Where the writing goes
What you write stays on this device. There is no account, no analytics, no cookies and no script from anyone else. Two features can send something out, and both are off until you switch one on. The cloud reflection sends what you wrote to a model, for the length of one request. Sync is not built yet, and will send only text this device has already encrypted. Each one says what it sends before it sends it.
That is the short form. The rest of this page is the long one: each sentence, what makes it true, and how you can check it without taking our word. Journal with Marcus is not public yet, and every row below says whether the thing it describes is built or is a decision the build follows.
Where does what I write go?
In the ordinary way of using the app, with nothing switched on, an entry will go like this.
- You write it in the browser on your own device.
- The app reads it there. It looks for the concerns you wrote about, chooses a passage, and asks one question. All of that is code running in the page.
- It stays there. The storage is the browser's own, on that device, and this website holds no copy.
- No request carries it anywhere. The only things the app fetches are its own files, from its own address: the page, the passages, the small model that reads your entry. None of those requests carries anything you wrote.
What can send something out?
Both are off until you switch one on, each is switched on separately, and each shows you what it would send before it sends it.
The cloud reflection sends what you wrote, up to four thousand characters, together with the concerns the app found in it and the handful of passages it is choosing between. It goes to a small relay we run and on to a model, for the length of one request. The relay keeps a time, a status code and a count of tokens, and not the entry. The model provider does not keep what it is sent, by default; a written agreement that it keeps nothing is being sought before launch, and until it is signed we say "by default" rather than "never".
Sync is not built yet. When it is, it will send only text this device has already encrypted, so that what passes through the sync service is unreadable to it.
What is not collected?
No account. No email address. No cookie. No analytics. No script from anyone else. No location. No fingerprint of your device. No crash reports. The list comes from the design's own account of its threats, not from a promise, and the network check below will show the part of it a browser can show.
What about payment?
When there is something to pay for, the app will link to the payment processor's own pages and will load none of its code. The billing record is the processor's. What comes back to the app is a signed token with a random subscription number in it and nothing that names you, and that token is never sent alongside anything you wrote. A subscription cannot be joined to a journal, and that is a property of the code rather than a rule we keep.
What makes each claim true?
Each row is a sentence this page or the app makes about privacy, the thing in the code or the design that makes it true, and how you can check it. A row with no check is a proof still to be built, and it says so rather than pretending.
| The claim | What makes it true | How you can check |
|---|---|---|
| What you write stays on this device. In the ordinary way of using the app, no request carries it anywhere. Built | The reading of an entry, the choice of a passage and the check that runs first all happen in the browser. Nothing in that path leaves it. | The network check below: write an entry with the cloud feature off and watch the panel. |
| Your journal will be stored encrypted, with a key made from your passphrase, so that the stored copy is unreadable without it. Designed, not yet built | A decision taken before the storage was built, so the storage is built to it rather than the other way round. | No check from outside yet. |
| There will be no account. Nothing will ask for your name or an email address, because there is nothing to sign up to. Designed, not yet built | A subscription, when there is one, will attach to a signed token rather than a login. The part that issues the token is built; the app that carries it is not yet. | Open the app: there is no sign-up screen and no field for an email address. |
| The app will set no cookie, run no analytics and load no script from anyone else. Designed, not yet built | A rule of the design, enforced by a content security policy the browser applies. The policy is written; the app that ships it is not yet public. | The network check below, and the browser's own tools, which show every address a page has loaded from. |
| The cloud reflection is off until you switch it on, and the app refuses to send anything without that switch. Built | The code that would send the request asks for your consent first and throws an error rather than sending without it. | The switch is in the app's settings and is off when you first open it. The consent screen shows what would be sent before anything is. |
| When the cloud reflection is on, what you wrote goes to a small relay we run and on to the model, for the length of one request. The relay writes down a time, a status code and a count of tokens, and nothing you wrote. Built | The relay's log line is those three things. No request body is written anywhere. | No check from outside yet. |
| The model provider does not keep what it is sent, by default. A written agreement that it keeps nothing is being sought before launch, and until it is signed this sentence says "by default" and not "never". Cited from the provider's terms | The provider's published terms, and a contract to be held rather than a fact held. | The provider's published terms. |
| A subscription cannot be joined to a journal. What names the subscription is never sent with anything you wrote, and what is sent with your writing never names the subscription. Built | Two tokens, never one. The code that issues the second token takes no subscription as an input, so the join cannot be made by a small convenient change. | No check from outside yet. |
| Nothing is trained on your entries. Cited from the provider's terms | The provider's terms for the interface the relay uses say it does not train on what is sent through it. Cited, not promised. | The provider's published terms. |
| You will be able to take the whole journal out, readable, in one tap, whether or not you pay, and to delete everything. Designed, not yet built | Both are commitments of the product, taken before the storage was built. | Take an export and open it without the app. |
What can the design not do?
Four things the design cannot do, stated here rather than left for a reviewer to find.
- The passphrase is the only key and there is no reset. Nobody can recover a journal whose passphrase is lost, including us. The app will offer a recovery phrase at the start for exactly this.
- The browser can clear its own storage, when space is short or when you clear it. The app asks the browser to keep the journal and most honor that, but a copy you have taken out is the only backup there is.
- A browser extension can read any page it is allowed to, this one included. Nothing inside the page can prevent that. If you are cautious, a separate browser profile with no extensions is the answer.
- The check that stops a reflection when an entry reads as a risk to you is a floor and not a guarantee. The help page says what it does.
How can I check this myself?
This takes about a minute in any desktop browser and needs nothing installed. It can be run once the app is public, and the expected result below is what the design says will happen; it is checked against the live app before launch.
- Open the app. Then open the browser's developer tools and choose the Network panel. In Safari that is the Develop menu, then Show Web Inspector; in Chrome or Firefox, press F12 or Cmd-Option-I.
- Reload the page with the panel open. You will see the app's own files arrive: the page, its stylesheet and script, the passages, and the small model that reads your entry. Every one comes from the app's own address.
- Clear the panel's list. Write an entry and ask for a reflection, with the cloud feature left off, as it is by default.
- Expected result: nothing appears that goes anywhere but the app's own address, and anything that does appear is a plain fetch of one of the app's files, with no request body. Open any one of them and look: there is nothing sent in it. A request to any other address, or one carrying what you wrote, is a bug.
- If you then switch the cloud reflection on and ask again, one request appears, to the relay's address, and the consent screen you just passed showed what it carries.
The other check is the export. You will be able to take the whole journal out, readable without the app, in one tap, whether or not you pay. A product you can leave with everything is the strongest evidence that it holds nothing over you.
What does this website itself hold?
This site holds no journal and no account, sets no cookie and runs no script. Its own note, on what the host logs and for how long, is on the legal page.