Your phone holds more irreplaceable data than your computer. The photos, the messages, the notes written at 2am, the record of where you've been and who you talked to. It's also the device most likely to be lost, stolen, dropped in water, or replaced entirely.
Most people have some backup running. Very few have a complete one, and the gaps are consistent.
Start with the basics, verified
iPhone: Settings → your name → iCloud → iCloud Backup. Turn it on, and then look at the last successful backup date. That number is the only thing that matters.
Backups run when the phone is locked, connected to power, and on Wi-Fi. If yours charges in a room with poor Wi-Fi, or you unplug it before bed, backups may not be running at all.
Android: Settings → Google → Backup. Turn it on. Then check Google Photos separately — photo backup is a distinct system with its own switch and its own failure modes.
Both: if you're near your cloud storage limit, backups fail silently. The notification looks like every other notification. Check storage first if the date is stale.
What the standard backup does and doesn't cover
This is where the gaps are, and they're not obvious.
iPhone: the backup covers app data, settings, home screen layout, and health data. It excludes anything already synced to iCloud — which includes your photos if iCloud Photos is on, and your messages if Messages in iCloud is on.
That exclusion is logical (why store them twice) and it matters enormously: if you delete a photo, it's deleted from iCloud too, and there's no copy in the backup to restore from. Sync is not backup, and the parts of your phone that sync are not protected by the parts that back up.
Android: the backup covers settings, app data for apps that opt in, and call history. App developers can exclude their data from backup, and many do. Photos are handled separately by Google Photos.
Both platforms: apps with their own accounts (messaging apps, note apps, password managers) generally restore from their own services rather than the device backup. That's usually fine, and it means you're depending on each of those services individually.
The five gaps almost everyone has
1. Messages
iPhone: if Messages in iCloud is on, messages sync. Deleting a conversation deletes it everywhere, permanently after a short recovery window. If it's off, messages are in the device backup instead — which means restoring an old backup restores messages as of that date.
Android: SMS is typically included in Google backup. Messages in third-party apps depend entirely on that app's own backup, which is often off by default.
Either way, if a conversation genuinely matters — evidence, a record of an agreement, messages from someone who's died — export it. Both platforms and most apps support exporting a conversation to a file. Do it deliberately, because no automatic system is reliably preserving it.
2. Authenticator app codes
This is the one that strands people. Your two-factor authentication codes live in an authenticator app. Lose the phone without a transfer, and you can't get into the accounts that need those codes — including, often, the account holding your backup.
Fix it now:
- Use an authenticator that supports encrypted cloud sync, so codes move to a new device
- Save the recovery codes every service gives you when you set up two-factor, somewhere that isn't the phone — a password manager, or printed and stored physically
- Register a second device or a hardware key where the service supports it
Do this before you lose the phone. Afterwards, the recovery process ranges from tedious to impossible.
3. WhatsApp and other messaging apps
Most messaging apps have their own backup, separate from the phone's, often off by default and often not cross-platform. Moving between iPhone and Android is where message history most commonly disappears.
Check each app you'd miss: is its backup on, where does it go, and when did it last run?
4. App data for apps that opt out
Fitness tracking, journals, offline note apps, games with local progress, anything storing data purely on the device. Some of these exclude themselves from the system backup.
You find out by restoring a new phone and discovering an app is empty. The prevention is to check the app's own settings for an export or backup option for anything you'd genuinely miss.
5. Photos, if optimize storage is on
If your phone is set to keep smaller versions locally with originals in the cloud, the phone does not contain your photo library. People assume the phone is a copy. It isn't.
This means your entire photo library exists in exactly one place: one cloud account. Which is one account problem away from gone.
Making a real local copy
Cloud backup is genuine backup, and it's inside one account. A local copy removes that single point of failure.
iPhone to a computer: connect the phone, open Finder (Mac) or the appropriate app on Windows, and back up to the computer. Tick "encrypt local backup" — encrypted backups include health data and saved passwords, and unencrypted ones don't. Store the encryption password in your password manager.
Android to a computer: connect and copy the DCIM folder and any other folders with data you care about. Android's file access is more open, which makes this straightforward for media and less complete for app data.
Photos specifically: export your library to an external drive once or twice a year. On iPhone, this can be done through the Photos app on a Mac or by downloading from the web interface. This is the single most valuable manual backup step available, because photos are the most irreplaceable thing on the device and they're the most likely to exist only in a sync.
Do this quarterly if you take a lot of photos. Annually at minimum.
Before you replace or sell a phone
- Take a fresh backup — cloud and local.
- Transfer authenticator codes to the new device, and verify you can generate a code, before wiping the old one.
- Check messaging apps have transferred or been backed up.
- Sign out of your accounts on the old device.
- Keep the old phone for a month after the new one is set up. It's the best possible backup of itself, and things surface late.
- Then factory reset it, and confirm the reset completed.
Step five is the one people skip. A phone in a drawer is a complete, working copy of everything as of the day you stopped using it.
If your phone is lost or stolen right now
- Use the find-my-device service to locate it, and mark it as lost — this locks it and displays a message.
- Don't wipe it immediately if you have any hope of recovery. Lost mode is enough to protect the data.
- If recovery is hopeless, wipe it remotely.
- Change the password on your main account — the one tied to the phone.
- Check what was signed in on it and revoke sessions where you can.
- Contact your carrier to disable the SIM, particularly if you use SMS for authentication.
- Report it to the police if stolen, for insurance purposes.
Step six matters more than it looks. A stolen SIM in a phone that receives your authentication texts is a route into your accounts.
The setup worth having
- Cloud backup on, last successful date verified as recent
- Enough cloud storage that backups aren't silently failing
- Photo backup on, and mode understood
- Authenticator codes syncable, and recovery codes stored off the phone
- Messaging app backups checked individually
- A local encrypted backup to a computer, occasionally
- Photo library exported to an external drive annually
- Find-my-device enabled
- Screen lock and device encryption on
The two items that most people are missing: authenticator recovery codes stored somewhere else, and a photo export that isn't in the same account as everything else.
Backup features, what's included, and where the settings live change between operating system versions. Check your device's current documentation.
Next in this series: Ransomware and Your Files: How Not to Lose Everything