Innerholm stores your journal entry text, timestamps (created and updated), any tags you apply, and your account email address. Entries in a journal that keeps a place (the Travel edition, or a journal you built with the Place companion) also carry a place name and an approximate coordinate, rounded to about a kilometre, when you let your device share its location. If you arrived through a tagged link, we also record which source and campaign brought you (those two labels, captured once at signup). If you subscribe to Innerholm+, we store your Stripe customer and subscription identifiers, your plan, and when your billing period ends; your card details go directly to Stripe and never touch our servers. When you search, we log the result count and response time for performance monitoring; your search query text is not stored, and no entry content is stored in logs. Journals you keep in Local Journal Mode are the exception: they are stored only on your device, and nothing in them ever reaches our servers.
Can Innerholm read my journal entries?
That depends on the journal, and it is your choice. By default: technically yes. Entries are stored on our servers, encrypted at rest so a stolen disk or backup is unreadable, but our servers can still decrypt them, because sync and full-text search need to read them. What we commit to there is unconditional: no human at Innerholm reads your entries; no automated system scans your content for advertising, AI training, or behavioural profiling; your content is never used to train machine learning models. If you want that to be a technical guarantee rather than a promise, you can turn on end-to-end encryption for any journal. The title and body of every entry in it are encrypted on your device before they are sent, and the key is derived from your passphrase and never reaches us. Then we cannot read that journal even if we wanted to, or were compelled to. A journal in Local Journal Mode goes one further: it lives only on your device and never reaches our servers at all. We cannot read it because we do not have it.
When I delete an entry, is it really gone?
Within 30 days, yes, permanently. Letting an entry go hides it from every view immediately: it leaves your journal, your lists, your calendar and your search results the moment you let it go. The row itself is then held for 30 days and hard-deleted by a nightly job. That window is yours: the entry is listed under Settings, Privacy, "Entries you let go" for the whole of it (the hundred most recent, which is more than most people ever let go at once), and you can bring them back from there. After that it is gone from the database, and out of backups on their own 30-day cycle. Deleting your account skips the wait: everything, including entries already let go, goes in one transaction.
What happens to my data if I cancel?
If you delete your account via Settings > Privacy > Delete my account, Innerholm hard-deletes your data in a single database transaction: journal entries, tags, settings, search logs, usage telemetry, AI reflections, and your account record. Deletion is immediate and irreversible. There is no grace period and no recovery path. Backups that contain your data rotate out on a 30-day cycle, after which your data is gone from all systems. A few records outlive deletion: feedback you sent us (kept without your name or email attached), our do-not-email list (how we make sure we never email you again), our record of which letters went out and when (kept against a one-way hash of your address, not the address itself, so nobody is written to twice), billing records our payment processor keeps because tax and financial law require it, and short-lived operational logs that age out within 30 days. If you requested the prompt pack, that email list is separate from your account and has its own one-click unsubscribe.
If someone buys me a gift, what do you learn about me?
Your email address, and only because the person who bought it typed it in so we could deliver the gift. We use it for that one letter and nothing else: it does not join a mailing list, and unless you redeem the code you never hear from us again. If they left you a note, we carry it to you and nothing reads it: no scanning, no AI, no search. After a year we delete the people from a gift entirely, both addresses, the name and the note, whether or not it was ever opened, while the code itself stays good for ever. The buyer holds the code, so they can tell whether it has been opened, but they never see anything you write. Buying a gift also does not require an account, so if you buy one we hold your address for the receipt, plus a salted one-way hash of your IP address to prevent abuse, and nothing else.
Does Innerholm use my data to train AI?
No. Innerholm does not use journal content to train machine learning models. Innerholm does have AI features: they are off by default, turned on per journal, and they read a journal only when you turn them on for that journal and ask. When you ask, the entry is sent to Claude (Anthropic) to generate the response; a few features you can invite, like the periodic companion note and gatherings, read several recent entries from that journal at once under the same per-journal consent. Anthropic does not use any of it to train models and deletes it after a short retention window (currently up to 30 days). The exception is a request its automated safety systems flag, which it can hold longer. Every data-touching feature follows the same rule: off by default, disclosed before anything is sent, gated by a consent toggle you control. If how AI features handle your data ever changes, we will email you at least 30 days before the change takes effect.
Does Innerholm share my data with third parties?
No. Innerholm does not sell, license, or share journal content with advertisers, data brokers, or analytics companies. Service providers (cloud hosting, email delivery, payments, and the AI service when you use AI features) process data as subprocessors under data processing agreements; they do not receive access to your content for their own purposes. Two optional features also reach a public lookup service: weather, if you turn it on, and turning a coordinate into a place name in a journal that keeps one (the Travel edition, or a journal you built with the Place companion). Those requests carry a coordinate rounded to about a kilometre and nothing else, no name, no email, and nothing you wrote.
What emails will Innerholm send me?
Account emails (confirmation, password reset, and security notices) are always on, because the account cannot work without them. So are billing notices: if you subscribe to Innerholm+ on a yearly plan we write about a month before it renews, and if the price ever changes we write at least 30 days before the new price applies. Everything else can be silenced with one click: writing reminders you schedule yourself, the periodic companion note for journals where you chose inbox delivery, four short getting-started notes across your first two weeks, and the prompt pack with its two follow-up notes if you request it on the site. Unsubscribing is honoured immediately and permanently. Your journal entries are never included in any email; the companion note contains only its own short reflection and the name of the journal. If you request the prompt pack, we store your email address, the topic you chose, and a salted one-way hash of your IP address to prevent abuse; that list is separate from any account and has its own unsubscribe link.
