver and Android's storage limits are handled too.
• Small, readable server. One file using only Node's built-in modules, so there are no third-party packages to patch. Photos sit in plain YYYY/MM folders with their original names and can be read without the app.

What to watch

• Same-size edits are missed. An edit that leaves a file exactly the same size isn't sent again. If the backup check later flags that file, Repair keeps the phone's version and puts the NAS original in the recycle bin for 30 days. Comparing dates or hashes would tell an edit from damage.
• The server is a single point of failure. Photo Backup keeps one copy, on one machine. That machine needs its own off-site backup, to Synology C2, Backblaze B2 or another cloud service its backup tool supports. Read-only snapshots of the photos folder also cover corruption or a bad sync.
• One maintainer. Fixes and new versions depend on one person. The photos don't: they are plain files in YYYY/MM folders that any computer can read.