Where does InnerNote keep your journal?

Your journal stays on your phone, in an encrypted database whose key InnerNote never has. Your words leave it only when you ask for a reply on a page, or when InnerSelf, once you allow it, reads your pages for a reading: only those words are sent, encrypted, read once and never stored by us.

A journal is the most private thing most people ever write. InnerNote was built around one boundary because of it: your pages stay on your phone. Here is what that means in practice, when your words leave the phone, and why we chose it.

What "on your phone" means

Your pages are stored in a database on your iPhone, encrypted with SQLCipher. The key that opens it is made on your phone and kept in the iPhone's Keychain; InnerNote never has it. The app can lock behind Face ID or your passcode, and when you switch apps it puts a cover over itself so the app switcher never shows a page.

You don't need an account, and if you choose to sign in, the account holds your sign-in and your email address only. It never holds a page. Our servers do not receive your journal, which is the simplest reason we can't read it: we don't have it.

When your words leave the phone

When you ask for a reply on a page, the text of that one page goes, encrypted, through InnerNote's server to our AI provider, which writes the reply. Nothing else from the journal goes with it, no name or identifier goes with it, and our server keeps none of it: it relays the page and the reply and stores and logs neither. The reply comes back to your phone and lives there with the page. The app shows you exactly what is sent before the first time, and nothing is sent until you tap Send.

InnerSelf, the reading the app forms every five sealed pages, measures your pages on the phone. Once you allow it, a reading also sends a few sentences from your pages the same way, so that the AI can say in a line what you are saying about a topic; they are read once and never stored by us. You can turn that off at any time in Settings → InnerSelf, and InnerSelf then uses its own words.

A page you type on the web, at innernote.ai/write, is sealed in your browser so that only your phone can open it. Our server holds it, still sealed, until your phone collects it, and deletes it then, or after 30 days.

Backups and a new phone

Because the key lives in the Keychain, where your journal can go depends on how Apple moves the Keychain. Quick Start, Apple's phone-to-phone transfer, and an encrypted backup made on a Mac or PC carry both the journal and its key, so every page opens on the new iPhone. An iCloud Backup carries the journal but returns the key only to the iPhone that made it; restored to a different iPhone, the journal cannot be opened, and we cannot recover a key that did not transfer. The Privacy Policy sets this out in full, and Settings in the app explains it under Where your journal lives.

You can export your journal at any time, as a PDF or plain text, and keep the copy wherever you choose. You can also delete everything from Settings, with no undo.

What it costs

A journal that stays on your phone can't be read in a web browser, synced to a laptop, or recovered by us if the phone is lost without a backup. We think that is the right trade for a journal, and we say so plainly rather than quietly keeping a copy. Writing is yours; it was never ours to hold.

Sources

• InnerNote's Privacy Policy, which says the same in full.
• Your journal stays yours, the page on what leaves the phone and what protects it there.
• Apple. Apple Platform Security, on Data Protection and the Keychain. support.apple.com/guide/security
• Zetetic. SQLCipher, the encrypted database InnerNote uses. zetetic.net/sqlcipher