Privacy

Last changed 24 September 2026.

This app is for writing down what crosses your mind. That is a private thing to hand to a computer, so this page says exactly what happens to it — in the same plain words as the rest of the app, and with nothing left out because it was awkward.

Nothing you write is sold, shown to advertisers, or used to train anybody's model. There are no trackers and no analytics. What you write is yours, you can take all of it away in one click, and the only people who see an entry are the ones you chose when you wrote it.

What is kept

Your account

An email address, a username, the name you want people to see, and — if you add them — a short bio and a profile picture. Your password is never kept. What is kept is a bcrypt hash of it, which is a one-way scramble: it can check a password you type and it cannot be turned back into one.

If you came in through Continue with Google, there is no password at all. What is kept instead is the identifier Google uses for your account, the address Google confirmed, and the name on it. Nothing else, and never your Google password — that is typed on Google's own page, which this app never sees.

What you write

Your entries — thoughts, dreams and ideas — with their titles, their text, the day you say they happened, the mood you gave them, and whether you marked them public or private. Pictures you upload or ask the app to draw. Comments, letters to your future self, and messages you send other people. Who you follow, what you have resonated with, and what you have saved.

What the app works out from it

The themes it pulls out of an entry, the short reading it writes back, and the threads it finds between entries. All of that is kept alongside the entry, and all of it comes out in your export.

The technical minimum

• A sign-in token in your browser's own storage, so you are not asked to sign in every time. It lasts thirty days and stops working the moment you change your password. Signing out removes it.
• Drafts you have not posted yet, and small preferences like whether a panel is open, also in your browser and never sent anywhere.
• One cookie, and only if you use Continue with Google: a random value that ties the trip to Google to the browser that started it. It lasts ten minutes and is used for nothing else. There are no other cookies.
• A notification address for your device, only if you turn on notifications there. It is the address your browser's push service gave it, plus two keys that let this server lock a notification so only that device can open it. It is kept until you turn notifications off, sign out, or delete your account, and it goes when your device's push service says the device has gone.
• Your network address, counted rather than stored. The server keeps a running count per address for a few minutes, so that one visitor cannot use up everybody's allowance or guess at passwords quickly. It is held in memory, written to no file, and gone when the app restarts.

What other people can see

Every entry is one of four things, and you choose which when you write it. You can change it afterwards, as often as you like, from Who can see this on the entry itself.

• Public — it appears on your profile and in the shared feed, with your name on it. You can post one unsigned, which shows it without saying who wrote it.
• Followers — it is shown to the people who follow you, and to nobody else: in their feed, on your profile as they see it, and in their search. It is kept out of Explore, and its link opens for a follower and for no one else. Somebody who stops following you stops being able to see it, because the question is asked again every time rather than remembered.
• Certain people — it is shown to the people you name on it, who can only be people you follow, and to nobody else. They are told it was written for them, and it reaches their feed whether or not they follow you. None of them is shown who else it went to: the list is yours. Taking somebody off it takes the entry away from them, and takes back what they were told. Its link opens for the people named and for no one else.
• Private — it is yours. It is not in any feed, not on your profile, not in anybody else's search, and not visible to anybody else through this app.

Inner space is the room made of the private ones. Everything written there is private and cannot be made anything else while it is being written; everything private you have written elsewhere appears there too. It is a way of seeing them together, not a separate or stronger kind of privacy — a private entry written anywhere in the app is covered by exactly the same rule.

Your whole account can be private too, in which case your entries are visible only to you until you change it.

One feature deserves spelling out, because it touches private entries. Crossings tell you when somebody else has written something that lands on a thread you were already pulling. Only one side is ever told — you, about their entry, and only when their entry was public and you could have seen it anyway. The person who has just written is told nothing. That is what makes it safe for your side of a crossing to be a private entry: it can be matched without a word of it leaving your account.

Blocking and reporting

Blocking somebody ends any follow between you, and from then on neither of you sees the other's entries, comments, messages or profile. The other person is not told, and cannot see that you have blocked them. The list of people you have blocked is kept for you alone and is shown nowhere else; unblocking removes it.

Reporting an entry, comment, message or person sends the person who runs this app a copy of what was reported — the words, the username, the reason you gave and any note you added — and the report is saved. It is saved with a copy of the words because the person reported can delete them before anybody looks. A message can only be reported by somebody in that conversation, and anything you could not see yourself cannot be reported at all. The person reported is never told who reported them, and you are not told what came of it. If either account is deleted, its reports are deleted with it; the one thing that can outlive that is the notification email, which sits in the owner's mailbox like any other and is deleted by hand if you ask.

Pictures

Pictures are files on the server, at addresses made of random characters that are not listed or linked anywhere. That makes them unguessable, but it does not make them checked: anybody holding the exact address of a picture can open it without signing in, including a picture attached to a private entry. Treat a picture as being as private as the link to it.

