What we hold, and what we cannot see
Not a policy written to be agreed to. This is what the software actually does, in enough detail that you could check it.
We never asked who you are
No name, no email address, no phone number. There is nothing in your account that points back at you, because we never collected anything that could.
Your writing is locked before it leaves your device
Every entry is encrypted on your own device, with a key made from your phrase. That key is never sent anywhere and never stored — it exists only in memory while your journal is open, which is why closing the tab locks it again.
If you turn on sync, this is exactly what reaches us
Sync is optional. With it off, nothing you write leaves your device at all. With it on, here is the complete list — not a summary of it.
What we receive
- A meaningless identifier for the entry
- A block of encrypted data we cannot open
- Which day it was written — the day, not the time
- Its rounded size, in steps of 256 characters
What we never receive
- A single word of what you wrote
- The time of day you wrote it
- How long it really is
- Anything you searched for
Nothing watches you here
No analytics, no tracking, no advertising, no third-party code of any kind — the page you are reading loads nothing from anywhere but us. We keep no record of when you opened the app, what you looked at, or that you visited the help page. Searching happens on your device; what you type into it never leaves.
You can take it, and you can end it
Export gives you everything as plain text you can open without us, and it works even when you cannot reach us. Deleting destroys the keys, which is what makes it real: what is left cannot be opened by anyone, including us.
Who else touches this
Two companies, and neither can read anything. One serves the pages to your browser and sees only that a device asked for them. One stores the encrypted blocks if you turn on sync, and can see exactly what the list above says we receive — nothing more. No advertising network, no analytics company, no AI service, and no data broker is involved at any point, because your writing never leaves your device unencrypted.
What you can ask us for
The usual answer to "what do you hold about me" is a form and a wait. Here it is a button: export gives you everything, immediately, without asking us. What we could send you ourselves is the encrypted blocks and the day each was written — the same thing we see, and unreadable to us.
Deleting works the same way. You do not request it and wait; you do it, and the keys are destroyed. What remains cannot be opened by anyone, including us.
What this cannot do
If you forget your phrase and lose your recovery key, we cannot get your writing back. Not "will not" — cannot. That is the same property that stops anyone else reading it.
This protects your writing from us and from the network. It cannot protect you from someone who has your unlocked device in their hands.
If we were legally compelled to hand over everything we hold, it would still be data nobody can read. That is the design, not a promise about the law.