Home › Encryption and data boundaries
Encryption and data boundaries
This page avoids the usual vocabulary — "military-grade encryption", "absolute security" — because none of it can be checked. It answers three questions you can: what lives on your device, what lives on our servers, and what leaves them.
In three sentences.
① What you write is encrypted on your device before upload; the servers hold ciphertext and have no key.
② Mood scores, assessment scores, tags and timestamps are metadata the servers can read — we use them to draw trends, never for advertising.
③ AI features need a model to read text, so automatic tagging, report generation, composing and dream analysis send plain text to a language-model provider. Deep insight sends statistics only, never source text.
One table: where your data lives
| Data | Where and in what form | Server can read it |
|---|---|---|
| Entry text | Encrypted on device, stored as ciphertext | No |
| Dream text | Encrypted on device, stored as ciphertext | No |
| Detailed scale answers | Optional: archived as ciphertext | No |
| Report text | Encrypted on device, stored as ciphertext | No |
| Voice recordings | Kept on the device only, never uploaded | No |
| Mood score | Synced with the entry, plain | Yes |
| Assessment score & band | Computed and stored server-side | Yes |
| Tags | Synced with the entry, plain | Yes |
| Entry timestamp | Synced with the entry, plain | Yes |
| Account identifier & password hash | Stored server-side | Yes (hash is irreversible) |
| Phone number | Only if you sign in by SMS code | Yes |
This table comes first because "on-device encryption" is often used to imply something that does not exist: that metadata disappears too. We would rather not do that.
How the encryption works
Encryption happens on your device, not on the server. The key is generated on the device and kept there — it is never uploaded alongside your content. The server receives ciphertext and holds no key capable of decrypting it. In other words, even someone who obtained every byte stored on the server could not reconstruct a sentence you wrote.
The price, stated plainly
On-device encryption carries an unavoidable consequence: if you lose the key, we cannot recover your content. If the key is gone — app data cleared, or the app reinstalled without keeping it — the ciphertext on the server can never be unlocked. That is not reluctance on our part; it is what encryption is. Any product offering both end-to-end encryption and plaintext recovery on request is misrepresenting one of the two.
Two more doors, besides the encryption
- App lock — reopening the app requires verification, so someone holding an unlocked phone still cannot browse your archive.
- PIN code — an additional gate in front of the local archive.
There is also a teen mode: it hides paid content entry points and makes insight prompts use more conservative thresholds and gentler wording. Enabling and disabling both require a guardian password.
What the servers can read
For trends, curves and search to work, some data syncs to the server in plain form. Those are:
- Mood scores — the per-entry score, used for the mood curve and averages.
- Assessment scores and bands — results of the self-assessment scales (PHQ-9, GAD-7, a short personality exploration).
- Tags — theme and mood labels, used for search and distribution.
- Timestamps — used for the timeline and monthly archives.
Together these can outline a person's emotional profile, so we treat them as health-related information: never shared with third parties, never used for advertising, never used to build a profile for sale. If you would rather not have even this read, the trade-off is clear — it comes with giving up cross-device sync.
AI features: the data boundary
For a language model to read your text, that step cannot remain end-to-end encrypted. That is true of every "AI plus private journal" product on the market. Our choice is to write the boundary down instead of blurring it.
| Automatic tagging | Sends the entry you just wrote, in full. Default behaviour on save, with no switch to disable it in the current version. |
|---|---|
| Report generation | Sends a batch of entries from that period, plus aggregate statistics, to produce the summary and keywords. |
| Composing | Sends the text you selected, arranged into the genre you asked for. |
| Dream analysis | Sends the dream text you entered or selected, along with a 14-day mood aggregate (no other entry text). |
| Deep insight | Sends aggregate statistics only: entry count, average score, theme distribution, mood distribution. No source text. |
| Literature matching | Runs with a local algorithm on the server. Nothing is sent to any model. |
Where the text goes
Over HTTPS to our servers, where it is processed in memory and passed to the model provider — Alibaba Cloud Bailian (Alibaba Group, located in mainland China) — running the qwen-plus model.
What we keep
Your text is not written to our database and not written to access logs. Internal task logs record the task type, success or failure, token count and elapsed time, for rate limiting and debugging. Those records contain nothing you wrote.
What we cannot promise
We cannot make commitments on the model provider's own retention and handling policies. That is an honest boundary, not boilerplate we copied.
Voice and audio
Voice notes recorded by holding the button are kept on your device and never uploaded. The current version has no speech-to-text service connected, so there is no step in which audio is sent for recognition. Voice is also the one data type excluded from the JSON export — it stays where it was recorded.
What we do not do
- No social layer — no public profile, no follow graph, no feed, no content recommendation. There is no product path by which a stranger could see your entries.
- No advertising — no ad slots and no advertising SDK.
- No cross-app tracking — no third-party analytics or profiling SDK, and no reading of your behaviour in other apps.
- No sale of data — your content and metadata are not sold or exchanged with anyone.
- No commercial content analysis — your entries are not used to train recommendation models or build advertising profiles.
The servers keep ordinary access logs (such as IP and time) for security and rate limiting.
What we do not promise
Stating the limits is what lets you use this on the right terms:
- Not absolute security. No software can promise that nothing will ever go wrong. Protect your device, your account and your key as well.
- Not key recovery. A lost key means unrecoverable content. There is no exception path.
- Not the model provider's retention policy. See the data boundary above.
- Not a medical service. No diagnosis, therapy or crisis intervention. The self-assessment scales are self-reflection references only.
A private archive should be able to say exactly how private it is.
Related pages
The FAQ covers day-to-day questions; the privacy policy is the binding, complete statement. If anything on this page is unclear about how the implementation works, write to support@citta.fyi.