The reading, and where the words go to get it

The app writes something back about each entry. There are two ways it can do that, and every reading says which one wrote it.

Most of the time it is the app's own logic, which runs on this server and sends nothing anywhere. When the app is set up with an AI key, the reading is done by an AI service instead — Google Gemini or Anthropic — and then the text of that entry is sent to that company to be read, including when the entry is private. Your email address, your username and your name are not sent with it: the service is given the writing and nothing that says whose it is.

Those companies say they do not train their models on what is sent through the paid interfaces this app uses. They are not this app, though, and this app cannot promise on their behalf. If that is a line you would rather not cross, the honest advice is not to write it here.

The other services involved

Five, and no more. Each does one job.

• Railway runs the app and holds the database and the pictures. They are the landlord: all of it lives on a disk of theirs.
• Brevo sends password reset emails. They are given the address the email goes to and the link inside it, and nothing else. They keep their own copy of the message, which is exactly why a reset link can only be used once and stops working after an hour.
• Google, only if you press Continue with Google. Doing so tells Google that you use this app. Google is never told anything you write here.
• An AI service — Google Gemini or Anthropic — as described above, and only when the app is set up with a key for one.
• Your device's own notification service — Google for Chrome and Android, Apple for Safari and the iPhone, Mozilla for Firefox, Microsoft for Edge — only if you turn on notifications on that device. It carries a notification to the phone and cannot open it: each one is locked to your device. What it can see is that a notification went to that device, and when. What is in a notification is a name and a kind — “Sam sent you a message”, “There is a new comment on an entry” — and never a word of anything anybody wrote. A comment, and a crossing, name nobody. The kinds follow the “Tell me about” list in Settings, and a message is sent with them.

Nothing else is loaded from anywhere else. The typefaces are served from this app rather than from Google's font service, so opening a page here tells nobody but this server that it was opened.

What never happens

• Nothing you write is sold, or shared for money.
• There is no advertising, no analytics, no tracking pixels, and no third-party script of any kind.
• Your writing is not used to train an AI model by this app.
• Nobody who has an account is emailed anything except the reset link they asked for. The one other email this app sends goes to the person who runs it, when somebody reports something.

One honest exception belongs on this list rather than off it. The person who runs this app has administrative access to the server it runs on, so the database is technically readable by them. It is not read, and there is no feature anywhere that shows one person another person's private entries — but a policy that claimed otherwise would be a lie, and a diary deserves better than a lie.

Taking it back, and getting rid of it

Deleting an entry deletes it, along with its reading, its themes and the threads that ran through it.

Deleting your account. Settings, at the bottom, under Leaving. You are asked for your password first — being signed in is not enough on its own, because browsers get left open — and offered an export of everything of yours on the way past: every entry, its reading, its themes, the threads found between them, and your account, in one file. Then the account, the entries, the pictures, the letters, the messages and the comments are deleted, for good. Nothing is kept back, there is no bin to recover it from, and your username and email address are freed for anyone to use again. If you cannot get into your account to do it, write to the address at the bottom of this page from the address you signed up with and it is done by hand. The same steps, in order, are on their own page.

What stays is other people's own writing. An entry of theirs that grew out of one of yours remains theirs, with nothing where yours used to be, and a comment you left on their entry goes while their entry stays. The exception is a conversation between the two of you: that goes entirely, both sides of it, because a private conversation cannot sensibly outlive one of the two people in it.

How long things are kept. Entries stay until you delete them, or ask for the account to go. Spent and expired reset links are cleared out as new ones are made. Backups of the whole database, where the host is keeping them, sit with the host for their own retention window and then rotate away.

Keeping it safe

• The site is served over HTTPS, so what travels between your browser and the server is encrypted.
• Passwords are stored hashed with bcrypt, never in a readable form.
• A reset link is single-use and expires in an hour.
• Changing your password ends every session that was already signed in, including somebody else's.
• Every page is served with a content security policy that stops it loading anything from, or sending anything to, any other site.

None of that is a promise that nothing can go wrong. This is a small app run by one person, not a company with a security department. If something does go wrong and your writing is involved, you will be told plainly and quickly rather than quietly.

Who this is for

You need to be at least 18 to have an account here, or older where the law you live under sets a higher age for agreeing to something like this on your own. This app is not built for children, and does not knowingly keep anything belonging to one.

When this page changes

The date at the top is the last time it was changed. If something changes that affects what happens to your writing — a new service involved, a new thing kept — it will be said in the app rather than quietly edited in here.

Asking about any of it

One person runs this app and reads that address: gio.chipchiuri@gmail.com. Questions about what is kept, requests to see it, and requests to delete all of it go to the same place.