CloudSync Help

CloudSync keeps your local folders in sync with the cloud — automatically, in the background. Changes you make on disk are uploaded within seconds; changes from other devices are pulled down on a regular interval.

---

Getting started

CloudSync is distributed as a Flatpak and works on any Linux distribution that supports it — Ubuntu, Fedora, Pop!_OS, Linux Mint, Arch, and more. If Flatpak is not already set up on your system, visit flathub.org/setup for distribution-specific instructions.

When you first launch CloudSync, a setup wizard will walk you through:

1. Choosing a cloud provider
2. Signing in
3. Picking a local folder and a cloud folder to sync

Once set up, CloudSync runs in your system tray and syncs continuously. You can add more accounts and folders at any time from the main window.

---

Connecting a cloud account

Google Drive

1. In the main window, click + next to Cloud Accounts.
2. Choose Google Drive.
3. A sign-in window opens — log in with your Google account and grant access.
4. CloudSync stores your token locally. You won't need to sign in again unless you revoke access.

Dropbox

1. Click + next to Cloud Accounts and choose Dropbox.
2. A sign-in window opens — log in with your Dropbox account and click Allow.
3. Your token is stored locally.

Microsoft OneDrive

CloudSync supports both personal Microsoft accounts (@outlook.com, @hotmail.com, @live.com) and work/school accounts (Microsoft 365 / Entra ID).

Personal account (no setup required)

1. Click + next to Cloud Accounts and choose Microsoft OneDrive.
2. Select Personal (the default).
3. Click Sign in with Microsoft — a Microsoft login window opens.
4. Sign in with your @outlook.com / @hotmail.com / @live.com account and approve the permissions.
5. Your token is stored locally. You won't need to sign in again unless you revoke access.

Work / School account (Microsoft 365)

Work and school accounts require a one-time Azure app registration to obtain a Client ID. See Microsoft OneDrive — Work/School Setup at the end of this guide for step-by-step instructions.

Once you have a Client ID:

1. Click + → Microsoft OneDrive.
2. Select Work / School.
3. Paste your Application (Client) ID into the field that appears.
4. Click Sign in with Microsoft and authenticate with your work or school account.

Note: OneDrive's Personal Vault cannot be accessed by third-party apps — this is a Microsoft restriction. It will not appear in the folder picker. Choose any regular OneDrive folder instead.

Amazon S3

You'll need an AWS Access Key ID and Secret Access Key for an IAM user with permissions on your target bucket.

1. Click + next to Cloud Accounts and choose Amazon S3.
2. Enter your Access Key ID, Secret Access Key, and Region (e.g. us-east-1).
3. Leave Endpoint URL blank for standard AWS S3.
4. Click Connect — CloudSync will verify your credentials.

Minimum IAM policy (whole bucket):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::YOUR_BUCKET"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::YOUR_BUCKET/*"
    }
  ]
}

Minimum IAM policy (prefix/folder only — recommended):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::YOUR_BUCKET",
      "Condition": {
        "StringLike": { "s3:prefix": ["YOUR_PREFIX/*"] }
      }
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::YOUR_BUCKET/YOUR_PREFIX/*"
    }
  ]
}

If your bucket uses SSE-KMS encryption, also add these permissions on the KMS key:

• kms:Decrypt
• kms:Encrypt
• kms:GenerateDataKey

Backblaze B2

B2 uses the S3-compatible API.

1. In your Backblaze console, go to App Keys and create a key with read/write access to your bucket.
2. Note the keyID, applicationKey, and the S3 Endpoint shown on your bucket page (e.g. s3.us-west-004.backblazeb2.com).
3. In CloudSync, click + → Backblaze B2.
4. Enter your keyID as Access Key ID, applicationKey as Secret, and paste the endpoint URL.
5. Set the region to match the endpoint (e.g. us-west-004).