Where is my data stored?
Innerholm is a Canadian service, but the app runs on Microsoft Azure cloud infrastructure with servers located in the United States. That means your journal data is processed and stored in the US, where it can be subject to US law (including lawful access requests by US authorities) in the same way it is subject to Canadian law here at home. We chose a provider with strong security and contractual data-protection commitments, and your data is encrypted in transit and at rest wherever it lives.
How is my data secured?
Your data is protected by a combination of technical and organizational safeguards. Technically: every request runs over HTTPS (encrypted in transit), the database and its backups are encrypted at rest, secrets live in a managed key vault rather than in code, and the authentication cookie is encrypted and HttpOnly. Organizationally: access to production systems is credential-gated and limited to the few people who operate the service, no one is permitted to read your entries, and every infrastructure provider operates under a data processing agreement. No system is perfectly secure, but these are the measures we take to guard your journal against unauthorized access, use, or disclosure.
What happens to my writing if something fails?
Your last entry is at most 12 minutes from durable. Innerholm runs on Azure SQL, which takes a transaction log backup every 5 to 12 minutes, so if something catastrophic happened to our infrastructure we could restore to within that window. Seven days of point-in-time restore history are always available. Photos are stored with three local copies and a 14-day soft-delete window, so an accidental deletion is recoverable for two weeks.
What happens if there is a data breach?
If we ever discover a security breach that creates a real risk of significant harm to you, we will notify you and the relevant privacy authorities as required by law, without unnecessary delay. The notice will tell you what happened, what data was involved, and what steps you can take. We would rather over-communicate about a security incident than leave you guessing.
How do I export my data?
Open Export in the journal sidebar and download everything. Two formats: a Markdown ZIP (one .md file per entry, foldered by journal, with YAML frontmatter for title, date, journal, starred and tags, and your inline images alongside) and a Day One-compatible ZIP that imports straight into Day One. Both are free and included with every account, with no upgrade. End-to-end encrypted journals export as Markdown from inside the unlocked journal, because our servers cannot read them. Your words are yours to take.
Can I see and correct the data Innerholm holds about me?
Yes. You have the right to ask for a copy of the personal information we hold about you and to ask us to correct anything that is inaccurate, such as your email or account details. Most of your data is already under your direct control: entries, tags, mood, weather, and settings are editable or deletable in the app at any time. For anything you cannot change yourself, contact our Privacy Officer (below) and we will respond within 30 days. A full copy of your entries is covered by data export, above.
What cookies does Innerholm use?
One, for the app itself. Innerholm sets a single authentication cookie when you sign in. It is an encrypted, HttpOnly cookie that tells the server you are logged in (HttpOnly means browser scripts cannot read it). It contains no personal data beyond your account identifier. A few others exist for specific jobs, and none of them track you: signing in with Google sets two short-lived cookies that complete the handshake and expire right after; turning on a second key (two-step sign-in) sets one that remembers this device so you are not challenged every time; and the network provider that sits in front of the site sets a bot-protection cookie. There are no advertising pixels, no third-party analytics scripts, and no browser fingerprinting. The app also keeps a small amount of housekeeping data in your browser storage: your language, cached interface state, your signup source if you arrived through a tagged link, and the random identifier described under analytics below. When you sign out, the cookie is cleared.
What analytics does Innerholm collect?
Two kinds, both first-party and both minimal. Basic visitor analytics record which pages are viewed, which features are used (event names only, such as entry created), and basic error reports, tied to a random identifier stored in your browser rather than to your name. Visitors in the EU, UK, and Switzerland are not counted unless they choose to allow it: nothing is sent while the choice is unmade, and declining means nothing is sent at all. Your browser applies that rule before it sends anything, and our server applies it again before recording anything, so it holds even if something goes wrong in between. One caveat we would rather state than gloss: if you go on to create an account and turn on Usage Analytics, the events already recorded against that browser identifier are joined to your account. With the setting off, which is the default, they are never joined. Account usage telemetry is off by default and collected only if you turn on Usage Analytics in Settings. Neither kind ever includes journal content, both go only to our own monitoring infrastructure (Microsoft Azure), and we use no third-party analytics services.
What happens if Innerholm receives a legal request for my data?
We comply with valid legal orders (court orders, subpoenas, or government requests) but only to the minimum extent required by law. We will notify you before producing your data unless we are legally prohibited from doing so. We push back on requests that are overly broad or improper. We do not cooperate with voluntary government surveillance programs.
Who can use Innerholm?
Innerholm is for adults 18 and older. Journal content is personal and sensitive by nature, and we believe that warrants an adult-only service. We do not knowingly collect personal data from anyone under 18. If we discover a user is under 18, we will delete their account and all associated data immediately.
How will I know if this policy changes?
If we make a material change to how your data is collected or used, we will email you at least 30 days before it takes effect. You will have time to export your data and delete your account before any change applies. We will never retroactively apply new data practices to data already collected. Minor clarifications that do not change actual practice will be updated without notice.
Who do I contact about privacy?
Innerholm has a designated Privacy Officer responsible for how we handle your personal information and for our compliance with applicable privacy law. For any privacy question, access or correction request, or concern about how your data is handled, email our Privacy Officer at [email protected]. We aim to respond within 30 days. If you are in Canada and are not satisfied with our response, you also have the right to raise the matter with your provincial privacy regulator or the Office of the Privacy Commissioner of Canada.