Can the people who built your journal app read it? What a court order or a breach would get

The short answer: no, we can't read your writing, and neither could a court or a hacker who got everything we hold. What we, a court order or a breach would get is the same pile: your email, your username, some readable settings, and your writing as scrambled text. The one thing that pile can't stop is a weak password, and this post says why. It also names the one thing the design doesn't block, because a promise with no honest limit isn't a promise.

The last two posts covered what our server holds and who touches your traffic. This one asks it from three sides: someone who works here, someone with a legal order, someone who breaks in.

If one of us opened the database

Say the founder, who owns the server, logged in with full administrator access and looked at everything. This is the list:

• Your email and username.
• A password check value. Not your password, and not even the thing your device sends us. We store a second, scrambled version of it, mixed with a secret kept on the server outside the database.
• Two random salts and your locked key. Salts are random extras that make every password's scrambling different.
• Your writing as scrambled text. Journal entries, to-do titles and notes, money notes and amounts, your own section names.
• Readable structure, not content. Dates, which section a row belongs to, whether a task is done, how rows link to each other, your settings, which reminders are on and at what time.
• Which module you used and when, tied to your account. Not what you wrote.
• Error reports from the app, and any message you send to us through the feedback form.

That last group matters, so we'll say it plainly: we can see that you opened Finance on a Tuesday evening. We can't see what you recorded there. A pattern of habits isn't nothing, which is why the second list is named in full instead of waved away.

Who actually has access

Awaken Journal is a two-person company. One person, the server owner, can log into the server and into a single admin page. That page is protected by a password and its sign-ins expire. There's no team of engineers and no support staff with a "view as customer" button, because there's nothing readable to view.

An AI assistant helps us fix bugs, and it sees only the error reports from the app: the name of the module, the app version and the error text, up to a fixed length. It never sees your entries, because nobody on our side does.

If a court order reached us

Be clear about what an order can and can't do. It can make us hand over what we hold. It can't make us hand over what doesn't exist. The list above is everything we have: your email, your username, the readable structure, and your writing as scrambled text.

We won't tell you we'd refuse an order. A company that promises that is promising something a court can overrule. What we can promise is narrower and true: there's no readable copy of your journal anywhere on our side to be handed over, and there's no way for us to make one.

If someone broke in

Now the attacker's side. Suppose someone copied the whole database and took control of the server, backups included. They'd get the same list as above, plus the server's secret.

Your password isn't in that list. What an attacker could do is guess: take your locked key and your salt, and try passwords on their own computer, offline, with no rate limit. Each guess is made deliberately slow and memory-hungry (the scrambling method is called Argon2id), which cuts them down, but a guess is still a guess.

So here's the honest cost: in a full breach, the strength of your password is the last thing standing. A long, uncommon password makes guessing hopeless. "journal123" doesn't. We'd rather say that now than let you assume the encryption does everything.

The one thing the design doesn't stop

Awaken Journal's web app is code that our server sends to your browser each time you open it. That code is what locks your writing. In theory, whoever controls our server could send you different code, code that copies your password as you type it. Nothing about encrypting your data on your device protects against the code that does the encrypting being swapped.

That's why we're building native apps. A native app keeps your writing on your device first, and it's a fixed file you install, not code sent to you again on every visit. Once the native apps cover every operating system, we plan to retire the web app, and this limit goes with it. Until then, we're building the web app to be as secure as we can make it, and we'll keep telling you plainly where it falls short, as we have here.

What we'd do if it happened

We have a written plan: detect, contain (change every secret and sign everyone out), work out exactly what was and wasn't touched, tell the people affected, and write it down. Two honest notes about it. It's written, not yet rehearsed: we haven't run it as a drill, and an unrehearsed plan is a belief, not a control. And we haven't set our notification deadline: India's breach-notification timeline isn't settled in our policy yet, and our privacy page says so openly. We're still in development, and we'd rather show you where each of these stands today than let you assume. We'll update this post when the drill is done and the deadline is set.

If it ever happened, the first thing we'd say is the thing this architecture earns: what was exposed (the list above) and what wasn't (your writing, in readable form).

Check it yourself

On a computer, open Awaken Journal, press F12 and pick the Network tab. Save an entry, then click the request that carries it. What you'll see leaving your device is scrambled text, not your words, and that's all that reaches us. You can't audit the whole system from a browser tab, and we won't pretend you can. You can see the one thing that matters most: what we're sent.

Quick answers

Can the people who built Awaken Journal read my journal?

No. Your writing is locked on your device with a key that never reaches us. With full administrator access, we'd see your email, username, readable settings and your writing as scrambled text.

What would a court order get from Awaken Journal?

Whatever we actually hold: account details, readable structure and scrambled text. There's no readable copy of your writing on our side to hand over.

What happens to my journal if Awaken Journal is hacked?

The attacker gets the same pile, not your writing in readable form. In a full breach, a strong password is what protects you from offline guessing.

Can Awaken Journal change its code to read my writing?

In theory, whoever controls the server could send different code to the web app. This is a known limit of web apps. We're building native apps that keep your writing on your device, and we plan to retire the web app once they cover every operating system.

Do you have a breach plan?

Yes, written, not yet rehearsed. We haven't fixed our breach-notification deadline yet, and we say so in our privacy policy.

Where to go next

The next question in Chapter 2 is the hardest consequence of all of this: what happens if you forget your password, and why we can't reset it for you.