Cloudflare R2

1. In the Cloudflare dashboard, go to R2 → Manage R2 API Tokens and create a token with Object Read & Write on your bucket.
2. Note the Access Key ID, Secret Access Key, and your Account ID from the R2 dashboard URL.
3. In CloudSync, click + → Cloudflare R2.
4. Enter your credentials and set the endpoint to https://<ACCOUNT_ID>.r2.cloudflarestorage.com.
5. Set region to auto.

iDrive e2

1. Log in to the iDrive e2 console, go to Access Keys, and create a new key pair.
2. Note the Access Key, Secret Key, and the Endpoint shown in your e2 console for your chosen region.
3. In CloudSync, click + → iDrive e2.
4. Enter the Access Key, Secret Key, and endpoint URL. Region can be left as us-east-1 unless your endpoint indicates otherwise.

Wasabi

1. In the Wasabi console, go to Access Keys and create a key with access to your bucket.
2. Note the Access Key, Secret Key, and your bucket's region (e.g. us-east-1, eu-central-1).
3. In CloudSync, click + → Wasabi.
4. Enter your credentials. The endpoint is auto-populated as https://s3.<region>.wasabisys.com — adjust if your bucket is in a different region.

Storj

1. In the Storj dashboard, go to Access Keys and create an S3-compatible access grant.
2. Note the Access Key and Secret Key provided.
3. In CloudSync, click + → Storj.
4. Enter your credentials. The endpoint is https://gateway.storjshare.io and region is global.

DigitalOcean Spaces

1. In the DigitalOcean control panel, go to API → Spaces Keys and create a new key.
2. Note the Access Key and Secret Key. Find your Space's region from its URL (e.g. nyc3, ams3, sgp1).
3. In CloudSync, click + → DigitalOcean Spaces.
4. Enter your credentials. The endpoint is https://<region>.digitaloceanspaces.com (e.g. https://nyc3.digitaloceanspaces.com).

Linode Object Storage

1. In the Linode Cloud Manager, go to Object Storage → Access Keys and create a key.
2. Note the Access Key, Secret Key, and the cluster ID for your bucket's region (visible in the bucket's URL, e.g. us-ord-1, eu-central-1).
3. In CloudSync, click + → Linode Object Storage.
4. Enter your credentials. The endpoint is https://<cluster>.linodeobjects.com where <cluster> matches your bucket's cluster ID.

Vultr Object Storage

1. In the Vultr customer portal, go to Object Storage and create an object storage instance.
2. Note the Access Key, Secret Key, and the Hostname (endpoint) shown on the instance page.
3. In CloudSync, click + → Vultr Object Storage.
4. Enter your credentials using the Hostname as the endpoint URL. The region can be any value — use the location identifier shown in your hostname (e.g. ewr1 for New Jersey).

Scaleway Object Storage

1. In the Scaleway console, go to IAM → API Keys and create a key with Object Storage permissions.
2. Note the Access Key ID and Secret Key. Find your bucket's region (e.g. fr-par, nl-ams, pl-waw).
3. In CloudSync, click + → Scaleway Object Storage.
4. Enter your credentials. The endpoint is https://s3.<region>.scw.cloud (e.g. https://s3.fr-par.scw.cloud).

MinIO

1. In your MinIO deployment, create an access key via the MinIO Console under Access Keys, or use the mc admin accesskey create <alias> <username> CLI command.
2. Note the Access Key, Secret Key, and the URL of your MinIO server (e.g. https://minio.example.com).
3. In CloudSync, click + → MinIO.
4. Enter your credentials and set the endpoint to your MinIO server URL. Region can be any value (e.g. us-east-1).

---

Adding a sync folder

1. Click + next to Sync Folders in the main window.
2. Choose the cloud account to sync with.
3. Click Browse to pick the remote bucket or folder.
4. Choose a local folder on your computer.
5. Click Add Folder.

CloudSync will do an initial sync immediately, then continue syncing in the background.

---

Managing sync folders

Each folder row in the main window shows the current sync status. Click the row to expand it for detailed progress.

• Sync now — click the sync icon on the row to trigger an immediate sync for that folder only.
• Edit (pencil icon) — change the remote folder, sync interval, or conflict strategy for this folder.
• Remove (minus icon) — stop syncing this folder. Your local files are not deleted.

---

Sync timing

CloudSync watches your local folder in real time using inotify. Local changes are uploaded within a few seconds of being saved.

For pulling down remote changes, CloudSync polls on a regular interval. You can set the interval globally in Preferences, or override it per folder in the folder's Edit dialog.

