Privacy Policy

Effective October 25, 2026

No account required

You don't sign up, and we never ask for your name, email address, or phone number. To use cloud features, the app creates a random installation ID and a secret key on your phone. The key is stored in the iOS Keychain. Our server keeps the ID, a one-way hash of the key, the dates the install was created and last seen, and numeric usage counts (for example, how many requests or transcription minutes an install used in a period). These counts protect the service from overuse. They contain nothing you wrote or said.

You can see your installation ID in Settings → About this installation.

What stays on your iPhone

All of this is stored only on your device, in the app's private storage:

• journal entries, framework answers, and voice recordings
• transcripts, both the original and the cleaned-up version
• Reflect conversations
• emotion check-ins, your Inner Map, maps, corrections, and dismissals
• film and meditation scripts and their revisions, narration audio, illustrations, captions, post captions, and finished videos
• saved Library ideas and your own book notes
• your settings

Narration with an iPhone voice and video rendering happen on your device. Saved items open offline and send nothing.

The current version has no cloud backup and does not sync between devices. If you lose or reset your phone without exporting, your journal can't be recovered, because we never had a copy.

When something leaves your iPhone

Content leaves your device only for transient AI processing that you start. The app explains this before your first transcription and before your first Reflect conversation, and you can say no. If you decline, everything else in the journal keeps working.

Every request goes over an encrypted connection to our server, which runs on Convex. The server forwards the request to the AI service and sends the result back to your phone. It holds the content in memory only while the request runs. It doesn't write the content to disk, keep it in a queue, or put it in logs. Our logs record technical details only: request IDs, installation IDs, timings, sizes, status codes, error codes, and safety-routing labels. They never record your words, your audio, or what the AI said.

Voice transcription — Deepgram

• What is sent: the recording you made, after you've agreed to transcription.
• Why: to turn your speech into text.
• How it's handled: every request opts out of Deepgram's Model Improvement Program, so audio and transcripts from our requests aren't used for training or model improvement. To be clear about the limits: this is an opt-out from training. It is not a contractual zero-retention guarantee. Any retention beyond that is governed by our Deepgram account settings and Deepgram's published data-processing terms.
• Unless you turn on Keep Original Recordings, the app deletes the recording from your phone after a successful transcription.
• Recordings made before you agreed to transcription are never uploaded automatically. You can transcribe them one at a time if you choose to.

Reflect and other writing features — OpenRouter

• What is sent: only what the feature you tapped needs. For a Reflect conversation, that's your conversation and the entry it's about. For transcript cleanup, it's the transcript text alone. For maps, film or meditation scripts, and post captions, it's the material you selected or reviewed.
• Why: to produce the response, plus a safety check that decides how carefully the response should be worded.
• How it's handled: OpenRouter routes each request to an AI model provider, such as Anthropic for Claude models. Every request requires routes that don't collect data for training and that follow zero data retention (OpenRouter's data_collection: deny and zdr settings). If no route qualifies, the request fails. It never falls back to a less private route. We keep OpenRouter's optional prompt-logging and data-use settings turned off. OpenRouter does keep request metadata, such as timing and size, but not the content. These protections come from OpenRouter's routing policy and its published terms. They aren't the result of an independent audit.

Library

• The book and idea list comes from our server. Those requests contain no personal content, at most a book's ID. Our server can tell which book an install opened, but it doesn't keep a reading history.
• Book cover images are original illustrations made for Practical Journal (not publishers' covers). They load from our own server, like the book list, and the requests don't include anything personal from the app. No third-party image host is contacted.
• Your saved ideas and book notes stay on your phone. Your notes leave the phone only if you choose to make a video from them. In that case only the notes you selected, the book's credit, and the theme are sent, through the OpenRouter process above.

Features not offered in this version

Studio narration voices (ElevenLabs), original AI illustrations (OpenAI), and animated scenes (fal.ai) aren't available in this version of the app, so nothing is sent to those services. If we offer any of them later, each will have its own explanation and opt-in inside the app, and we'll update this policy before it launches.

Photos, microphone, and sharing

• Microphone: used only while you're recording.
• Photos: Save to Photos asks only for permission to add photos. The app saves the video you chose and never reads, lists, or changes your photo library.
• Sharing: nothing is ever published automatically. A video you save to Photos or share through the share sheet becomes your own copy outside the app, so deleting it in the app doesn't remove that copy.

What we don't do

• We don't sell your data or share it for advertising.
• We don't track you across apps or websites, and the app contains no advertising, analytics, or tracking SDKs.
• We don't use your content to train AI models.
• No person at Practical Journal can read your journal. It isn't on our servers, and we don't review user content.
• We don't share data with anyone for "safety" purposes. If your writing suggests you might be at risk, the app shows support resources on your screen. It never contacts anyone.

Your choices and deleting your data

• Export: Settings lets you export everything as a complete archive with media, as Markdown, or as JSON.
• Delete an entry: deleted entries go to Recently Deleted and are permanently removed after 30 days, or right away if you delete them there. Inner Map items that relied only on that entry are removed with it, and deleted material is left out of future AI requests.
• Delete all maps: Settings → Delete all maps and corrections.
• Delete everything: Settings → Delete all local journal data permanently removes all entries, conversations, check-ins, maps, scripts, recordings, and videos from your phone.
• Uninstall: deleting the app removes its data from your phone. iOS may keep the installation's Keychain key after the app is deleted. That key is connected only to the anonymous usage counts.
• Server usage counts: deleting data in the app doesn't remove the anonymous usage counts on our server. To have them deleted, email us your installation ID (from Settings → About this installation) at contact@practicaljournal.com.

Security

Connections to our server and to AI services are encrypted in transit. API keys for AI services are kept on our server, never on your phone. Your journal is stored in the app's private storage and protected by iOS. Anyone who can unlock your phone can open the app, so keep your device passcode private.

Children

Practical Journal is not directed to children under 13, and we don't knowingly collect personal information from children. The app doesn't ask anyone for personal information. If you believe a child has sent us information, contact us and we'll help.

Changes to this policy

If we change how data is handled, we'll update this page and the effective date. If a change adds a new place your content could go, the app will ask you first.

Contact

Questions or requests: contact@practicaljournal.com