Your journal belongs to you.

Jia ("Jia," "we," "us," or "our") makes a journaling app for iPhone and iPad. This Privacy Policy explains what information Jia collects, how it's used, and, most importantly, what stays on your device and never reaches us at all.

Jia was built around one rule: your journal belongs to you. Everything below is written to make good on that.

The short version

If you want the full detail, read on.

1.Information we collect

1.1 Journal content: not sent to us

Everything you create in Jia, including written entries, handwritten strokes, typed text, audio you talk into the app, decorations, and prompts you've answered, is stored:

• On your device, in the app's local storage, and
• In your own personal iCloud account (Apple's private CloudKit database), so it syncs across your own devices.

This data is encrypted at rest by Apple and is accessible only to you, as the signed-in iCloud user. Jia's servers never receive, store, or have visibility into this content: not your entries, not your handwriting, not your voice recordings. The only exception is a passage you choose to share as a link, and even then we only hold it encrypted, without the key (see §1.8).

Some content is deliberately never even written to a file, let alone synced anywhere:

• Talk it out (voice-to-text): your speech is transcribed to text entirely on your device using Apple's on-device speech recognition. The audio itself is never saved to disk and never leaves your device; once the words appear as text, the audio is gone.
• Scan a page: when you photograph a paper page to bring it into your journal, the photo is used on-device to recognize the text and is then discarded. The image itself is never kept or sent anywhere; only the resulting text is saved, as part of your entry.

1.2 Account information

Jia uses Sign in with Apple. We receive an opaque, Apple-generated identifier for your account. We immediately hash that identifier and use the hash as an anonymous ID for the limited backend purposes described below (relaying AI requests and logging their metadata, storing your onboarding preferences, rate limiting, and the free trial). This backend identifier is separate from — and never shared with — the analytics identifier described in §1.3. We do not receive, request, or store your name or email address, even if you choose to share them with Apple during sign-in.

1.3 Usage analytics (no journal content)

We use Mixpanel to understand how the app is used in aggregate: for example, that entries are being saved, that a feature was opened, or that a subscription was started. Analytics events:

• Never contain journal content: no entry text, no transcripts, no scanned text, no handwriting, no AI prompts or AI responses.
• Are tied only to a separate, random identifier that our analytics tool generates on your device for this purpose. This identifier is not your Apple ID and not the hashed backend identifier in §1.2 — analytics is deliberately kept unlinked from your identity, and the identifier resets if you reinstall the app.
• Contain counts and outcomes (e.g., "an entry was saved," "a prompt was used"), not free text or precise, fingerprintable timestamps.

You can disable analytics entirely in Settings; the app remains fully functional either way.

1.4 AI request metadata (no journal content)

When an AI request is made (see §2), our backend logs operational metadata about that request: which AI provider handled it, how long it took, how many tokens were used, and whether it succeeded. This metadata never includes the content of the request or response: not the prompt, not the AI's reply, not any part of your entry.

1.5 Onboarding preferences

During onboarding you may answer a small set of multiple-choice questions — such as what's drawing you to journaling, your relationship with journaling, challenges you'd like to work on, when you like to journal, a journal color, and reminder preferences. These closed-set answers are stored on our backend, keyed to the anonymous hashed identifier in §1.2, and are used to personalize your experience. They never include free-form text, and never your name, birthdate, or gender: those stay on your device.

1.6 Device and technical information

Standard technical information is processed as part of operating the app and its backend, such as app version, OS version, and device type (iPhone vs. iPad), used for things like debugging, compatibility, and understanding our user base in aggregate.

1.7 Purchases

Companion subscriptions are sold and billed entirely through Apple's App Store (StoreKit). We never see or store your payment details; Apple handles billing directly, and Jia only receives confirmation of your subscription status.

1.8 Shared passages

You can select a passage of typed text from an entry and share it as a link that opens on tryjia.app. This is the only way the words you write ever reach our backend, and it only happens when you ask for it. Here's how it works:

• Only when you share. Nothing is uploaded until you pick a destination in the share sheet. If you close the sheet without choosing one, nothing leaves your device.
• Encrypted on your device. Before anything is uploaded, Jia encrypts the passage on your device: its words, the date of the entry it came from, and the paper and ink it's shown on. The key that unlocks it is only in the link itself, in the part after the # sign. Browsers never send that part to a server, so we store the encrypted passage but have no way to read it. The person you share it with unlocks it in their own browser.
• Never your name. A shared passage doesn't include your name. Next to it we store your anonymous ID from §1.2 (so we can delete your shared passages if you delete your account), the time it expires, and a count of how many times it's been opened.
• Gone after 24 hours. 24 hours after you share it, the encrypted passage is deleted. We keep a small marker with no content in it, just the link's ID and its expiry time, for 30 days, so anyone who opens the link sees "This link has expired" instead of an error. After 30 days the marker is deleted too.
• Anyone with the link can read it. For those 24 hours, whoever has the full link can open the passage, including anyone it gets forwarded to. Link previews in apps like Messages show the same generic card for every passage, never your words, because we can't read them to build one.
• The passage card stays on your device until you send it. When you share, Jia can also make an image of the passage. That image is made on your device and is never uploaded to us. Once you send it somewhere, it lives wherever you sent it and doesn't expire.

