Security, explained honestly
What we protect, how, and exactly what our servers can and cannot see.
Two kinds of privacy
Every entry is encrypted at rest. Your journal text, notes, people, places, goals, letters, vault items, chats, captions and transcripts are encrypted with AES-256-GCM using a random key that belongs to your account alone. That account key is itself encrypted by a master key kept in our server's secret store. Because our servers hold these keys, they can decrypt normal entries to power search, Life Twin, exports, Future Letters and reminders. Staff do not read diaries, and we never sell your data or use it to train AI.
Locked entries are end-to-end encrypted. Mark an entry Locked and your browser encrypts it with a key made from a passphrase only you know (PBKDF2-SHA256 with 600,000 iterations, then AES-256-GCM). We store only the scrambled text and a wrapped copy of your key that we cannot open. Search, Life Twin, AI features and transcription never touch Locked entries. We can still see that a Locked entry exists, its date, its type and roughly how long it is.
The honest trade-off: when you set up Locked entries you get a one-time recovery key. If you lose your passphrase and your recovery key, nobody, including us, can open those entries again. Locked entries are text only for now.
See it for yourself
Every saved entry has a See what we store button that shows the exact database row for that entry, plus how many search fingerprints and AI index vectors exist for it (always zero for Locked entries).
Signing in
- Passwords are hashed with PBKDF2-SHA256 and a unique salt; sessions are HttpOnly, Secure cookies stored only as hashes.
- 2-step verification with an authenticator app, passkeys (Face ID, fingerprint, Windows Hello, security keys) and ten one-time backup codes stored only as hashes.
- Sensitive actions (exporting everything, deleting your account, changing your password or email, turning off 2-step, unlocking Locked entries on a new device) ask you to confirm it is you.
- Security emails for every important change, rate limits and lockouts on repeated wrong codes, and a slow, cancellable recovery if you lose every 2-step method.
- Sign-in with Google is verified against Google's signing keys; no claim is trusted before its signature checks out.
Your media
Photos, videos and voice notes live in a private storage bucket (encrypted at rest by our storage provider) and are served only after checking that you, or a family space you shared with, may see them.
Your control
Export everything at any time, delete single items or your whole account. Deletion removes your data from our live database and storage immediately; backup copies expire on a rolling schedule described in our Privacy Policy.
What we do not claim
Diary.com is not a medical records service and makes no HIPAA claims. An independent audit of the Locked-entries design is planned; until then, this page describes the design as built. Questions or a security report? Use our contact form.