When you open an app to write down something you have never told anyone, a hesitation often stops you. You wonder where those words go once you press save, who has the keys to read them, and whether a machine or a human will ever see them.
Judge an AI journal's privacy by following one entry: where it is stored and who holds the keys, what reaches the AI providers and on what terms, who can read it and when, and what deletion removes. Rosebud's own privacy policy, for example, says entries are stored on its servers and encrypted in transit and at rest, go to its AI providers without identifying details under zero data retention agreements, are read by a small number of authorized people only for support, technical or safety reasons, and stay in backups for a short time after deletion. Read those lines in any app's policy before you write.
Starting with text or voice
Every entry begins on your device, either typed on a keyboard or spoken aloud. These two inputs take different technical paths from the moment you record them.
A typed entry is text. A spoken entry is two things: an audio recording and the transcript generated from it. According to the company's privacy policy (last updated in 2026), if you use voice journaling, dictation, or voice conversation features, the system collects the audio you record and the transcript produced from it. The policy notes that audio is sent to its transcription provider under a Zero Data Retention agreement and is discarded after processing.
I started using Rosebud when I was at one of my lows. The idea came from my own experiences with therapy and coaching, and from meeting my co-founder Sean through a men's group where we practiced exactly this kind of open dialogue. Reflective journaling is a space for personal reflection and growth, not acute crisis care. If you are experiencing overwhelming distress or thoughts of self-harm, please call or text the Suicide & Crisis Lifeline in the United States, or contact your local emergency service if you are abroad.
When you want to decide how your words are captured, the choice is straightforward. If you prefer that no audio recording ever exists, type your entries.
Where entries live and who holds the keys
Once you submit an entry, it leaves your phone or computer and travels to a storage server. Understanding how that data is shielded requires separating how information moves across the internet from how it sits on a drive.
The UK Information Commissioner's Office (ICO), in its guidance on encryption, defines encryption as a process using a secret key to encode information so that only those with access to the key can read it. Encryption in transit protects data moving across a network, shielding it from interception or eavesdropping. Encryption at rest secures stored data on a device or network, making it unintelligible to unauthorized users without a key.
Yet encryption at rest does not prevent the hosting provider from reading the files if that provider holds the keys. As the ICO explains in its scenarios on cloud encryption, cloud service providers commonly use encryption at rest to protect physical storage devices from unauthorized access. On a technical level, this does not stop cloud providers from accessing the data, because they typically manage the encryption keys.
The privacy policy states that entries are stored on company servers in Google Firestore, encrypted in transit and at rest. The policy also gives its reason for not using keys held only by the user: user-based encryption carries a risk of data loss if the encryption key is forgotten or lost, whereas storing data on its servers ensures that even if you lose access to a device or forget a key, journal entries will not be permanently lost. The policy does not say who holds the encryption keys.
The trade-off between private keys and server processing
Many people ask why apps that provide automated feedback do not simply use end-to-end encryption. The answer lies in the technical mechanics of server-side computation.
Under end-to-end encryption, as defined in an ICO policy paper from 2021, content is encrypted across communications channels so that only the sender or recipient can access it. This setup prevents third parties, including the platform provider itself, from accessing the content. Furthermore, the ICO explains in its encryption guidance updated in 2025 that if you lose a decryption key, no one, including you, can decrypt the data.
That architecture creates a conflict with server-side language models. In a 2025 preprint published on arXiv, Knodel and colleagues examined the relationship between AI assistants and end-to-end encrypted messaging systems. They explained that plaintext inference and training are not compatible with end-to-end encryption, because analyzing readable text requires exposing that text to the computing service. Even with custom hardware, the authors write, a smartphone cannot support every AI assistant query, and many features require sending readable text off the device.
When an app analyzes your entries on its servers, it trades user-held key isolation for automated processing and for recovery if you lose a device or forget a key. To protect entries locally on your phone, the company's help page describes a biometric lock using Face ID, Touch ID, or fingerprint sensors. Under this feature, biometric data stays locked in the device hardware, and the application receives only an unlock success or failure event.
