What we hold, and what we cannot see
Not a policy written to be agreed to. This is what the software actually does, in enough detail that you could check it.
We never asked who you are
No name, no email address, no phone number. There is nothing in your account that points back at you, because we never collected anything that could.
Your writing is locked before it leaves your device
Every entry is encrypted on your own device, with a key made from your phrase. That key is never sent anywhere and never stored — it exists only in memory while your journal is open, which is why closing the tab locks it again.
If you turn on sync, this is exactly what reaches us
This is about your journal — the writing that is yours alone. Sync is optional. With it off, nothing you write in your journal leaves your device at all. With it on, here is the complete list — not a summary of it. Posting in a room is a different thing, and it has its own section below.
What we receive
- A meaningless identifier for the entry
- A block of encrypted data we cannot open
- Which day it was written — the day, not the time
- Its rounded size, in steps of 256 characters
What we never receive
- A single word of anything you wrote in your journal
- The time of day you wrote it
- How long it really is
- Anything you searched your own journal for
If you post in a room, that part is different
A room is a place other people read, so anything you put in one arrives here as plain words rather than as a locked block. We can read it, and so can whoever reviews a report about it. Searching inside a room happens on our side too, so those words reach us as well. None of this changes your journal: it stays locked, and joining a room does not unlock a single thing you wrote there.
Nothing watches you here
No analytics, no tracking, no advertising, no third-party code of any kind — the page you are reading loads nothing from anywhere but us. We keep no record of when you opened the app, what you looked at, or that you visited the help page. Searching your journal happens on your device; what you type into it never leaves. Searching inside a room is the one exception, and the section above says so.
You can take it, and you can end it
Export gives you everything as plain text you can open without us, and it works even when you cannot reach us. Deleting destroys the keys, which is what makes it real: what is left cannot be opened by anyone, including us. Both start from inside the app, without asking us for either.
Who else touches this
Two companies, and neither can read your journal. One serves the pages to your browser and sees only that a device asked for them. One stores the encrypted blocks if you turn on sync, and can see exactly what the list above says we receive — nothing more. No advertising network, no analytics company, no AI service, and no data broker is involved at any point, with anything you write. Not your journal, and not what you post in a room either: nothing you write is sent to anybody outside this service, for any purpose, ever.
What you can ask us for
The usual answer to "what do you hold about me" is a form and a wait. Here it is a button: export gives you everything, immediately, without asking us. What we could send you ourselves is the encrypted blocks and the day each was written — the same thing we see, and unreadable to us.
Deleting works the same way. You do not request it and wait for us to decide; you start it yourself, in Settings under “Your account”. Nothing is destroyed for seven days, so changing your mind takes one tap — and after that the keys are destroyed and what is left cannot be opened by anyone, including us.
What this cannot do
If you forget your phrase and lose your recovery key, we cannot get your writing back. Not "will not" — cannot. That is the same property that stops anyone else reading it.
This protects your writing from us and from the network. It cannot protect you from someone who has your unlocked device in their hands.
If we were legally compelled to hand over everything we hold, it would still be data nobody can read. That is the design, not a promise about the law.