diff --git a/tools/android-app/app/src/main/AndroidManifest.xml b/tools/android-app/app/src/main/AndroidManifest.xml
index fdbacc61c..defbd2f44 100644
--- a/tools/android-app/app/src/main/AndroidManifest.xml
+++ b/tools/android-app/app/src/main/AndroidManifest.xml
@@ -21,7 +21,8 @@
 
     <application
         android:name=".VoiceApp"
-        android:allowBackup="true"
+        android:allowBackup="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
         android:icon="@drawable/ic_launcher"
         android:label="@string/app_name"
         android:networkSecurityConfig="@xml/network_security_config"
diff --git a/tools/android-app/app/src/main/res/xml/data_extraction_rules.xml b/tools/android-app/app/src/main/res/xml/data_extraction_rules.xml
new file mode 100644
index 000000000..f3f64a9d1
--- /dev/null
+++ b/tools/android-app/app/src/main/res/xml/data_extraction_rules.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  The companion stores a Doorkeeper bearer token (full mobile-API access to the
+  user's Collavre account) in the `collavre_voice` Preferences DataStore. That
+  file is app-private but plaintext, so it must never leave the device via a
+  backup channel. allowBackup="false" already blocks Auto Backup and adb backup;
+  on Android 12+ dataExtractionRules governs cloud-backup and device-transfer
+  SEPARATELY, so we exclude the file domain (where the datastore lives) from
+  BOTH — otherwise a device-to-device migration would copy the token in cleartext.
+-->
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="file" />
+        <exclude domain="sharedpref" />
+        <exclude domain="database" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="file" />
+        <exclude domain="sharedpref" />
+        <exclude domain="database" />
+    </device-transfer>
+</data-extraction-rules>