Deleting your account removes all of your shared passages right away, and any links you've shared stop working (see §4).

2.How Jia uses AI

Jia's core journaling experience (writing, handwriting, decorations, looking back at past days) works completely offline and never involves AI or the network.

The Companion, Jia's optional AI presence, is different, and we want to be specific about how it works:

• Before any text leaves your device for AI processing, we run a local redaction pass that strips things like email addresses, phone numbers, names from your contacts (only if you've opted into contact matching), URLs, and physical addresses. You can view your redaction activity, and you can turn redaction off in Settings if you prefer AI to see your writing verbatim.
• Generative AI requests are routed through OpenAI and/or Anthropic, via a backend relay we control. These providers receive the (redacted, unless you've disabled redaction) text of your request: never the whole journal, only what a given AI feature needs. Under our agreements with these providers, this content is not used to train their models. Each provider does retain it briefly to detect and prevent abuse, under their standard API terms: OpenAI retains API inputs and outputs for up to 30 days, and Anthropic deletes them within 30 days. Both providers keep content longer where the law requires it, or where a request is flagged by their automated safety systems: in Anthropic's case, a flagged request may be retained for up to 2 years, and its safety classification scores for up to 7 years.
• You can see exactly what was sent. Settings → AI History shows your last 100 AI requests, so you can audit exactly what left your device and when.
• You can turn AI off completely. With AI disabled, or with Privacy Mode enabled, Jia relies only on on-device AI (Apple Intelligence, where available on your device) and refuses to send anything to a cloud AI provider. If on-device AI isn't available on your device, the relevant AI feature is simply inactive rather than silently falling back to the cloud. Some Companion behaviors are generative and only work through the cloud relay described above; with Privacy Mode on, those specific behaviors are turned off rather than run on-device. On-device features like theme recognition continue to work regardless.
• No AI request happens silently. Every AI call is in direct response to something you did, and the app shows you when it's talking to AI.

3.Who we share information with

We share information only as needed to run the app, and never for advertising or resale:

We do not use advertising networks, and we do not sell or rent your information to third parties.

We may disclose information if required to do so by law, or to protect the rights, property, or safety of Jia, our users, or others, but because journal content never reaches us in a form we can read, there is nothing of that nature for us to disclose, even in response to a legal request. The most we could hand over is an encrypted shared passage we have no key for, and only during the 24 hours before it's deleted.

4.Your choices and rights

• Turn AI off. Disable AI entirely in Settings; the journal remains fully usable.
• Privacy Mode. Restrict AI to on-device processing only, refusing all cloud AI requests.
• Disable analytics. Opt out of usage analytics at any time in Settings.
• Review what's been sent to AI. Settings → AI History shows your last 100 requests.
• Export or access your data. Because your journal lives in your own iCloud account, you can access, back up, and export it the same way you would any of your personal iCloud data.
• Delete your account and data. Settings → "Delete my account and all data" permanently deletes your journal data from iCloud, erases all local data and cached files on your device, deletes the AI-request metadata and onboarding preferences keyed to your anonymous backend identifier, deletes every shared passage you've created (so those links stop working immediately), and signs you out. (Usage analytics is stored under a separate, unlinked identifier and isn't tied to your identity, so there's no personal analytics record for us to delete.) You'll be shown exactly what will be deleted and asked to confirm before anything is removed.

If you're unable to use the in-app deletion flow (for example, you've lost access to your device or Apple ID), contact us at the email in §8 and we'll process the request manually. Note that because Jia is designed so your journal content never reaches our servers in a readable form, there is generally very little for us to delete beyond the limited AI-request metadata and onboarding preferences described in §1.4–§1.5 and any shared passages from §1.8 (usage analytics is anonymous and not linked to you); deleting your iCloud data is something you can always do directly by removing it from your iCloud account, with or without our involvement.

5.Children's privacy

Jia is not directed at, and is not intended for use by, children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with information, contact us at the email below and we will address it.

6.Data security

Journal content is encrypted at rest by Apple within your private iCloud database and is accessible only to your signed-in iCloud account. Shared passages are encrypted on your device before upload, and the key never reaches our servers. Backend infrastructure that handles the limited anonymous data described above is access-controlled, and API keys for third-party AI providers are kept server-side and never embedded in the app.

No method of storage or transmission is 100% secure, but Jia is deliberately architected so that a compromise of our backend would not expose journal content, because our backend never has it in a form it can read.

7.Changes to this policy

We may update this Privacy Policy from time to time as the app evolves. If we make material changes, we'll update the effective date above and, where appropriate, notify you in the app. Continuing to use Jia after a change means you accept the updated policy.