Privacy
Short version: your journal is stored on your device. We can't read it, sell it or train on it.
Where your entries live
Every entry, photo, mood, AI reply and action item is stored in your browser's IndexedDB on the device you use. Nothing is uploaded when you write. Clearing your browser data deletes it, so use Settings → Export backup or encrypted sync to keep a copy.
Passphrase lock
If you set a passphrase, entries are encrypted on your device with AES-256-GCM using a key derived from your passphrase (PBKDF2-SHA-256, 310,000 iterations). The passphrase is never stored or sent anywhere. If you forget it, the entries can't be recovered — not even by us.
When you ask the AI
Only when you ask for an AI reply, the text needed for that reply (the entry or conversation, or for reports a short digest of the period) is sent over HTTPS to our server, which passes it to OpenAI's API and streams the answer back. We do not store or log that text; we keep only a count of requests per day per hashed browser id and hashed IP address, to apply the free daily limit (deleted after 3 days). OpenAI processes API data under its API data policy, which does not use it to train models by default and may retain it up to 30 days for abuse monitoring.
Bring your own key: if you enter your own OpenAI or Anthropic API key in Settings, your browser calls that provider directly. The request never touches DiaryFast. Your key is stored only in your browser.
Weather and place
Only when you tap Add weather & place, your browser asks for your location and sends rounded coordinates (about 1 km) directly to Open-Meteo (weather) and BigDataCloud (city name). We don't receive them.
Voice
Voice-to-text uses your browser's built-in speech recognition. Depending on your browser, audio may be processed by its maker (Google for Chrome, Apple for Safari). DiaryFast never receives audio.
Accounts and encrypted sync
An account is optional and exists only for sync and the weekly reminder. We store your email, the sign-in sessions of your devices and, if you sync, encrypted blobs we can't decrypt (the key comes from your passphrase on your device) along with their size and timestamps. Settings → Delete account deletes all of it immediately.
Payments
Payments are handled by Stripe. We store your email, license key, plan and payment status, never your card.
We send sign-in links, license keys and — only if you turn it on — a weekly reminder that never contains anything you wrote. Every reminder has a one-click unsubscribe link.
Analytics
We count anonymous events per day (for example "an entry was posted", "a weekly report was opened") with no content, no identifiers and no IP address. There are no ads, no trackers and no analytics scripts inside the journal.
Contact
Questions or requests about your data: use the contact page and choose "Privacy".
Last updated 7 November 2026.