How to choose a truly private journal app

A truly private journal app keeps your entries where only you can read them, either on your device or end-to-end encrypted with keys only your devices hold. It also deletes anything it processes on its servers, carries no ads or trackers, and explains all of this in plain language you can check.

That sounds like a high bar. It should be. A journal holds things you haven't told anyone, and a voice journal holds them in your own voice. This guide gives you a practical checklist, explains the terms apps use, and shows how to verify some claims yourself on an iPhone.

Why journal privacy deserves more scrutiny than most apps

Three facts are worth knowing before you choose.

The law probably doesn't cover your journal. Many people assume health-adjacent apps are protected like medical records. In the US, the Department of Health and Human Services says HIPAA generally does not apply to information in an app you use for personal purposes, unless the app comes from a covered entity such as your doctor or insurer. Your protection is mostly the company's own promises.

Those promises have been broken. In 2023 the FTC ordered BetterHelp to pay $7.8 million after alleging it shared users' health information with Facebook, Snapchat and others for advertising, despite promising privacy.

The category has a poor record. Mozilla's 2023 review of 32 mental health apps put its privacy warning label on nearly 60% of them, recommended only two, and found that 40% had gotten worse since the year before.

None of this means journal apps are unsafe. It means you should check, not assume.

The checklist: seven things to verify

1. Where do your entries live?

There are three common models:

• On your device only. Most private, but you lose everything if you lose the phone without a backup.
• On your device plus your own cloud account (for example, an app's private area of your iCloud). The data sits in an account you control rather than the company's database.
• On the company's servers. Convenient for cross-platform sync, but now the company's security, staff and policies matter a great deal.

None is automatically wrong. Just know which one you're choosing.

2. Who holds the encryption keys?

This is the most important question, and the one apps most often blur. Learn to read the three phrases:

"Encrypted in transit and at rest" is standard and good, but it is not end-to-end encryption. If an app only says that, assume the company can decrypt your entries if it chooses to, or is compelled to.

3. If it uses iCloud, which kind?

Apple's own iCloud security overview is the best reference. Under standard data protection, Apple end-to-end encrypts 15 categories, including Journal, Health and Passwords. Notes, Voice Memos, Photos, iCloud Drive and iCloud Backup are encrypted with keys Apple holds, unless you turn on Advanced Data Protection.

Third-party apps storing data in iCloud get Apple's standard protection by default. Some apps go further and encrypt specific fields end-to-end themselves. Ask which parts of your journal get that treatment.

4. What gets sent to servers, and for how long?

Even an end-to-end encrypted journal may need to send something to a server: audio for transcription, text for an AI feature, a prompt to generate an image. That's often reasonable. What matters is:

• What is sent: audio, transcript, both?
• How long it's kept: minutes, days, indefinitely?
• Whether it's deleted even if something goes wrong: is there a hard upper limit?

Good apps answer specifically. AudioPen, for example, states that voice-note audio is deleted within 48 hours. A specific number is a good sign.

5. Is AI involved, and who runs it?

If an app offers AI chat, summaries or insights, find out which company's model processes your words and whether it's used for training. Day One, for instance, says its Daily Chat content is not stored or used for training by Day One or its AI partners. Look for AI features that are optional and off until you turn them on. We cover this in depth in what AI should and shouldn't do with your journal.

6. Is there tracking or advertising?

A journal app has no reason to contain advertising SDKs or cross-app tracking. On iPhone you can check two things:

• The App Store privacy label. Scroll to App Privacy on any app's page. Look for "Data Used to Track You" (should be empty) and "Data Linked to You" (should be minimal). Labels are filled in by developers themselves, so treat them as a claim, not proof.
• App Privacy Report. In Settings, go to Privacy & Security, then App Privacy Report, and turn it on. After a week, it shows which domains each app contacted. A journal app talking to ad networks is a red flag.

7. Can you delete and leave?

Check that you can delete individual entries and your whole account, that deletion reaches the server copies, and that you can export your journal in a usable format. An app you can't leave is an app that owns your words.

Red flags

• Privacy policy says data may be shared with "partners" for marketing.
• "Encrypted" with no detail about keys.
• AI features on by default, with no mention of training.
• A free app with no paid tier and no clear business model.
• Ads inside the app.
• No way to export.
• "Data Used to Track You" on the App Store label.

Questions worth emailing a developer

If the website doesn't answer these, ask. A good team will reply plainly.

1. Is my journal text end-to-end encrypted? Who holds the keys?
2. What do you send to your servers, and when is it deleted?
3. Which third-party services (AI, analytics, crash reporting) see my content?
4. Is my content ever used to train models?
5. If I delete my account, what remains, and for how long?

How Monologue answers these questions

Since we're asking you to check apps carefully, here are Monologue's answers in the same terms.

• Where entries live: on your iPhone and in Monologue's private area of your own iCloud account. A new iPhone signed into the same Apple Account restores everything.
• Keys: transcripts, titles and places are end-to-end encrypted in iCloud with keys only your devices hold. Audio and cover images get iCloud's standard encryption, and become end-to-end encrypted too if you turn on Advanced Data Protection.
• What goes to servers: audio is sent to Monologue's servers to be transcribed. The servers then delete the audio and the transcript.
• Location: optional. You see a neighborhood and city; coordinates never leave the phone.
• Tracking: no ads, no tracking, no advertising identifiers.
• Notifications: one optional daily reminder at a time you choose, nothing else.
• AI connections: connecting Monologue to Claude or ChatGPT is optional, read-only and uses transcripts, not audio. Turning it off deletes the server-side copy. While it's on, anything the assistant reads becomes part of that chat, so your Claude or ChatGPT data settings apply too. See asking your journal with AI.

If you use a journal alongside therapy, privacy matters even more; our guide to using a voice journal alongside therapy covers what to share and what to keep. And if you want to compare apps on these points, see the best voice journaling apps. Or download Monologue. What you say stays yours.