rclone sync mirrors the source: a file disappears there, it disappears at the destination. Chained after a local rsync --delete, a mistake at any point propagates the destruction all the way to the cloud, irreversibly.

--backup-dir moves whatever would be deleted or overwritten into a dated folder:

rclone sync ./backup/library remote:library \
  --backup-dir remote:_deleted/2026-07-11/library

Now nothing is actually erased — just relocated to _deleted/. A restore is a copy back.

Gotcha: --backup-dir can’t live inside the destination. If you sync to the remote’s root, sync subdirectory by subdirectory (library, database, …), each with its own _deleted/…/<sub>.