Journal encryption

Summary

Journal entries are cloud-stored, encrypted at rest with a per-household envelope key. The server can decrypt for AI processing. We publish this model transparently rather than pretending to be zero-knowledge.

Why it matters

Journaling is the most sensitive content in the app — intimate thoughts, marital tension, fertility struggles, postpartum darkness. Users need to trust it deeply.

A pure local-first / zero-knowledge model would break our product: the flow-weekly-reflection-ritual and daily briefings need server-side access to summarize. Pretending we don't have that access would be dishonest; users deserve the truth.

Implications

• Envelope encryption per Household — each Household gets a key stored in KMS; individual entries are encrypted with per-entry keys wrapped by the household key.
• Server-side decryption is possible — for AI summarization (via ephemeral in-memory decryption in Edge Functions), for user-initiated data export, for compliance response.
• Server-side decryption is logged — every decryption event is audit-logged, visible to the user in surface-mobile-settings-privacy.
• AI summaries do NOT leave the AI provider's boundary — Anthropic zero-retention agreements only.
• Private-vs-shared toggle — each journal entry has a visibility: private | shared flag. Private entries are visible only to the author + AI-for-summary; shared entries are visible to both partners + AI. The other partner never sees a private entry, period.
• Deletion is real — user delete removes ciphertext + wraps key; no soft-delete visible to us.
• Data export available in surface-mobile-settings-privacy as decrypted JSON.
• Publish crypto docs — a plain-English privacy explainer in-app + on marketing site.

Related

• household-as-billing-unit — key is per-Household, not per-user
• surface-mobile-settings-privacy — where users see this
• no-medical-advice — trust theme
• voice — how we talk about privacy (honest, plain)

Sources

• Design decision, no external source
• India DPDP Act 2023