How your journal is protected

What is encrypted

Every piece of prose you write — journal entries, coach conversations, AI summaries, and the personal profile the system builds about you — is encrypted before it's saved. The names of people you mention in goals or tensions are encrypted too. Each account has its own encryption key. Without that key, the saved data is mathematical noise.

What stays in plain text

The numeric signals derived from your entries — mood score, sleep hours, whether you exercised, broad themes (e.g. "work", "family"), and the search index — are stored as plain numbers and short labels. They're what makes your insights charts and pattern detection work, and they don't reveal what you actually wrote.

A note about older entries

Encryption was added to the app on June 6th 2026. From this date encryption was enabled onward, and every new entry, message, summary, and named person is encrypted at rest.

Who can read your entries

• ✓You, when you sign in. The app decrypts on the fly as you read.
• •The AI Models briefly, while they are analyzing a new entry to detect patterns or update your profile. It does not retain the text. This is unavoidable — local models good enough for this work don't fit in a browser yet.
• ✕Anyone with database access — including the operator of this app — sees only ciphertext when they look at your new entries. A database leak or a stolen backup is unreadable without the master key.

What this is not

This is not "zero-knowledge" encryption. A determined operator with access to both the database and the application's master key could decrypt entries — that's the trade-off we made so password reset still works. If you want the strongest possible promise (lose the password, lose the entries forever), let us know; the system is built so we can offer that as an option.

If you delete your account

Your per-account encryption key is destroyed. Even if a row somehow survived a deletion, it would be unrecoverable. There's no undelete.