Privacy policy
Last updated: 8 November 2026
Your journal stays on your phones
Journal text, photos, songs, stickers, comments and tags are stored on the devices of the people in the journal. They travel directly between those devices, encrypted, and are not stored on our servers. Phone backups to iCloud or Google leave journal content out.
If the owner of a journal turns on the optional encrypted mailbox, changes can wait on our server until the other phones collect them. They are encrypted on the phone before they are sent, the server cannot read them, and they are deleted once every phone has them.
What our server keeps
- Your account: email address, the name you choose, and how you sign in (email, Google or Apple).
- Your devices: an identifier and name for each phone you use, and its push notification token, so other phones can tell it to sync.
- Journal membership: which journals you belong to, your role, and invitations, including the email address an invitation was sent to.
We use this only to run the app: signing you in, letting people join a journal, and helping phones find each other. We do not sell it, use it for advertising, or run analytics on it.
Services we use
- Supabase hosts the server, account sign-in and the database described above.
- Google Sign-In and Sign in with Apple, if you choose them, confirm who you are. We receive your email address and name from them.
- Apple Push Notification service and Firebase Cloud Messaging deliver sync notifications. Notifications carry no journal content.
Deleting your data
Deleting the app removes the journal pages stored on that phone. To delete your account and everything our server keeps about you, email us at the address below and we will do it within 30 days.
Children
hahyah is not directed at children under 13.