Last Updated October 11, 2026
Privacy
A journal is only worth keeping if you know who else could read it. This page says so plainly, including what the service can still see.
How Your Journal Is Protected
Everything you keep in the journal is encrypted on your device before it is sent, with a key made on your device. The service stores only the sealed form, the ciphertext.
Whether anyone but you is able to open it depends on how that key is kept. There are two ways. Every journal starts in the first, and you can change it in Settings whenever you like.
Standard Keeping, The Default
The service keeps a recovery copy of your key, locked with a key of its own. Signing in is then enough to get back in: on a new device, or when you have forgotten your code. There is no recovery key to store and none to lose.
In Standard keeping the service is able to open your journal. Said plainly, that means:
- whoever holds both the service's database and its key can read what you keep: the people who run the service, or someone who breaks into both;
- anyone who can sign in as you, through your mailbox or your Google account, can get in without knowing your code;
- a reset link for a forgotten code is mailed to your sign-in address and leads to your journal, so whoever can read that mailbox can follow it: in Standard keeping your mailbox is part of what protects your journal;
- the network provider in front of the service carries your key, inside the encrypted connection that it ends, at the moment the key is handed over or handed back.
The service does not open journals, and has no screen or tool that does. It is able to. Choose with that in mind.
When The Copy Is Kept. A recovery copy of a journal's key is kept only when it has been agreed to with that journal's own code: at the start, when you choose your code on the screen that says what Standard keeping means, and afterwards in Settings, under Key Keeping, where a journal that has not yet agreed on that device shows Keep A Recovery Copy For This Journal. A device you set up by signing in asks once. Nothing is handed to the service for a journal on the strength of a sign-in alone, and until a journal has a copy, a forgotten code for it may not be replaceable.
Resetting A Forgotten Code. From the lock screen or from Settings you can ask for a reset link. It is mailed to the address you sign in with, works once, lasts 15 minutes, and brings you to a screen where you choose a new code. No link is made, and no message is sent, for a journal in Ultra Secure keeping, and a link that is waiting stops working the moment Ultra Secure is turned on.
Ultra Secure Keeping
Turn it on in Settings and the service deletes its copy of your key and shows you a recovery key, once. From then on the recovery key is the way back in on a new device, and the service never has it.
In Ultra Secure keeping the journal is end-to-end encrypted: sealed on your device, opened only on your devices, with nothing on the server that opens it. That is a statement about its contents, and only about its contents. The service can still see:
- your sign-in address;
- when you sign in;
- how many records you have, and roughly how large they are;
- the times of the reminders you schedule;
- which way your key is kept, and when that was changed.
It cannot see what any record says.
If you lose every device and your recovery key, nobody can recover your journal. Not you, and not the people who run the service. Keep the recovery key somewhere you will still have when a device is gone.
Turning Ultra Secure on does not reach back into backups: a backup of the service's database made while Standard keeping was on still holds the old copy of your key until that backup ages out.
What The Service Sees Either Way
In both ways of keeping, without opening anything, the service sees your sign-in address, when you sign in, how many records you have and roughly how large they are, the times of the reminders you schedule, which way your key is kept, and when a key was handed over or the keeping was changed. In Standard keeping it also records when a reset link for a forgotten code was asked for and when one was used: the time and the account, and nothing else. Neither way protects you from a changed copy of the journal served by a compromised server; nothing that runs in a browser can.
Optional Sync Through A Store You Choose
The journal can keep its counts in step between your devices, and with other software that uses the same open format, through a storage address that you choose and control: a WebDAV address with an account and an app password of its own. This is optional. It is off unless you turn it on in Settings, and turning it off again leaves your journal as it was.
While it is on, the journal talks to one more address: the one you typed. That is the one exception to the journal talking to nothing but itself. The connection goes from your device straight to that address; it does not pass through this service.
Whoever runs that store can see:
- how many devices sync, the label you gave each, and their public keys;
- which device added or removed which;
- how many files each device writes, how large they are, and when;
- each device's network address.
They cannot see the name of anything you count, a count, or a date. Those are encrypted on your device before they leave it, under a key that reaches another device only after you approve that device and compare a short code on both.
What this service learns is the name of the store's server, at the moment your journal is opened with sync on, so that your browser can be told it may connect there. It does not learn the folder, the account or the app password: those stay on your device, sealed with your journal's own key. The name is not stored and not logged.
Whoever knows the store's app password can delete files there or hold them back. They cannot read them, and cannot make counts of their own. Turning sync off removes its keys from that device; what was already sent stays on the store, still encrypted, until you delete it there.
What Is Not Kept
- No analytics, no trackers, no advertising, and no third-party code or fonts on any page.
- No network addresses and no browser details: not in the database, and not in the service's logs.
- No password. There is none to keep.
- No list of who invited whom, and no count of members shown anywhere.
Cookies, And What Stays On Your Device
This site sets no cookies at all. The journal sets one when you sign in, to keep you signed in, and a short-lived one while you are asking for a sign-in link or signing in with Google. Two more remember, for that device, the look you chose and the name and icon the app goes by; they hold the choice and nothing that identifies you. A reset link leaves one for two minutes so that the journal opens on the right screen. With sync on, one more lasts half a minute each time the journal is opened: it lets your browser connect to the store you chose, and is removed as soon as it has been used. None of them follows you anywhere else.
Your lock choices (when the journal locks after losing focus, and after being left alone) are kept on the device itself and are not sent to the service. So are the wrapped keys a device needs to open your journal with your code, and a sealed copy of your records for use without a connection.
Who Else Handles Anything
A few outside services touch the journal, each for one job. A network provider carries traffic to it and, like any carrier, handles network addresses in transit under its own terms; the journal itself never records them. A mail provider delivers the three messages the journal sends, and no others: an invitation, a sign-in link, and Reset Your Vault Code. If you turn on reminders, they reach you through your browser's own push service, which learns that a reminder was sent to your device and when, and nothing of what the journal holds. And if you choose to sign in with Google, Google learns that you did, and confirms to the journal that the address is yours. And if you turn on sync, the store you chose handles what is described under Optional Sync above, and nothing else.
Nothing is sold, shared for advertising, or handed to anyone for their own use.
Leaving, And Taking Your Journal With You
Settings lets you export everything to your own device, and delete your account. Deleting removes your records, and any copy of your key the service was keeping, from the live database at once. Backups hold the sealed form and, for a journal in Standard keeping, the locked copy of its key; they are kept for a short fixed period and age out on their own.
If This Changes
If what the service can see ever changes, this page changes first, with a new date at the top. Members can ask about any of it from inside the journal.