Security & Privacy

The Short Version

How Encryption Works

When you save an entry, its text is encrypted on our server with AES-256 and only the encrypted version is written to the database. If someone got hold of a copy of the database or a backup, they would see unreadable ciphertext instead of your words.

The encryption key is kept on our server, separately from the database. This is a deliberate choice: if you forget your password, you can reset it and still have every entry. With apps where only you hold the key, a forgotten password means your diary is gone forever.

It also means E-diary is not end-to-end encrypted. Our server decrypts an entry when you open it, so in principle the service could read it. We don't, and we built the app so that nothing on our side needs to look at your writing.

What Is and Isn't Encrypted

• Encrypted: the text of every entry.
• Not encrypted: entry titles, moods, tags, and dates, so that search, filters, and stats can work. Keep anything sensitive in the entry itself.
• Not encrypted: your email address and username, which we need for login.
• Never stored in readable form: your password, which is hashed with bcrypt.

Who Can See Your Entries

Every new entry starts as Private. You can change that on any single entry:

• Private: only you.
• Followers: people who follow your profile.
• Unlisted: anyone with the link, but it is not listed anywhere.
• Public: anyone, and it can appear on Explore.

Writing Offline

When you write without a connection, the entry is kept in your browser's storage on your own device until you are back online. It is then sent to us over HTTPS and encrypted. If other people use your device, sign out when you're done.

Dictation

The Dictate button uses your browser's built-in speech recognition. Some browsers, including Chrome, send your voice to their own speech service (Google, for Chrome) to turn it into text, so dictation needs an internet connection. E-diary never receives or stores audio: only the text that appears in your entry is saved, and it is encrypted like everything else you type. If you'd rather keep your voice off third-party services, simply type instead.

Your Data, Your Control

You can export all of your entries at any time, or request a copy of your data by email. If you find a security issue, please contact us and we will respond quickly.