Private journal apps: what a passcode protects, what encryption protects, and what to check

Almost every journal app calls itself private. Some mean that the app has a passcode. Some mean that data is encrypted on their servers. A few mean that nobody but you can read what you write, the company included. These are three very different promises, and the store page rarely says which one you are getting.

This guide explains the difference in plain words, what encryption usually does not cover, and what to ask before you trust an app with the parts of your life you've never told anyone.

Level 1: a passcode or Face ID on the app

An app lock asks for a code or your face before it shows anything. It is useful: it stops a partner, a child or a colleague who picks up your unlocked phone from scrolling through your entries.

That is all it does. The data itself is unchanged. If the app keeps a copy in the cloud, that copy is exactly as readable as it was before you set the code. A lock is a curtain, not a safe.

Level 2: encryption "in transit" and "at rest"

Most serious services encrypt data on its way to the server (the padlock in your browser, TLS) and on the server's disks. This protects you from someone listening on public Wi-Fi and from a stolen hard drive.

But the service holds the keys. Its software has to read your entries to show them on a new phone, so it can read them in other situations too: a support engineer with too much access, a hacked admin account, a legal request. "We encrypt your data" is often true and still means the company could read it if it wanted or had to.

Level 3: encryption on your device, with your key

The strongest model encrypts your words on your phone, with a key made from a password only you know, before anything is uploaded. The server stores scrambled text it can't read. When it is designed so that the data is only ever readable at your end, this is called end-to-end encryption: in the words of the Electronic Frontier Foundation, information is turned into a secret message by its sender and "decoded only by its final recipient". In a journal, you are both.

This protection has a price, and an honest app tells you about it up front: if you forget the password and have no recovery key, nobody can get your entries back. Not support, not the developers. Services that do this properly say so plainly: Day One's encryption FAQ states that if the key is lost, the encrypted journal "cannot be decrypted", and Apple warns that if you turn on its Advanced Data Protection and lose access to your account, it "will not have the encryption keys to help you recover it". That isn't a flaw. It is what "we can't read it" actually means, and it is why good apps give you a recovery key or a backup of the key, and why you should keep it.

What encryption usually leaves visible

Even with strong encryption, "everything is encrypted" is rarely literally true. Ask about:

• Titles and dates. Many apps keep them readable so the timeline and search work without your password.
• Photos, videos and voice notes. Large files are often stored differently from text, and not always encrypted the same way.
• Tags, moods, places. Small fields, but together they can say a lot.
• Metadata. When you write, how often, how much. Encryption hides content, not the fact that content exists. The EFF's guide puts it simply: end-to-end encryption "does not protect your metadata".
• Notifications. A reminder that shows an entry's title on your lock screen shows it to anyone who glances at your phone. You can usually hide notification previews in your phone's settings.

None of this makes an app bad. It makes a vague promise suspicious. A trustworthy app can tell you exactly which fields are encrypted and which are not.

If the app has AI

AI features in a journal work by sending your words to a language model, which almost always runs on someone else's servers. Encrypted text can't be analysed, so the text that goes to the AI is the readable version. That isn't necessarily a problem, but you should know:

• Is AI optional, and is anything sent before you agree?
• Which company's model receives the text?
• Can that company use your text to train its models? (For many AI APIs this depends on whether the developer pays for the service.)
• Is each AI feature switchable on its own, and what happens to locked entries?

Lock-in: can you leave?

Privacy also means control. A journal you can't export is a journal you can't take with you when the company changes its prices, adds features you don't want, or shuts down. Check whether export is free, what format it uses, and whether photos and audio are included or only the text.

Ten questions to ask any journal app

1. Is there an app lock, and what does it protect?
2. Is my text encrypted on my device before it's uploaded, or only on the server?
3. Who holds the key? Can the company read my entries?
4. What happens if I forget my password? Is there a recovery key?
5. Which fields are not encrypted: titles, dates, moods, photos, audio?
6. Does the app have AI? Is it opt-in? Which provider receives my text?
7. Are my entries used to train any AI model?
8. What do notifications show on the lock screen?
9. Can I export everything, with media, for free?
10. Can I delete my account and data from inside the app?

How Lifeline answers them

Since we are asking you to hold apps to this standard, here are our own answers, including the parts that are less impressive.

• Locking. You can lock any memory with a master password. Its words (the text, your reflections, the AI's questions and your answers) are encrypted on your phone with AES-256-GCM, using a key derived from your password, before they reach our server. We can't read them. Once a master password is set you can also unlock with Face ID, a fingerprint or your phone's passcode.
• What is not encrypted. The title, date, emotions (including the word you choose for the feeling), photos, videos, voice notes and their names, and the attached song of a memory are not encrypted. Memories you don't lock are protected in transit and on Google's servers, like most apps, but they are not encrypted with your key.
• Forgotten password. When you set the password, the app gives you a recovery key. With it you can set a new password and keep everything. Without it, locked memories can't be opened by anyone, us included.
• AI. Optional. Nothing is sent until you agree once. After that, each feature sends only what it needs, through our server, to Google's Gemini model. One switch turns all of it off, and there are switches of their own for questions, for monthly patterns, and for the Life Compass with "What followed similar moments". We use Gemini under Google's paid-service terms, in which Google does not use the prompts or responses to improve its products; it keeps logs for a limited time to prevent abuse and for legal reasons. Background features never send the text of a locked memory; questions on a locked memory are sent only after you confirm. The app has a "What the AI sees" screen that describes what each feature sends.
• Notifications. "On this day" reminders and the home-screen widget show a memory's title, but never the title of a locked memory. If even that is too much for your lock screen, turn the reminder off or hide previews in your phone's settings.
• Usage statistics. Like most apps, Lifeline uses Google's Firebase Analytics and Crashlytics to count how features are used and to receive crash reports. These don't contain the text of your memories. We also use Meta's App Events to see which of our ads lead to installs and purchases: it receives events such as signing up, starting a trial and buying Premium, never anything you write. On iPhone this happens only if you allow the app to track.
• Export and deletion. Export is free: a ZIP with every memory as text plus your photos, videos and voice notes. Locked memories are included once you enter your password, and inside the ZIP they are no longer encrypted, so keep the file somewhere safe. Your account and data can be deleted from inside the app; our backups are erased within 30 days.

Whatever app you choose, the habit that protects you most is boring: a strong lock on your phone itself, and your recovery key written down somewhere safe that isn't the same phone.

Lifeline for iPhone and iPad · Lifeline for Android