How to check a journal app's privacy claims yourself, in five minutes

The short answer: you don't have to take our word for anything in this chapter. On a computer, in about five minutes, you can see what leaves your device when you save an entry, where your browser is allowed to send it, and everything our server holds about you. This post walks you through five checks, step by step, with no technical background needed.

The last five posts made a lot of claims. This one hands you the tools to test them.

Before you start

You need a computer and a desktop browser: Chrome, Edge, Firefox or Safari. Phone browsers don't show these tools. Sign in to Awaken Journal, then press F12 (on a Mac: Cmd + Option + I; in Safari, first turn on Show features for web developers in Settings → Advanced). A panel opens. That's your browser's developer tools, built in, and it shows what the page is actually doing. You can't break anything by looking.

1 · What leaves your device when you save

1. In the panel, open the Network tab.
2. Write a sentence in your journal and let it save.
3. In the list, click the newest request to entries (its name may be entries, blob or a long number), then open Payload (Firefox: Request).

You'll see your entry as a long run of scrambled letters and numbers, not the sentence you wrote. That's what crosses the internet, and it's all our server ever receives. The date and section next to it are readable. Our field-by-field post explains why.

2 · Where your browser is allowed to send anything

1. Still in Network, reload the page and click the very first request (the page itself).
2. Open Headers and find content-security-policy under the response headers.

You'll see default-src 'self' and connect-src 'self'. In plain words: your browser will only load code from, and send data to, our own address. If anything on the page tried to talk to an analytics or ad company, your browser would block it. This rule is enforced by your browser, not by our promise. Run your eye down the request list too: every request goes to journal.everythingawaken.com.

3 · Everything our server holds about you

While signed in, open these two addresses in a new tab:

• journal.everythingawaken.com/api/me shows your account: email, username, sign-in method, when you joined, how many days you've journaled, your settings, a couple of app flags (like unread replies to your feedback), and two long values (your salt and your locked key) that are useless without your password.
• journal.everythingawaken.com/api/account/export shows every row of your journal, to-dos, money and notes, exactly as we store it. Every piece of writing is scrambled. What's readable is dates, done-or-not and links between rows. If you've written a lot, it's a long page.

That second page is the same thing a court order or a thief would get, as covered two posts back. Now you've seen it with your own eyes.

4 · What we keep in your browser

Open the Application tab (Firefox: Storage, Safari: Storage) and look at Cookies. You'll find __Host-session, which keeps you signed in, and nothing else unless you're halfway through a Google or Apple sign-in. No tracking cookies.

5 · Two things that aren't there

• No "Forgot password?" link on the login page. The last post explains why it can't exist.
• No third-party scripts. In Network, filter by JS: every script comes from our own address.

What these checks can't tell you

Honest limits, so you know what you've proven and what you haven't:

• They show what happened on this visit. The web app's code comes from our server each time you open it, so these checks can't promise the next visit's code is the same. That's the limit we named in an earlier post, and one reason we're building native apps.
• They show what reaches us, not what happens on our servers. For that, the field-by-field list and our privacy page are the record, and we keep them matched to the code.
• If you want to report something you find, our security contact is published at journal.everythingawaken.com/.well-known/security.txt.

Quick answers

How can I check if a journal app is really private?

Open your browser's developer tools (F12), save an entry, and look at the request in the Network tab. If the app is end-to-end encrypted, you'll see scrambled text, not your words.

Can I see what Awaken Journal stores about me?

Yes. While signed in, open journal.everythingawaken.com/api/account/export for your content as we store it, and /api/me for your account details.

Does Awaken Journal send my data to other companies?

No. The page tells your browser to load and send only to our own address, and your browser enforces that. You can see the rule in the response headers.

Can I run these checks on my phone?

Not in a phone browser. You need a computer with Chrome, Edge, Firefox or Safari.

Do these checks prove the app is secure?

They prove what leaves your device and where it can go on that visit. They don't prove how our servers behave, or that the code won't change. We say so openly.

Where to go next

The next question in Chapter 2 is the big one: is it actually secure, the honest answer, and the methods we chose.