Our Core Commitment
Your diary is yours alone. We never read, analyze, sell, or use your diary content in any way. Every entry you create belongs to you — we simply provide a secure, private place to keep it.
AES-256
End-to-end encryption
App PIN Lock
Device-level protection
7-Day Sessions
Auto sign-out
End-to-End Encryption
Your diary entries, daily notes, and AI-generated content are all encrypted with AES-256-GCM before being written to the database. This means even our own team sees only unreadable ciphertext when accessing the database directly.
Encryption keys are managed independently and never stored in the database. No database administrator can retrieve your content by querying the database.
Technical note: each record uses a unique random IV (initialization vector), ensuring that identical content produces different ciphertext on every write — preventing pattern-analysis attacks.
App PIN Lock
You can set a 4–6 digit PIN in Settings to lock the app when you're not using it. Once enabled, anyone who picks up your device will need the PIN to open Tell My Day — even if your device is already unlocked.
The PIN is stored locally on your device using the browser's secure storage and is never transmitted to our servers. We have no way to retrieve or reset your PIN — this is intentional, by design.
You can configure the auto-lock timeout (1, 5, 15, or 30 minutes of inactivity) to balance security and convenience.
Forgot your PIN? Sign out and sign back in. Your diary content remains safe and encrypted throughout.
Session Security — 7-Day Auto Sign-Out
Login sessions automatically expire after 7 days of inactivity. This limits the window of risk if your device is ever lost or accessed without your knowledge.
After expiry, you will be prompted to sign in again. Your diary data remains fully encrypted and intact — only the active session is invalidated.
You can also sign out manually at any time from the Settings page, which immediately invalidates the session on the server.
What We Collect
Account information: Your name and email address obtained via OAuth login, used solely to identify your account.
Diary content: Text entries and voice recordings you create (transcribed and encrypted at rest), visible only to you.
Usage analytics: Anonymous page-view statistics that contain no personally identifiable information, used only to understand how the product is being used.
How Your Data Is Stored
All content is encrypted with AES-256-GCM before being written to the database, and all data in transit is protected by HTTPS. Each user's data is fully isolated — no one, including our team, can read your content directly from the database.
Voice recordings are stored in a private cloud storage bucket after transcription. Only you can access them.
How AI Features Work
When you use "Generate Diary" or "Create Content," your notes are decrypted server-side and sent to an AI model for processing. This is a necessary step for the feature to function. Decryption happens entirely in server memory and is never written to disk in plaintext.
Important: Your content is never used to train any AI model, and is not retained by the AI provider after processing.
Your Rights
Access: You can view all your diary entries and notes at any time within the app.
Export: You can export all your diaries as Markdown files with a single tap, keeping a complete local copy.
Delete: You can delete individual entries, specific diary entries, or your entire account and all associated data from the Settings page. Deleted data cannot be recovered.
Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data rights, please reach out through the in-app feedback channel.
Last updated: March 2026