How to Evaluate a ‘Private’ Journal (Any App)
A checklist for journal privacy policies: lock vs encryption vs on-device vs cloud AI. Use this on any vendor. Then see how Conviction is built if you want.
This is self-help for people who journal between therapy or coaching sessions. It is not treatment, diagnosis, or a replacement for care from a licensed clinician. The author builds Conviction; he is not a therapist.
“Private” on the App Store is a marketing adjective. This page is a checklist you can run on anyone’s policy, including mine. Product architecture for Conviction lives on private journal app and the hub /private-journal.
I am not a lawyer. EFF on privacy is a better civic primer. GDPR Article 9 is why mood-and-health journals are not the same as a todo list.
The ladder (weak → strong)
- Icon lock / Face ID. Stops casual peeking. Does not stop the vendor.
- Encryption in transit. HTTPS. Table stakes. The server still sees plaintext if they decrypt for features.
- Encryption at rest on their servers, they hold the key. Employees “shouldn’t” read it. Different from “can’t.”
- Zero-knowledge backup / you hold the key. Better. Check whether AI features still ship the plaintext somewhere else.
- On-device inference, no account, airplane-mode test passes. Strongest practical bar for a journal in 2026.
If the policy says they “may process content on third-party infrastructure to provide AI,” you are not at 5.
Tests that do not require trust
- Airplane mode.
- Account required? Why?
- Export. If you cannot leave, it is not yours.
- Subprocessors list. If there isn’t one, ask.
More legal-shaped detail: GDPR and journals.
If you want the app I built after applying this list to myself: App Store. $3.99 Pro one-time. iPhone 15 Pro+.
FAQ
Is open source required for privacy?
No. It helps auditability. Closed source can still be on-device. Demand tests, not vibes.