Journaling · Privacy guide
What an encrypted journal app actually means: an honest 2026 guide
Every journaling app claims to be private, and “encrypted” is the word they reach for. It means three different things depending on who is talking, and the differences decide who can read your journal, who can lose it, and who can lock you out of it. This guide separates the meanings, then states exactly where Mind Marshal is strong and where it is not.
The three meanings of “encrypted journal”
When a journaling app says encrypted, it is claiming one of three things. End-to-end encrypted cloud sync — the model Day One and Journey use — means your entries travel to the vendor’s servers encrypted with keys the vendor cannot read. That is genuine protection against the company and against breaches of its database, and it is what makes multi-device sync possible. Local-first storage means the journal never leaves your device in the first place; there is no vendor copy to breach, subpoena, or lose, and the encryption question moves to your disk and your backups. Encryption at rest means the file on your own machine is unreadable without a key — usually a job for the operating system’s full-disk encryption rather than the app. An honest comparison starts by asking which of the three an app actually offers, because they solve different threats.
Mind Marshal’s model: nothing to decrypt because nothing leaves
Mind Marshal is local-first. Your journal, notes, tasks, and databases live in one SQLite file on your machine. There is no product account, no analytics, telemetry, or crash-reporting SDK, and ordinary writing, planning, search, and databases work fully offline. Content leaves the device only for services you deliberately invoke: an AI provider you configure, the one-way Slack or Discord capture integrations, the signed update feed, or periodic license-token refresh. If you never configure those, nothing ever leaves. Against the threats most people actually mean by “private journal” — the vendor reading entries, a breach of the vendor’s cloud, an account being banned or a service shutting down — this is a stronger answer than any encrypted cloud, because there is no cloud copy to protect.
The honest limitation: the live file is not encrypted at rest
Here is the part most marketing pages skip, and ours will not: the live Mind Marshal workspace file is a plain SQLite file. It is not encrypted at rest, and we will not call it encrypted. Anyone with unlocked access to your computer — a stolen and unlocked laptop, another user on the machine, malware running as you — could read it. The practical fix is the one security professionals use for every other document on the disk: turn on full-disk encryption. That is FileVault on macOS, BitLocker or device encryption on Windows, and LUKS on most Linux distributions. With the disk encrypted, the workspace is protected at rest the same way everything else you own is. The trade-off is deliberate and worth stating: keeping the live file plain means your journal stays readable and exportable forever, with ordinary tools, long after any app — including ours — is gone.
Encrypted backups you actually hold
Where Mind Marshal does encrypt is the backup path, and the specs are public and specific. An encrypted backup takes the SQLite bytes and encrypts them with AES-256-GCM with a 16-byte authentication tag, so tampering is detected rather than silently restored. Every backup gets a fresh random salt and a fresh random nonce, so two backups of the same workspace share nothing an attacker could correlate. The key is derived from a passphrase you choose with Argon2id (19 MiB of memory, 2 passes), the current memory-hard standard for passphrase-based keys. You decide where backups live — an external drive, a synced folder, a safe — and no one, including us, can reset a forgotten passphrase. The features page describes the backup flow in the product.
No lock-in, by construction
Encryption claims are also exit claims. A journal you can never leave is a journal you do not fully own, whatever cipher guards it. Mind Marshal imports and exports Markdown, and the workspace itself is an ordinary SQLite file you can copy, back up, and inspect. Leaving is a file operation, not an export request. That matters most in the encryption conversation: end-to-end encrypted cloud journals can only be read through the vendor’s app, so the exit path — typically a PDF, JSON, or plain-text export — deserves a test before you commit years of entries, exactly as our guide to choosing a journaling app recommends.
When a cloud E2EE journal is the better fit
The same honesty applies in the other direction. Choose an end-to-end encrypted cloud journal — Day One or Journey are the serious options — if you journal on a phone or tablet, need your entries to appear on every device without maintaining anything yourself, or want to share a journal with someone. Mind Marshal has no mobile apps and no sync service, and pretending a desktop-only local workspace covers those needs would waste your time. The Day One and Journey comparisons go deeper. Choose Mind Marshal if you journal at a computer, want no account and no vendor copy at all, want encrypted backups under your sole control, and want the journal connected to tasks, databases, and projects. The daily journal workflow shows what that looks like in practice, and the private AI workspace guide covers what happens when you optionally add AI.
Test the privacy model with real entries
A private journal should survive you inspecting it.
The full local workspace is free forever; the 14-day Pro trial adds AI and automation with no email address or payment card. Write real entries, make an encrypted backup, and verify you can read and export everything yourself.