Interval	When to use
30 seconds	Active collaboration — you need near-real-time updates from others
1 minute	Default — good balance of freshness and network activity
5 minutes	Low-traffic use or metered connections
15 minutes	Rarely-changing folders or very limited bandwidth

---

Conflict resolution

A conflict happens when the same file is changed on your local device and in the cloud between syncs.

You can set a default strategy in Preferences, and override it per folder in the folder's Edit dialog.

Keep both copies (default)

Your local version is copied to filename.conflict_TIMESTAMP.ext and uploaded alongside the remote copy. The remote version is then downloaded to the original filename. Both copies end up on all your devices — you decide which one to keep.

Best for: shared folders or any situation where you don't want to risk losing changes.

Local copy wins

Your local version overwrites the remote file. Any changes made on other devices since the last sync are discarded.

Best for: folders you only edit from this device.

Remote copy wins

The remote version overwrites your local file. Any local changes made since the last sync are discarded.

Best for: read-only or reference folders where the cloud is always authoritative.

---

Preferences

Open Preferences by clicking the gear icon (⚙) in the top-right corner of the main window.

• Default sync interval — how often to check for remote changes (can be overridden per folder)
• Default conflict resolution — what to do when the same file is edited in two places (can be overridden per folder)
• Desktop notifications — show a notification when a sync completes or an error occurs
• Start on login — automatically launch CloudSync when you log in

---

Subscription

CloudSync is free to use with one cloud provider and one sync folder. A subscription ($9.99/year) removes all limits.

Subscribing

1. Visit cloudsync.seravault.com and click Subscribe & Download.
2. Complete the checkout using the email address you want associated with your subscription.
3. Open CloudSync and go to Preferences → Subscription.
4. Enter the email address you used to subscribe and click Sign In.
5. CloudSync will verify your subscription and unlock all features immediately.

Checking your subscription status

Open Preferences → Subscription. The status row at the top shows whether your subscription is active and when it renews. CloudSync re-validates your subscription at most once per week. If you just subscribed and need to activate immediately, sign in with your email.

Signing out

To remove your account from this machine, open Preferences → Subscription and click Sign Out. The app reverts to free tier limits (1 provider, 1 sync folder). Your existing sync folders and cloud accounts remain intact.

Renewing

Subscriptions renew automatically each year through Stripe. If your subscription lapses, CloudSync continues running but reverts to free tier limits. To renew, visit cloudsync.seravault.com or contact cloudsync@seravault.com.

Subscription not activating?

• Make sure you're entering the exact email address used during checkout.
• Allow a minute or two after purchase before signing in — Stripe may take a moment to confirm payment.
• Check your internet connection — the app needs to reach our validation server.
• If the problem persists, email cloudsync@seravault.com with your purchase email.

---

Troubleshooting

AccessDenied errors with S3

1. Confirm the bucket name is spelled correctly.
2. Make sure s3:ListBucket is granted on the bucket ARN (not the object ARN).
3. Make sure s3:GetObject, s3:PutObject, s3:DeleteObject are granted on arn:aws:s3:::YOUR_BUCKET/*.
4. Check that the region matches the bucket's actual region.
5. If using SSE-KMS, ensure the KMS key permissions are in place.
6. Check for explicit Deny statements in your bucket policy or AWS Service Control Policies — an explicit deny overrides any allow.

A folder shows an error and won't sync

• Check the Recent Errors section at the bottom of the main window for details.
• If the error mentions authentication, click Edit on the account and reconnect.
• For S3/B2/R2, verify your access key hasn't been rotated or revoked.

Files aren't uploading after a save

• Make sure the folder is enabled (the toggle in the folder row is on).
• Check that there is enough free space in your cloud account.
• Look at Recent Errors for any upload failures.

CloudSync isn't starting on login

• Open Preferences and toggle Start on login off, then on again.

---

Enterprise Deployment

This section is for IT administrators who need to deploy CloudSync across a fleet of machines (Intune, Jamf, Ansible, or similar).

---

How the config layers work

CloudSync loads configuration in this order — later layers win:

1. Built-in defaults (compiled into the app)
2. Base config — read-only, administrator-controlled
3. User config — read/write, per user (~/.config/cloudsync/config.json)

The base config lets you pre-set sync interval, conflict strategy, and the OneDrive Client ID. Users can override everything in the base config from their own settings. The base config is never written by the app.