What reaches the language models
When an entry triggers an automated reflection or prompt, what actually leaves the database and reaches the external AI models?
The privacy policy explains that entry contents are sent to named AI and language model providers, including OpenAI, Anthropic, Google, Amazon Web Services, and Groq. According to the policy, all data processed through these services is anonymized, containing only the contents of journal entries without user-identifying information. The policy also states that the company maintains business associate agreements and Zero Data Retention agreements with these providers, ensuring they immediately discard data after processing.
In the United States, the Department of Health and Human Services defines a business associate agreement as a written contract where an outside partner gives satisfactory assurances that it will appropriately safeguard protected health information. This federal framework defines obligations under US health privacy rules, though its mention in vendor contracts describes provider agreements and does not mean a consumer application itself is classified as a covered medical entity.
Removing account names and email addresses from text is useful, but it has limits. In a study presented at the ICLR 2024 conference, Staab and colleagues demonstrated that large language models could still infer personal attributes, including geographic location and age, from ordinary text even after state-of-the-art tools for detecting personal information were applied. The researchers tested public forum comments rather than personal journal entries. Similarly, a 2019 study by Rocher and colleagues in Nature Communications found that re-identification remains a practical risk across incomplete, sampled demographic datasets.
The practical control rests in what you write. If you are describing an experience you want kept private, leave out employer names, specific addresses, and identifying details you would not want processed.
Analytics, advertising, and training data
Modern applications routinely connect to third-party services for bug tracking, product analytics, and advertising. What happens to your journal text when those systems run?
The privacy policy states that journal entries and personal reflections are never sent to analytics tools or advertising providers. It also states that the company uses aggregated and anonymized data to identify trends, track user behavior, and understand how people interact with the service, and may share only aggregated, anonymized data with academic research partners to study mental well-being.
Rosebud does not use journal entries to train AI models, and its therapy and coaching page says entries are "never used to train AI." Not every app says this plainly, so when you judge any journal, look for an explicit statement on model training rather than assuming it does not happen.
Reading these boundaries closely matters because digital health tools have often shared data without clear disclosures. A 2019 study published in JAMA Network Open by Huckvale and colleagues examined 36 top-ranked depression and smoking-cessation apps. The researchers discovered that 33 of 36 apps (92%) transmitted data to third parties, yet most failed to provide transparent disclosure of those practices in their policies. In a 2022 study in Empirical Software Engineering, Iwaya and colleagues evaluated popular Android mental health apps and uncovered security issues, including unnecessary permissions, weak cryptography implementations, and leaks of personal data in web requests. In 2024, the Federal Trade Commission's business guidance on consumer health information warned companies that health information includes anything conveying or enabling an inference about health.
When human eyes can open an entry
A common concern among journal writers is whether company employees or moderators can browse personal reflections.
The privacy policy states that access to production data containing journal content is restricted to a small number of authorized individuals. According to the document, authorized individuals access journal content only when necessary to resolve a technical issue, respond to a user support request, or investigate a safety or security concern. The policy also notes that automated quality evaluations review real interactions to assess feature performance, but these evaluations are run by machine systems and are not reviewed by staff.
In addition, the policy specifies that personal journal entries and data tied to an individual will never be shared unless absolutely required by law enforcement.
This operational structure means that if you file a customer support ticket asking for help with a specific reflection or a technical error, an authorized staff member may open that entry to diagnose the problem. Keep that in mind before submitting an inquiry about private text.
Continuity, memory, and learned preferences
As you write regular entries, an interactive journal builds context so it does not treat every session as an isolated interaction.
According to the help page on long-term memory, the system takes note of important topics you mention and recalls previous entries to create continuity over time. Exploring how to notice emotional patterns can give you a way to review these recurring themes across months of regular writing.
