A journaling app privacy test starts with one blunt question: if someone got into the company’s systems tomorrow, what could they actually read? Whatever the honest answer is tells you more about the app than any promise on its homepage.
Most people never ask it. They pick an app because a friend recommended it, or because it has a pretty interface and a lock icon, and they begin typing the most personal things they own. The question isn’t paranoid. It’s the same one you’d ask before leaving a diary at a friend’s house: who could open this?
This guide turns that question into a short test you can run on any journaling app. You’ll gather three documents, ask seven specific questions, score the answers, and learn what to do with the result. A chatbot can help with the reading, as long as it only quotes what’s there. The app in the example is invented. This isn’t legal advice, and it doesn’t describe any legal process. It’s about what’s technically readable and what the app says about it.
Contents
The Question Behind the Test
Notice the wording. The test isn’t “is this app secure?” That’s too broad to answer, and no document will answer it honestly. It’s “what could be handed over, leaked, or read by a third party if someone gained access to the company’s systems?”
That question has a short list of possible answers:
- Your readable entries
- Your entries in a form that can’t be read without a key you hold
- Only information about your entries, such as dates or file sizes
- Nothing, because the company doesn’t store it
Each app falls somewhere on that list, and the app’s own documents usually tell you where, if you know which sentences to look for.
Three Ways People Choose an App
- Based on: Go by reviews and design – Other people’s impressions; Read the privacy policy front to back – The company’s full legal text; Run a structured privacy test – Specific questions about specific text.
- Shows what’s readable: Go by reviews and design – No; Read the privacy policy front to back – Buried in the text; Run a structured privacy test – Yes.
- Easy to repeat later: Go by reviews and design – Yes; Read the privacy policy front to back – No; Run a structured privacy test – Yes.
- Risk of missing something: Go by reviews and design – High; Read the privacy policy front to back – Medium; Run a structured privacy test – Lower.
A structured test sits between the other two. In my view, it’s quicker than reading everything and more reliable than trusting the design.
Collect, Question, and Score
Step One: Collect the Three Documents
For the app you’re testing, find:
- The privacy policy, usually linked at the bottom of the website
- A security or encryption page, which may be in the help center
- Any help article about AI features, since AI features are where the handling of your text may change
If one doesn’t exist, note that. In my view, an app with AI features and no page explaining how they handle your text is already telling you something.
Copy the text into a plain document so you can work with it. Keep the web addresses and the date you copied them, because these pages change.
Step Two: Ask Seven Questions
For each, find the exact sentence that answers it, or write “not stated.”
- Who holds the keys to my entries?. Why it matters: Whoever holds the keys can read the content.
- Is my entry text stored in a readable form on the company’s servers?. Why it matters: Readable text is what could be read or leaked.
- When an AI feature runs, where does my text go?. Why it matters: The AI step may be where protection changes.
- Which other companies receive my text?. Why it matters: Each one is another place your words exist.
- How long is text kept after it’s processed?. Why it matters: Retention decides how long the exposure lasts.
- What isn’t protected, such as dates, device details, or file information?. Why it matters: Metadata still says something.
- What happens if I forget my password?. Why it matters: The recovery method shows who holds the keys.
You don’t need to judge the answers yet. Collect them.
Step Three: Score What You Found
Use a simple scale for each question: 2 if the document gives a clear answer you’re comfortable with, 1 if it gives an answer you’re unsure about, 0 if it’s not stated or you’re not comfortable with it. Add them up, out of 14.
- 11 to 14: Clear answers on most points. Check the ones that scored 0 or 1.
- 6 to 10: Mixed. Decide which unanswered questions matter for what you write.
- 0 to 5: Mostly unanswered. Ask the company, or choose differently for private writing.
The score and its bands are my own, not a standard, so it isn’t science. It’s a way to make your gut feeling visible, and to compare two apps on the same footing. Your comfort level is yours, so a “0” on retention might matter a lot to one person and little to another.
Let AI Read for You, Strictly
Step Four: Let AI Read for You, Strictly
Policies are written in dense language, and a chatbot can pull out the relevant sentences quickly. The risk is that it fills gaps with confident guesses, so this prompt forbids that:
I'm running a privacy test on a journaling app. Below is text copied from the app's privacy policy, security page, and AI help page. Please use only this text.
[paste the text]
Answer each question by quoting the exact sentence. If the text doesn't answer it, write "NOT STATED."
1. Who holds the keys to my entries?
2. Is my entry text stored in readable form on the company's servers?
3. When an AI feature runs, where does my text go?
4. Which other companies receive my text?
5. How long is text kept after processing?
6. What is not protected (for example, dates or device details)?
7. What happens if I forget my password?
Then fill in this table: Question number, Quote, Score I should consider (2 clear / 1 unsure / 0 not stated or concerning), and a one-line reason.