---

Setting the base config path

Option A — Environment variable (recommended for MDM):

CLOUDSYNC_BASE_CONFIG=/etc/cloudsync/base.json

Push this via /etc/environment, a systemd drop-in (/etc/systemd/user/cloudsync.service.d/), or your MDM's environment variable management. CloudSync reads the variable at startup before any config files are opened.

Option B — CLI flag (useful for testing or scripts):

cloudsync --base-config /etc/cloudsync/base.json

CLI flags override environment variables if both are present.

---

Setting the user config path

By default CloudSync stores user config in ~/.config/cloudsync/config.json. To redirect it (e.g. to a network home or managed profile directory):

CLOUDSYNC_CONFIG=/home/managed/cloudsync/config.json

Or via CLI: cloudsync --config /home/managed/cloudsync/config.json

---

Base config file format

/etc/cloudsync/base.json is a plain JSON file. All keys are optional:

{
  "sync_interval_seconds": 300,
  "conflict_resolution": "keep_both",
  "notifications_enabled": true,
  "start_on_login": false,

  "onedrive_client_id": "ab12cd34-ef56-7890-abcd-ef1234567890"
}

Key	Type	Effect
sync_interval_seconds	integer	Default poll interval (30, 60, 300, or 900)
conflict_resolution	string	"keep_both", "local_wins", or "remote_wins"
notifications_enabled	boolean	Desktop notifications on/off
start_on_login	boolean	Autostart at login
onedrive_client_id	string	Pre-seeds onedrive_credentials.json so users never need to enter a Client ID

The file must be readable by all users. It does not need to be writable.

---

Pre-seeding the OneDrive Client ID

When onedrive_client_id is present in the base config, CloudSync writes it to ~/.config/cloudsync/onedrive_credentials.json on first launch — but only if that file doesn't already exist. This means:

• New users: Client ID is silently pre-filled, sign-in flow works immediately.
• Existing users: Their existing credentials are never overwritten.

Users selecting Work / School in CloudSync will see the Client ID field pre-filled. They only need to click Sign in.

---

MDM deployment example (Intune / shell script)

#!/bin/bash
# Deploy CloudSync base config to /etc/cloudsync/base.json

install -d -m 755 /etc/cloudsync

cat > /etc/cloudsync/base.json << 'EOF'
{
  "sync_interval_seconds": 300,
  "conflict_resolution": "keep_both",
  "onedrive_client_id": "YOUR_CLIENT_ID_HERE"
}
EOF
chmod 644 /etc/cloudsync/base.json

# Append the env var to system-wide environment
if ! grep -q CLOUDSYNC_BASE_CONFIG /etc/environment; then
  echo 'CLOUDSYNC_BASE_CONFIG=/etc/cloudsync/base.json' >> /etc/environment
fi

For Ansible:

- name: Deploy CloudSync base config
  copy:
    dest: /etc/cloudsync/base.json
    mode: "0644"
    content: |
      {
        "sync_interval_seconds": 300,
        "conflict_resolution": "keep_both",
        "onedrive_client_id": "{{ cloudsync_onedrive_client_id }}"
      }

- name: Set CLOUDSYNC_BASE_CONFIG system-wide
  lineinfile:
    path: /etc/environment
    line: "CLOUDSYNC_BASE_CONFIG=/etc/cloudsync/base.json"
    regexp: "^CLOUDSYNC_BASE_CONFIG="

---

Flatpak sandbox note

CloudSync is distributed as a Flatpak with --filesystem=host permission, so it can read files anywhere on the host filesystem including /etc/cloudsync/. No additional sandbox permissions are needed.

---

Microsoft OneDrive — Work/School Setup

This section explains how to register a Microsoft Entra ID application so that CloudSync can authenticate work and school accounts (Microsoft 365 / Office 365). You only need to do this once per organisation.

Personal accounts (@outlook.com, @hotmail.com, @live.com) use a built-in registration and do not need these steps.

