Is your journal app reading your entries?

A journal is where people write the things they don't say out loud. So it's fair to ask a blunt question of any app that holds one: could the company behind it read what you wrote?

For most cloud apps the honest answer is yes, at least in principle. Your words travel to a server over an encrypted connection, then get stored in a form the company's systems can read. Policies may stop anyone from looking, but the ability is there.

End-to-end encryption changes that. Here is what it means in practice, what it doesn't cover, and how Understory handles the harder case: an AI companion that has to read your words to respond to them.

Three kinds of "encrypted"

When an app says your data is encrypted, it can mean one of three quite different things.

Encrypted in transit. Your words are protected while they travel between your device and the server (the padlock in your browser). Once they arrive, the server can read them. Nearly every website does this.

Encrypted at rest. The server stores your data on encrypted disks. That helps if a drive is stolen, but the service holds the key and can decrypt whenever it needs to.

End-to-end encrypted. Your words are locked on your device before they're sent, with a key the company doesn't have. The server stores scrambled text it can't turn back into words. Only someone with your key can read it.

The first two are good and normal. Only the third answers the question at the top of this page with a no.

How Understory encrypts your journal

Understory runs in your browser, and the encryption happens there, using the browser's built-in cryptography (the Web Crypto API).

When you set up your journal, your browser creates a random 256-bit key. That key encrypts everything you write, using AES-GCM, a widely used standard that also detects tampering. Each piece of text gets its own random starting value, so two identical entries don't produce identical ciphertext.

That key is never stored as-is. Your browser locks it twice: once with a key derived from your passphrase, and once with a key derived from a recovery code you're shown a single time when you set up. The passphrase step uses PBKDF2 with SHA-256 and 600,000 rounds for new journals, which makes guessing a passphrase slow and expensive. What reaches our database is the locked key, never the key itself and never your passphrase.

When you unlock Understory, your browser unlocks that key with your passphrase and decrypts your entries on your device. Our database only ever receives ciphertext for:

• the text of every entry, including drafts
• the companion's cards that sit inside an entry
• spores, the quick notes you save for later
• the companion's memory of your journal (more on that below)
• writing in progress that's kept on your device until it's saved

Access to that ciphertext is restricted too: the database's access rules only let your own signed-in account read your entries.

If you sign in with Google, you choose a journal passphrase separate from your Google account. If you sign up with email, your journal passphrase starts out as your account password, which is also what you use to sign in.

The trade-off you should know about

Because we don't hold your key, we can't rescue you if you lose it. Resetting your sign-in password doesn't touch your journal passphrase. If you lose both the passphrase and the recovery code, nobody can decrypt your entries, us included. That is the cost of the protection, and it's why the recovery code matters. Store it somewhere you'd keep a spare house key.

What isn't end-to-end encrypted

Encryption covers the words. An app still needs some information to work, and it would be misleading to call that encrypted when it isn't. In Understory, these are stored without end-to-end encryption:

• your email address and account details, such as your plan and preferences
• when each entry was created and last edited, its word count, whether it's a draft or finished, the season label you chose and whether you typed or dictated it
• if you use the AI companion: each finished entry's mood reading (a mood word, a mood score, an intensity score and up to five short themes) and the reflection you're shown, so your growth rings can be drawn

None of that is your writing, but it does say something about you, and it's worth weighing.

One more caveat applies to every web app, including this one. End-to-end encryption assumes the code running in your browser does what it says. A website sends you its code each time you visit, so you're trusting its publisher not to change that. It's a real limit, whichever journal you use.

The harder part: an AI that has to read

Understory has an optional AI companion, part of Premium. It can ask you a question about what you wrote, walk you through a slow look at one thought, offer a short reflection, or answer something you ask it.

Here's the plain truth: an AI can't respond to words it can't read. Whenever the companion works, the text it needs is decrypted on your device and read by the AI model. In that moment it's protected in transit and by the provider's terms, but it isn't end-to-end encrypted. Any app offering AI on your journal faces the same constraint. What differs is how much gets sent, when, and whether you agreed to it.

Where it goes

The companion uses Google's Gemini models through Google Cloud's Vertex AI, which may process the text in the United States. It travels over an encrypted connection, passing through Understory's server on the way. Our server forwards it and returns the response; it doesn't store your text. The app's consent screen also states that the text isn't used to train Google's models; Understory's privacy policy covers the details of how Google handles it.

Nothing is sent before you agree

Before the companion first responds, Understory shows a consent screen. It spells out what's sent, where it goes and what's kept, and notes that journal writing may include sensitive things like your health or faith. Nothing goes to the AI service until you tap "I agree".

That check isn't only in the app's interface. Understory's server looks for your recorded consent on every AI request and refuses to pass the request on if it's missing. Turning the companion off in Preferences withdraws that consent, and turning it back on asks you again. With the companion off, Understory is a plain encrypted journal and nothing about your entries is sent to the AI service.

What's sent, and when

While you write, the companion stays quiet until you ask it something. It's still worth being exact about every point where text leaves your device, including the one that happens without a button press:

• When you finish an entry, with the companion on, its text is sent once to read its mood. That reading picks a short passage for you from a fixed library, and the AI writes a brief note on how it might fit, which you see afterwards. If the companion's memory is on, the entry is also used to update that memory. Entries you mark as windthrow (for venting you don't want to keep) are never added to the memory.
• When you ask the companion something, it receives the entry you're working on and your conversation with it so far. For most kinds of reply it also gets its memory and up to three short passages from earlier entries that echo what you're writing. Your device picks those passages itself; nothing about your journal is indexed on a server to find them.
• When you use spelling check or dictation, the text or the recorded audio is sent so it can be checked or transcribed.

The memory deserves a note of its own. It's a short running summary that helps the companion understand your story. It's encrypted in your browser before it's stored, like your entries, and it's sent along with most of the companion's responses. In Preferences you can read exactly what it holds, edit it, clear it or turn it off. Deleting an entry doesn't remove what the memory already absorbed from it, so clear the memory if you want a fresh start.

Leaving cleanly

If you decide Understory isn't for you, you can delete your account from Preferences. You'll be asked to sign in again first, so an unlocked session on a shared computer can't do it. Deletion cancels any subscription, then removes your entries, spores, mood readings, reflections, any share links you've made, the companion's memory, your profile and your sign-in account. On the device you delete from, it also clears the quick-unlock PIN if you set one, saved drafts and the offline copy of your journal. Payment records stay with Stripe, the payment processor, as the law requires.

What to ask of any journal app

Whatever you use, a few questions get to the truth quickly:

1. Is my writing encrypted on my device, with a key the company doesn't hold?
2. What isn't encrypted, such as dates, tags or moods?
3. If there's AI, which provider reads my text, and when?
4. Will it ask me before sending anything, and can I turn it off completely?
5. If I leave, what gets deleted?

A good answer to all five is clear and specific. If you'd like a journal built around those answers, Understory is free to start.