The documentation does not list a setting to disable long-term memory. However, for stylistic adaptations, the help page on learned preferences explains that when you give feedback, the system saves those preferences and applies them to future interactions. You can view, manage, or disable learned preferences at any time within your settings.
How to export entries and delete an account
Stepping away from an app should be as clear as signing up. If you decide to leave, you need to know how to retrieve your writing and what happens when you press delete.
The help page on exporting data explains that you can download a single entry or export all entries to Markdown files through account settings. The help page on deleting an account stresses that deletion is irreversible, covering entries, goals, and personalized prompts, and recommends exporting all entries beforehand.
The privacy policy explains the backend process. When you request deletion, the account and sensitive journal data are deleted from active systems. However, deleted data is retained for up to 30 days in Google Firestore for disaster recovery purposes, after which it is permanently removed. The policy also notes that the company may retain a limited set of non-journal records where an ongoing business or legal need exists, such as billing history for financial recordkeeping and product error logs.
Under UK data protection law, the Information Commissioner's Office explains in its guide to subject access updated in 2026 that individuals have a right to obtain a copy of their personal information, and organizations must respond without undue delay and within 1 month, though extensions can apply and clarification can stop the clock. Regarding deletion, the ICO guidance on individual rights confirms that the right to erasure is not absolute, and data may remain within backup systems for a period until overwritten.
Consumer privacy reviews show why built-in account deletion features matter. In a 2023 review of mental health apps by the Mozilla Foundation, researchers noted that deleting an app icon from your phone almost never removes your personal information from company servers. Always export your writing first and complete formal account deletion directly in the application settings.
Policy updates and terms of ownership
Data handling practices are governed by legal terms that can change over time. Understanding your legal rights requires looking at ownership terms and how updates are announced.
The company's published terms of service provide that you retain full ownership of any intellectual property rights in the content you create. By submitting content, you grant permission to store and protect it on your behalf, and the terms state that the company will not use, publish, display, or distribute your user content for any other purposes.
Privacy terms, however, can be revised. The privacy policy states that if material changes are made, the company may notify users through the privacy page, by email, or via a notice on its home page.
Regulatory agencies monitor how software providers introduce revisions. In 2024 guidance published on the FTC technology blog, staff warned that it may be unfair or deceptive for a business to adopt more permissive data practices, such as sharing consumer data with third parties or using that data for AI training, and inform users only through retroactive amendments to its terms or policy.
Your defense is simple: check the date at the top of an app's privacy policy when you sign up, and check it again whenever an update notice appears.
If you want an interactive journal built around structured reflection and documented privacy practices, explore what we are building at Rosebud.
FAQs
How can I tell which AI journaling tool offers strong data security?
For data security, look at any tool's own documents for four answers: who holds the encryption keys, what reaches its AI providers and on what terms, who on its staff can read an entry and when, and what deletion removes and how long backups keep it. A tool whose policy answers all four in plain words, with a date at the top, is one you can judge.
If a service leaves those points unaddressed, claims absolute secrecy without explaining its server architecture, or fails to provide clear export and account deletion options, look elsewhere.
Does HIPAA protect what I write in an AI journaling app?
Usually not, if you downloaded the app yourself: US health regulators say an app offered directly to consumers, not on behalf of a doctor or health plan, is not likely to be subject to HIPAA. The FTC's Health Breach Notification Rule covers many health apps that HIPAA does not and requires them to tell you about a breach. When a policy mentions a business associate agreement, ask who it is with and what it covers.
In 2016, the Department of Health and Human Services clarified that developers offering products directly to consumers rather than on behalf of health plans or healthcare providers are not likely to be subject to the Health Insurance Portability and Accountability Act (HIPAA). Meanwhile, the Federal Trade Commission enforces its Health Breach Notification Rule, updated in 2024, which requires certain organizations not covered by HIPAA, including makers of health apps, to notify their customers of a breach of unsecured, individually identifiable health information.
