Security
Last updated: October 14, 2026
Your entries are encrypted on your device. Without an account, your diary stays on that device and nothing from it is sent to us. With an account, entries reach us only in encrypted form. The key that opens them is locked with a passphrase that only you know, and that passphrase never leaves your device. We store that diary, but we cannot read it. If you lose your passphrase, nobody can get those entries back, including us.
PrivaLog is not open source. This page is how we document what the code does instead. It describes the iPhone, iPad and Mac apps and the web app as they work today.
When you start a diary, the app creates a diary key: a random 256-bit number that encrypts and decrypts your entries. Entries are encrypted with AES-256-GCM, a widely used encryption method. It also detects tampering: if an encrypted entry is changed, the app refuses to open it instead of showing altered text.
If you start writing without an account, there is no passphrase. The diary key is stored in the Keychain on your device, and the diary opens the way you unlock your device: with Face ID, Touch ID or your device passcode. That is a lock in the app, not a second key: anyone who can unlock your device can open the diary. On a device without a passcode, the diary does not lock. Nothing from your diary is sent to us. The key is not tied to this one device, so an encrypted backup of your iPhone or iPad, in iCloud or on a computer, contains your diary and its key. How well that backup is protected depends on Apple: an iCloud backup is end-to-end encrypted only with Advanced Data Protection. We never get a copy.
When you create an account, you choose a diary passphrase of at least 8 characters. The app turns it into a second key with Argon2id, a method built to make each guess slow and memory-hungry. That second key locks your diary key. Only the locked diary key is sent to us. When you unlock, your device downloads the locked key and does all the work itself. Your passphrase is never sent to us. If you already wrote without an account, your diary keeps the same diary key: the passphrase locks it, and your entries move into your account. From then on the key on your device is no longer in device backups; on a new device you use your passphrase.
Everything you write in an entry is encrypted together: the title, the text, your mood, tags, the favorite mark, and places, including their coordinates. The date of an entry is not encrypted. See What our servers store.
With an account, your diary opens with your passphrase or with Face ID or Touch ID. On a device that has Face ID or Touch ID, it is turned on when you create your passphrase or merge a diary into your account, unless you chose otherwise before. You can turn it off in Settings. The app then stores the diary key, not your passphrase, in the Keychain. That copy stays on this device, is not included in backups, and can only be read after Face ID or Touch ID succeeds. The device passcode is not enough, so someone who has seen you type it still cannot open your diary. On a device without Face ID or Touch ID, you can choose to unlock with the device passcode instead. The system checks your face or fingerprint; PrivaLog never receives it. If you add or remove a face or fingerprint, the stored key stops working and you unlock once with your passphrase.
After you unlock, the diary key stays in the app's memory until the diary locks. That happens when you lock it yourself, sign out or close the app, and when PrivaLog has been in the background for the time you choose in Settings: immediately, after 1, 5 or 15 minutes, after an hour, or never. The default is 1 minute on iPhone and iPad and 5 minutes on Mac. On a Mac the diary also locks as soon as the screen locks or goes to sleep, unless you chose Never. While the app is in the background, its screen is covered, so the app switcher does not show your entries. Signing out deletes the stored key from the Keychain. The encrypted copies of your entries stay on the device, so you don't lose entries that have not synced yet.
Search runs on your device, over entries that are already decrypted in memory. No search index is written to disk or sent to us.
This applies to accounts. A diary without an account never reaches our servers. We use Supabase for accounts and storage. Our Supabase project is hosted in the EU, in Ireland. Each account can only reach its own rows; the database enforces this.
In short: we can see that you have an account, your email address, on which days you wrote and when. We cannot see what you wrote.
Cloud sync needs an active trial or Pro. Without it, new entries stay on your device and are not sent to us. Entries that were synced before stay stored, encrypted, until you delete them or your account. The locked diary key and the unlock check are stored for every account.
When you delete your account, your account, entries, locked key and subscription status are deleted from our database straight away. Copies may remain in our providers' backups for a limited time. Purchase records kept by Apple and RevenueCat are not deleted by this.
With an account, PrivaLog uses two separate secrets. They do different jobs.
Your account password is sent over an encrypted connection to sign you in, as on any website. Your diary passphrase is not sent at all. Use a different value for each.
The place you pick is stored only inside the encrypted entry. The apps and the signed-in web app contain no analytics or advertising code.
Offline copies are encrypted in the same way as the copies on our servers.
The web app encrypts in your browser, with the same method and settings as the apps: AES-256-GCM through the browser's built-in Web Crypto, and Argon2id through a WebAssembly library.
There is one important difference. An app from the App Store is signed and checked before it reaches you, and it stays the same until you update it. The web app is sent by our server every time you open it. If that server sent altered code, that code could read your passphrase as you type it. When you use the web version, you trust us and our hosting provider on every visit.
Some measures limit this, but do not remove it. The site is served only over HTTPS. A Content Security Policy lets pages connect only to our own site and the services listed above, and load images only from our own site. It does allow inline scripts, which the site's framework needs. We do not use Subresource Integrity.
After you unlock, the web app keeps your diary key in the browser's storage, in a form that the page can use but cannot read or copy. The tab can use it until you lock the diary, sign out, or close the tab. There is no automatic timeout. Signing out removes all stored keys, but leaves the encrypted copies of your entries in the browser.
If you want the stronger model, use the iPhone, iPad or Mac app.
There is no reset and no recovery. We do not have your passphrase or your diary key, so we cannot open your diary for you, and neither can anyone else. This is on purpose: a way in for us would also be a way in for others. Without the passphrase, your entries cannot be read again. You can delete your account and start a new one.
{"v":1,"user_id":…,"entry_id":…,"entry_date":…,"crypto_schema_version":…}If you find a security problem, email privacy@nextdevstudio.com. Please include the steps to reproduce it, and give us a reasonable time to fix it before you publish details.
October 14, 2026. When we change how encryption, storage or outside services work, we update this page. See also the Privacy Policy.