TL;DR

  • Four parties could conceivably read a journal app's data: the company, its ad partners, an attacker, and whoever picks up your phone. A private journal has an answer for each.
  • The single most important question: are your words encrypted before they leave the device, or only "in transit and at rest"?
  • AI features add a fifth question: what does the AI provider do with your entries? "Never trained on" should be in writing.
  • The list of questions at the end works on any journal app — including ours.

The whole point of a journal is that you can be honest in it. Honest about your marriage, your work, your health, the day you handled badly. Which means the privacy question isn't a feature comparison — it's the foundation. If any part of you is composing for an audience, the journal has already failed.

So here's the threat model, in plain English: who could conceivably read what you write in a journal app, and what an app that takes this seriously does about each.

1. The company that makes the app

Most journal apps can read every word you write, because entries reach their servers as plain text. That's not evil — it's just the default way software is built. The stronger design is to encrypt the words on your phone, before they sync, so what's stored server-side is unreadable ciphertext.

That's how My Lighthouse works: your notes, your Keeper conversations and your weekly intentions are AES-encrypted on the device. Honesty requires a footnote, though, and here it is: your scores and dates are not encrypted, because the app needs them to draw your charts and reports. Any journal app that shows you trends has this trade-off; the difference is whether they tell you.

2. The advertising supply chain

If a journal app is free and ad-supported, its business model is your attention — and ad SDKs are hungry. A journal that contains "I think I'm burning out" should never share a process with a tracker. The simple test: does the app show ads, and does its privacy label list data "used to track you"? My Lighthouse shows no ads, embeds no trackers, and sells nothing about you. The business model is a £2.49 subscription, which means you are the customer, not the product.

3. An attacker, someday

Breaches happen to companies of every size. The question is what an attacker would actually get. Plain-text entries are a catastrophe; ciphertext is a much smaller story. Where the servers live matters too — My Lighthouse keeps its data in the European Union (Frankfurt), under GDPR.

4. Whoever picks up your phone

The least technical threat is the most common one. A journal on an unlocked phone is open to anyone you hand it to — a child playing a game, a colleague borrowing it for a call. An app lock answers this: My Lighthouse locks with Face ID by default and re-locks when you leave it.

5. The AI, if there is one

AI features complicate the picture, and it's fair to hold them to a specific standard. When an AI reads your journal to summarise your month, your words leave the ciphertext story for that moment — so the questions become: who processes them, and are they used for training? For My Lighthouse: entries are processed by Anthropic's Claude to write your letters, and they are never used to train AI models. If a journal app with AI can't give you that sentence in writing, that's your answer.

The questions to ask any journal app

Email these to any journal app you're considering — including ours (team@mylighthouseapp.com). A serious app will answer plainly.

You'll notice none of these require a computer science degree — just the willingness to ask. Your honest writing is worth that.

Related reading: The two-minute evening journal · The rules the Keeper follows

← Back to all resources