You Can Only Back Up What You Actually Have
A backup only counts if something else can open it. Why the file format, and not the schedule, decides whether your work survives the next five years.
Time Machine gave me a clean bill of health last week. Last backup finished twenty minutes ago, drive healthy, nothing to report. Then I counted the things I actually work on and compared them with the list that lives on that disk. The two lists did not match.
Everything I write in a browser was absent. The document sat on a server, and what my laptop held was a rendering of it plus a session cookie that says I am allowed to look. There was nothing local to copy, which is exactly why the timestamp looked so healthy.
That gap never appears in a report, and it is why I treat the whole subject as a file-format problem before a drive problem.
Three tests a copy has to pass
Something only counts as a backup if you can open it without asking anyone's permission. That splits into three tests, and a lot of modern software fails all three.
The first is custody. If today's work only ever lived in a browser tab, nothing on your machine is worth copying, and no scheduling on your side changes that.
The second is format. A folder of .docx files passes, because another program can read it. A proprietary blob that needs the original vendor's sign-in to render does not pass, even when the bytes are sitting on your desk.
The third is the one people skip, and the one that matters most: whether you can restore the thing. A copy you have never opened is a hypothesis. Twice a year I pull one file out. It goes into an empty folder on a spare disk and gets opened there, which takes ten minutes and caught one of my disks dying before a real emergency did.
Where your work sits tonight
Most tools in a normal subscription stack hold your work in one of three places, and the three places behave differently the day you need them back.
A web app keeps the only copy. You get an interface, a login, and an export button that may or may not produce something usable. If the company is acquired, raises prices, or shuts the doors, access to your work ends with the account.
A desktop app with a sync service keeps a copy on your disk and treats the server as the master, which holds up fine until a migration goes sideways and the local copy is overwritten to match it. Every support forum in existence has that story, usually dated a Tuesday.
A desktop app that writes ordinary documents to a folder you chose keeps the master on your disk. The software is only a way to open and edit them. Uninstall it and the documents are still there, still readable, still yours.
Only the last group ends up on your disk in a form that means anything ten years from now.
What that looks like on the menu
Every app on the café's shelves writes to a format something else can read. That is the whole point of the local-first idea, and it shows up in small, checkable details.
SteepJournal keeps a diary in a single file that you name and store wherever you like. Entries, tags, photos and attachments are sealed with a key derived from your password, so the file sitting in Documents is unreadable to anything but the software that made it. Carry that one file to an external disk and the whole journal travels with it. The rest of the Affogato shelf is built the same way.
PrivateMedia takes the opposite route to the same end: a vault folder of encrypted photos and videos on your own disk, plus an export command that hands back an ordinary decrypted file whenever you want one. Locked, the folder is a pile of noise. Unlocked, any photo comes out as a normal JPEG.
Notes are plain Markdown in NoteCafe. Contracts and reports are standard .docx in DocCafe. Passwords live in KeePass-compatible .kdbx files via PassBrew. Plans with dependencies are ProjectCafe projects, books are BookCafe files. Each of those formats has at least one other program that opens it, which is what you want from anything you plan to need in five years.
The honest catch
Encryption makes part of this harder, and it would be dishonest to skip that.
A locked journal is only as recoverable as its password. Copy the file faithfully and forget what unlocks it, and you have a tidy archive of nothing. So that secret goes somewhere else entirely: a password manager you also back up, a printed sheet in a drawer, or both. Two places beats one clever place.
Offsite still matters too. A local-first setup protects you from a vendor going away. It won't save you from a fire, a flood, or a laptop left on a train. A second drive in a different building, or an encrypted copy in whatever cloud bucket you choose, is cheap and covers the failure mode no file format can.
The routine I keep
Four habits, all boring. Originals live in a folder I named, so making a copy never means running an export. The schedule runs whether or not I remember it. The printed password sheet in the drawer gets replaced whenever one of those passwords changes. And a second copy sits unplugged in a different building, refreshed whenever I visit.
Everything else about this subject is detail. The question that decides whether any of it works is simpler than the feature list: when you close the laptop, is there a file on it that another program can open?
If not, the backup is holding a copy of your access to someone else's files, and access is the one thing no restore command can bring back.
That question is why the apps here are built the way they are. The menu runs to 126 apps across eight shelves, one subscription for the lot: $9.99 a month, or $4.99 a month billed yearly. If ownership is the part you care about, what local-first actually means and why the cloud is a prison for your workflows pick up where this leaves off.