---

Prerequisites

• A Microsoft work or school account with permission to register applications in your organisation's Azure tenant. If you see "You don't have permission to create applications" ask your IT administrator.
• A browser signed in to portal.azure.com with that account.

---

Step 1 — Create the app registration

1. In the Azure portal, open the navigation menu (☰) and choose Microsoft Entra ID.
2. In the left sidebar, select App registrations.
3. Click + New registration at the top.
4. Fill in the form:
5. Name: CloudSync (or any name you like — this is only shown to admins)
6. Supported account types: Choose one:
   • Accounts in this organizational directory only — only users in your own tenant can authenticate. Best for a single company.
   • Accounts in any organizational directory — any Microsoft 365 / work account worldwide. Use this if you distribute CloudSync to users in multiple organisations.
   • Do not choose "personal accounts" options here — this registration is for work/school accounts only.
7. Redirect URI:
   • Platform: Public client / native (mobile & desktop)
   • URI: http://localhost
8. Click Register.

You are now on the app's overview page. Leave this tab open.

---

Step 2 — Copy the Client ID

On the app overview page, copy the value labelled Application (client) ID. It looks like:

ab12cd34-ef56-7890-abcd-ef1234567890

This is the value you paste into CloudSync's Application (Client) ID field.

---

Step 3 — Verify the redirect URI

1. In the left sidebar, click Authentication.
2. Under Platform configurations, confirm that Mobile and desktop applications shows http://localhost as a redirect URI.
3. If it is missing, click Add a platform, choose Mobile and desktop applications, check http://localhost, and click Configure.
4. Click Save.

---

Step 4 — Set the API permissions (optional but recommended)

By default, the registration already has User.Read (sign-in). CloudSync only needs Files.ReadWrite — this is requested at sign-in time and does not need to be pre-granted unless your tenant requires admin consent for all permissions.

If your IT policy requires admin pre-consent:

1. In the left sidebar, click API permissions.
2. Click + Add a permission → Microsoft Graph → Delegated permissions.
3. Search for Files.ReadWrite and tick it.
4. Click Add permissions.
5. Click Grant admin consent for [your organisation] and confirm.

---

Step 5 — Connect in CloudSync

1. Open CloudSync and click + next to Cloud Accounts.
2. Choose Microsoft OneDrive.
3. Select Work / School.
4. Paste the Application (Client) ID from Step 2.
5. Click Sign in with Microsoft.
6. A Microsoft login window opens — sign in with your work or school account.
7. If prompted, approve the permissions requested by the app.

CloudSync stores the token locally. The token refreshes automatically and will not expire as long as the app remains signed in.

---

Troubleshooting the work/school flow

"AADSTS50011: The reply URL specified in the request does not match"

The redirect URI in your app registration does not include http://localhost. Go to Authentication in the Azure portal, add it under Mobile and desktop applications, and save.

"AADSTS65001: The user or administrator has not consented to use the application"

Your tenant requires admin consent. Ask your IT administrator to follow Step 4 above and grant consent on behalf of the organisation.

"AADSTS700016: Application with identifier '…' was not found in the directory"

The Client ID you pasted does not match any app registration in the tenant. Double-check you copied the full Application (client) ID (not the Directory/tenant ID or Object ID) from the correct app registration page.

"You don't have permission to sign in here"

The app was registered for a single tenant and you are signing in from a different tenant. Change Supported account types in the app registration to Accounts in any organizational directory if multi-tenant access is needed.

Sign-in window closes with no result

MSAL requires the redirect URI to be http://localhost (no trailing slash, no port number) registered as a Mobile and desktop platform — not a Web platform. Check the Authentication page and confirm the platform type is correct.

---

Free developer tenant for testing

If you do not have a work or school account but want to test the work/school flow, Microsoft offers a free developer tenant:

1. Go to developer.microsoft.com/microsoft-365/dev-program and click Join now.
2. Sign in with any existing Microsoft account (personal is fine).
3. Follow the prompts to set up an instant sandbox tenant (e.g. yourname.onmicrosoft.com).
4. You get 25 user licences with full Microsoft 365 E5 capabilities, renewable every 90 days.
5. Use the admin account of that tenant (admin@yourname.onmicrosoft.com) to register the app as described in Steps 1–4 above.