What happens if something goes wrong? How Awaken Journal is kept honest

The short answer: if Awaken Journal were ever broken into, your writing would still be sealed. Someone could reach your account details, like your email address, and nothing you wrote. If that happened, we'd follow five written steps: notice it, shut it down, work out exactly what was reached, tell you plainly, and write it all down. This post explains how a problem gets noticed in the first place, what those five steps are, what a break-in could and couldn't reach, and which parts of this we haven't finished yet.

The last post was about what to do if something goes wrong on your side, like a lost phone. This one is about something going wrong on ours.

1 · The promises are written down before the code

Most apps write their privacy promise after they build the thing. Ours was written first, as a list of rules the app has to obey. It's public in the Awaken Journal Standard.

Before any change to the code that touches your data goes in, it's checked against a short written list of questions. Three of them:

• Would any of your writing leave your device unsealed?
• Could we, with full access to our own server, read it?
• Would the key that opens your writing, or anything it could be rebuilt from, be sent or saved anywhere?

If the answer to any of them is yes, the change doesn't go in. There's no "we'll fix it later" box to tick.

When a fact in the Standard changes, the page changes with it. Where something isn't done yet, the page says so in plain words instead of leaving it out.

2 · How a problem gets noticed

A problem you never notice can't be fixed. So there are three ways one reaches us:

• A weekly check of the code we build on. Every Monday, an automatic scan checks every outside library the app uses against the public list of known security problems. A library that was safe last week can turn out not to be, and this is how we find out.
• Error reports from the app. When something breaks, the app sends us a short note: the app version, which part of the app (Journal, To-Do and so on), whether it was a phone, tablet or computer, the error itself, and the page it happened on, without the rest of the web address. It never includes anything you wrote. A sudden wave of errors in one place is often the first sign that something is wrong.
• You, or anyone else. If you ever find something that looks like a security problem, tell us at help@everythingawaken.com. Security researchers can also find our security contact in the standard place they look for it (/.well-known/security.txt on the app's web address). A report from someone outside is treated as real until we've checked it.

3 · If something does go wrong: the five steps

These steps are in our written incident plan. We're a team of two, so there's no committee to wait for. Whoever spots it starts at step 1.

1. Write down what we saw, and when. Before touching anything. Memory of "what came first" fades fast once you start fixing.
2. Shut it down. Change every secret and password that could be involved, and end any sign-in that shouldn't be there. Nothing gets deleted while we do it, so the record of what happened survives.
3. Measure it. Which part of the server, which details, how many accounts, and how it happened. The "how" matters most, because it shows whether this was a one-off or a gap that needs fixing in the code.
4. Tell you. We'd say plainly what was reached and what wasn't, how many accounts were affected, and what, if anything, you should do.
5. Write it down, and fix the plan. Every incident gets a written record, and the plan itself gets corrected if any step was slow or unclear.

4 · What a break-in could and couldn't reach

This is the part the whole design was built around. Our server only ever holds your writing as sealed text, and the key that opens it never reaches us. So:

• What a break-in couldn't read: your journal entries, your tasks, your money amounts and notes, your section and category names, and your Notes pages. They're sealed before they leave your device, and they stay sealed on our server and in our nightly backups.
• What it could reach: the plain details listed in what our server knows: your email address, your username, dates, and the shape of your account (how many entries, which days). That's what step 4 would be about.

One honest line on top of that: someone who stole a copy of our database could try guessing your password against it, slowly, on their own computers. Each guess is deliberately expensive, and what decides how long it takes is the length of your password. A long one you don't use anywhere else is what keeps a stolen copy useless.

5 · What we'd tell you, and when

If your details were ever reached, we'd tell you as soon as we knew what was reached (step 3). Not before, because a guess helps nobody, and without waiting once we do.

We'd write it the same way we write everything else: what happened, what was and wasn't reached, and what you should do. No "we take your privacy very seriously" in place of the facts.

What isn't finished yet

These are the gaps in this part of the system, said plainly:

• The plan is written but hasn't been rehearsed end to end yet. A plan that has never been run is a good intention. A full practice run is still ahead of us.
• The exact legal deadline for telling you is still being worked out. India's data protection law (the DPDP Act) sets how quickly a company has to report a breach. We haven't finished mapping that number into our plan, and our privacy policy says so. It will change the day that's done.
• Every check so far is our own. No outside firm has audited Awaken Journal yet. The security post has the full list of what's done and what isn't.

What you can do

1. If you spot something that looks wrong, tell us: help@everythingawaken.com.
2. If you think someone else signed in to your account, sign in again yourself. That ends every other session straight away.
3. Use a long password you don't use anywhere else. It's what protects your writing even in the worst case above.
4. Download a backup now and then. It's sealed with your password, and it means no problem on our side can ever take your writing away from you.

Check it yourself

• The reporting address. Open journal.everythingawaken.com/.well-known/security.txt in any browser. It's a short text file with our security contact on its first line.
• The written promises. Read the Awaken Journal Standard. Scroll to "What would happen if Awaken were breached?", the same five steps in short.

Quick answers

What happens to my journal if Awaken Journal is hacked?

Your writing stays sealed. Our server only holds it in encrypted form and never has the key, so a break-in reaches your account details, like your email, not what you wrote.

Would you tell me if there was a data breach?

Yes. As soon as we knew what was reached, we'd tell you plainly what was and wasn't exposed, how many accounts were affected, and what you should do.

How do I report a security problem in Awaken Journal?

Email help@everythingawaken.com. Security researchers can also use the contact in the app's /.well-known/security.txt file, the standard place they look.

Do error reports include what I write?

No. They carry the app version, which part of the app, the device type, the error and the page. Never your entries.

What should I do if I think someone got into my account?

Sign in again yourself. You're signed in on one device at a time, so your sign-in ends every other session straight away. Then tell us at help@everythingawaken.com.

Where to go next

That's the last post in Chapter 2. Chapter 3 is about the day itself: how a day in Awaken Journal is built, from the first line in the morning to the review at night.