A private journal, built like one

Every entry, mood, habit and attachment is stored against your account behind PostgreSQL row-level security. That matters more than it sounds: the rule that only you can read your rows is enforced by the database itself, on every query, rather than by an application filter that a future bug could omit.

The common way journal apps leak is a missing WHERE user_id = … on one endpoint out of eighty. Under row-level security that query returns nothing rather than someone else's diary, because the check does not live in the endpoint.

All traffic is HTTPS with HSTS, so a downgrade to plaintext is refused by the browser rather than accepted quietly. Entries and uploaded attachments are encrypted at rest in storage.

The application also ships a strict Content Security Policy with no inline-script escape hatch, framing denied outright, and a locked-down permissions policy. Those are not privacy features in the marketing sense; they are what stops an injected script on one page from reading your journal on another.

Your entries are processed to generate your insights, for you. They are not used to train models that serve other people, and this is a product rule rather than a setting that defaults to on and hides in a submenu.

There are no advertising trackers, no data brokers and no third-party analytics reading entry content. Nobody is monetising the contents of your journal, because the product is monetised by the subscription — which is the whole reason there is a paid tier.

Access to production data is restricted and audited, and there is no internal support tool that renders a user's entries for a staff member to browse. The practical consequence is worth stating plainly, because it is a trade rather than a pure win: support genuinely cannot answer "what did I write in March" on your behalf, and cannot recover an entry you have permanently deleted.

That is the correct side of the trade for a journal. An app where support can read your diary to help you is an app where support can read your diary.

Export the entire journal to Markdown or PDF at any time, without contacting anyone. Deleting your account deletes your entries and attachments rather than flagging them hidden.

And if you stop paying, nothing happens to your writing: you drop to the free tier, keep full access to every entry, search and export, and Compline simply narrows how far back it reads. An AI journal you cannot leave is a trap, not a product — see pricing for what a downgrade actually does.