Rules:
- Use only the pasted text. Do not use outside knowledge of the app.
- Do not tell me whether the app is safe or whether I should use it.
- If statements conflict, quote both and write "CONFLICT."
- Do not interpret legal terms for me. Just quote them.Treat this prompt as my suggestion: it is not taken from any official guide.
Run it, then read the quotes yourself. The AI is a highlighter, not a judge.
Worked Example for Journaling App Privacy Test
Take an app called Pagelight, which doesn’t exist. After you paste its pages, the table comes back like this:
| # | Quote or result | Score |
|---|---|---|
| 1 | “Encryption keys are managed by us.” | 0 |
| 2 | NOT STATED | 0 |
| 3 | “Entries are sent to a language model provider to generate prompts.” | 1 |
| 4 | NOT STATED (provider not named) | 0 |
| 5 | “Processed text is deleted within 30 days.” | 1 |
| 6 | NOT STATED | 0 |
| 7 | “Reset your password by email and your journal will be restored.” | 1 |
The total is 3 out of 14, which falls in the lowest band. The “keys are managed by us” line and the email-restore line fit together: if the company can restore everything after a password reset, it likely holds what it needs to read the entries, though you’d want it to confirm.
You’d also want to know who the provider is and what happens in those 30 days. For writing you’d be fine with anyone reading, that might be acceptable. For private reflection, you’d ask questions or look elsewhere. Everything about Pagelight here is made up.
Compare Two Apps Side by Side for Journaling App Privacy Test
The test shines when you run it on two apps and put the scores in one table. The totals matter less than the pattern: where one app answers clearly and the other stays silent. If both apps are strong on keys but silent on retention, you know which question to send to the support team.
Ask the Company, and Avoid Common Slips
Writing Your Message to the Company
If an answer is missing, ask. Keep it short and specific:
- “Does your company hold keys that could decrypt my journal entries?”
- “When I use your AI features, is my text sent to a third-party provider? Which one?”
- “How long is my text retained after AI processing?”
A clear reply is a good sign. A vague one, or none at all, tells you how much weight to put on the homepage.
What the FTC Says to Do With the Answers
If your journal records mood or health details, the FTC Consumer Advice: Does your health app protect your sensitive info? gives context for why the seven questions matter. It says apps like these may not be covered by health privacy laws like HIPAA, and it describes an FTC settlement in which the Flo app was said to have shared users’ personal health information with marketing and analytics companies despite promising to keep it private. For consumers, it advises comparing privacy protections by reading what health data an app collects and how it is used and shared, choosing the more protective settings because defaults often favor sharing, keeping the app and phone updated, weighing whether the app’s services are worth the chance your information is exposed, and reporting an app that does not live up to its privacy commitments to the FTC. Your score sheet answers the first of those, and the settings step is easy to add as an eighth row.
Where Writers Trip Up
- Taking one sentence out of context. Read the whole page around a quote.
- Skipping the AI help page. That’s where the answer to question 3 usually lives.
- Treating a high score as a guarantee. The test shows what the documents say, not what’s true in every case.
- Testing once and forgetting. Apps add features, and policies change. Redo the test after major updates.
- Pasting your actual journal entries into a chatbot to “test” it. Paste only the app’s public text.
Questions About Journaling App Privacy Test
What is a journaling app privacy test? It’s a short checklist of questions about keys, storage, AI processing, third parties, retention, metadata, and recovery, answered using the app’s own documents.
How long does a journaling app privacy test take? Finding the three pages and answering seven questions is the main work, and the chatbot prompt only adds the quoting.
Can a chatbot answer these questions for me? It can quote the relevant sentences if you paste the text and forbid guesses. It shouldn’t judge whether the app is safe.
What if the privacy policy doesn’t answer a question? Write “not stated,” and consider asking the company. Missing answers count as information.
Does a good score mean my journal is safe? No. It means the documents give clear answers you’re comfortable with. Policies can change.
Do I need to run the test on an app I already use? It’s worth doing, especially if it has added AI features since you signed up.
Should I write anything differently because of the result? That’s up to you. One option is to keep your most private entries in the app that scored best for you and use other apps for everyday notes.
Run It on One App Tonight
Pick the journaling app you use most, find its three pages, and answer the seven questions with quotes. A journaling app privacy test is short, and it replaces a hunch with specific sentences about what the company says it can and can’t read.
For a look at how journaling apps describe encryption, see our guide to AI journaling encryption.
This article offers general information, not legal, security, or mental-health advice, and it doesn’t describe any legal process. Apps and policies change, so read the current documents. The example app and its text are fictional. If you’re struggling with persistent or serious emotional difficulty, consider talking with a licensed professional.
Sources: FTC Consumer Advice: Does your health app protect your sensitive info?.
Leave a Reply