Three choices stop someone else reading a digital journal, and the order matters: pick an app whose provider cannot read the entries (end-to-end encryption), lock the account with a password-manager password and an authenticator app, and lock the device and the app itself so an unlocked phone in someone else’s hand does not open the journal. Everything after that (encrypting files before they sync, backups, emergency access, a quarterly check) protects against losing the journal; only the first three stop someone reading it. A few common measures are theatre, and they are named below.

Quick Answer: In order: choose an end-to-end encrypted app (Apple Journal, Day One with encryption on, Standard Notes, or Obsidian with Sync), lock the account with a unique password from a password manager plus an authenticator-app second factor, turn on device encryption and the app’s own lock, encrypt anything you sync through a general cloud folder, keep two encrypted backups with one off the device, write an emergency-access note, and check it all once a quarter.

Definition: Digital journal privacy is the set of app choices, account controls, device settings and habits that keep an electronic journal readable only by its owner and the people the owner names.

Key Evidence: Apple lists Journal data as end-to-end encrypted in iCloud under both standard and Advanced Data Protection. Day One’s encryption FAQ states that if the key is lost the encrypted journal cannot be decrypted and Day One never has the private key. NIST SP 800-63B says verifiers should not require passwords to be changed periodically, only after evidence of compromise.

Context: End-to-end encryption protects against the provider and against a breach of its servers. It does not protect against someone who knows your passcode, a shared device with no separate accounts, or a court order served on you.

Key Takeaways

Ten minutes first: decide what you are protecting against

Answer three questions first; each points to the step that matters for you.

  1. Who could plausibly pick up my unlocked phone or laptop? If anyone, the device and app locks (step 3) are your real defence.
  2. Would I be harmed if the provider, or someone who breached the provider, read this? If yes, only an end-to-end encrypted app (step 1) or self-encrypted files (step 4) will do.
  3. Do I need this journal to survive me, or survive a lost password? If yes, emergency access (step 6) is mandatory, because the strongest apps have no recovery.

Step 1: Pick the app by who can read it

The single test is whether the provider holds a key to your entries. The table carries only the privacy columns; features and prices are compared in the secure journal app roundup.

AppCan the provider read entries?App-level lockExport formatMetadata to watch
Apple JournalNo: Apple lists Journal data as end-to-end encrypted in iCloudYes: Settings > Apps > Journal > Lock Journal (Face ID, Touch ID or passcode)Print or export from the appJournaling Suggestions draw on other on-device data; review the setting under Privacy & Security
Day OneNo, for journals with end-to-end encryption on (default for new journals since version 4.2; older journals must be converted)Yes: passcode with Face ID or Touch ID, locks the whole appJSON, plain text, PDF; exports are not encryptedJSON export carries location and weather per entry
Standard NotesNo: only you hold the keys to decrypt your dataYes: passcode lock plus biometricsEncrypted backup, or decrypted zip of plain text filesMinimal; notes are text
ObsidianLocal Markdown files on your device; if you use Obsidian Sync, the remote vault is end-to-end encrypted, but Obsidian does not encrypt the local vaultNo built-in lock; rely on the device lockThe files themselvesWhatever plugins you install can read the vault
Google Docs, Dropbox, Evernote, Notes foldersYes: the provider holds the keysVariesVariesTreat as readable by the provider unless you encrypt first (step 4)

One caveat from the apps’ own documentation. Day One’s key lives on your device and, by default, in iCloud under your Apple ID; turn that off and lose the key, and “encrypted journal stored in the Day One Sync cannot be decrypted” because “Day One does not have access to the private key at any point.” Obsidian says the same: “We’re not able to recover your password, or any encrypted data for you.” That is the price of a provider that cannot read your journal, and it is why step 6 exists.

Step 2: Lock the account

Password. Let a password manager generate and store it, so it is long and used nowhere else. NIST SP 800-63B says verifiers “SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)” but “SHALL force a change if there is evidence of compromise.” So change it only if it shows up in a breach, which you can check at Have I Been Pwned.

Second factor. Turn on two-factor authentication for the journal account and any cloud account that syncs it, with an authenticator app for the codes; NIST restricts the phone network (PSTN) as an out-of-band channel.

Step 3: Lock the device and the app

This is where most journals are actually read: an unlocked phone on the kitchen table.

Step 4: Encrypt anything that syncs through a general cloud folder

If the journal lives in Google Drive, Dropbox or iCloud Drive as ordinary files, encrypt them on your device before they sync. Cryptomator creates an encrypted vault inside a cloud folder; VeraCrypt creates an encrypted container you mount as a drive. The provider then only ever stores ciphertext. Lose the vault password and nothing recovers it.

Step 5: Backups

Two copies, both encrypted, one off the device. A sync service is no backup, because a deletion syncs too. A Day One JSON export and a Standard Notes decrypted backup are plain text; put them inside an encrypted container before they go anywhere, and delete the unencrypted copy.

Step 6: Emergency access

Decide now who gets in when you cannot. Three documented mechanisms:

Then write one paragraph and store it with the kit:

“If I am dead or unable to manage my accounts, [name] may read my journal. They may read all of it / only entries before [date] / only what is needed to settle my affairs. The journal is in [app]; the account password and the encryption key are in my [Bitwarden / 1Password] vault, and the emergency kit for that vault is in [place].”

The will line: “My digital records, including my journal, are to be handled by [name] as set out in the note stored with my [password manager] emergency kit.”

Step 7: Once a quarter

What is theatre

  • An app-level password on an app that syncs plaintext. The provider and anyone who breaches it still read everything.
  • Hiding entries in a file called “recipes”. Search finds it in seconds.
  • A long password that you also use elsewhere. Length is irrelevant once it leaks from the other site.
  • SMS two-factor on an account whose phone number can be ported. The code goes to whoever holds the number.

When this does not work

A shared family iPad. Apple’s Shared iPad exists only on managed devices with Managed Apple Accounts; a family tablet has no user accounts. You have the app lock and nothing else, so keep the journal on a phone that is yours alone.

A partner who knows your passcode. Apple Journal locks with the phone’s passcode; Day One’s PIN is separate. If the passcode is shared, change it, or accept that the journal is open to that person.

A court order. End-to-end encryption means the provider cannot hand over readable entries. An order served on you can still compel you to produce what you can decrypt; the EFF’s Surveillance Self-Defense guides cover that case.

A lost password on an end-to-end app. Standard Notes, Day One and Obsidian all document the same thing: no recovery. The emergency kit in step 6 is your own recovery mechanism, so write it today.

In The Art of Journaling, chapter 9, I say digital privacy risks can be substantially reduced with two-factor authentication, strong unique passwords and encryption, and I suggest looking for zero-knowledge encryption, where even the company cannot access your entries. This page is the settings-level version of that advice.

Why Digital Journal Privacy Matters

A journal is only useful if it is honest, and it is only honest if you are sure no one else will read it. Digital adds a second reason: the apps that keep the provider out do so by giving you the only key, and each says in its own documentation that a lost key is unrecoverable. Privacy and durability pull against each other, and the seven steps are the way to have both: the first four keep people out, the last three make sure you, and only the people you name, can get back in.

Related reading

Sources