Built with serious privacy standards

We use the same security principles that protect healthcare data. Here's exactly what that means for your journal.

Transparency First

Let's talk about what this actually means

No jargon, no fine print games. Just honest answers about how we protect your words.

01

First, a quick HIPAA primer

HIPAA is a U.S. law that tells hospitals, insurers, and their partners how to protect patient data. Daylogue isn't a healthcare company. We're a personal journaling app. But that doesn't mean we take privacy any less seriously.

02

Why we say "HIPAA-aligned"

We built our security using the same technical standards that protect medical records. TLS on everything in transit. Per-user access controls and row-level security in the database. Entry text is kept out of Daylogue's application logs and error reports. Logging that helps us catch anything unusual. These are real protections, not marketing words.

03

What we're not claiming

There's no official "HIPAA certified" stamp. It doesn't exist. We haven't done a formal HIPAA audit. We don't sign Business Associate Agreements (BAAs). And Daylogue reads your entries to write your narratives and surface your patterns. That is how the product works, and we would rather say so than imply otherwise.

04

Why we're telling you all this

Most apps bury this stuff in legal documents. We think you deserve better. Your journal holds real thoughts and real feelings. You should know exactly how we protect them. Not because the law requires it, but because it's the right thing to do.

The Technical Details

How we actually protect your data

For the security-minded folks who want specifics.

Access Controls

Every row in the database is scoped to one user ID, enforced by row-level security. Your account can only reach your own data.

Log Redaction

Entry text is kept out of Daylogue's application logs and error reports.

Integrity Controls

Vault entries carry an AES-256-GCM authentication tag. If the stored ciphertext is altered by a single byte, decryption fails rather than returning something wrong.

Transmission Security

TLS encrypts everything moving between your device and our servers, with HSTS enforced so the browser will not fall back to plain HTTP.

Storage

Most entries are stored in readable form, protected by per-user access controls. Where an account has an encryption key, vault entries are stored as AES-256-GCM ciphertext under a key wrapped with PBKDF2-SHA256 at 600,000 iterations. That is not a guarantee that we can never decrypt them.

Authentication

Sign in with an email and password, or with Google or Apple. Email addresses are verified before an account is active.

All safeguards actively protecting your data

The honest details

A few things worth knowing before you dive in.

Daylogue is a personal journal. It's for you, about you, owned by you.
Daylogue does not run emotion recognition on your face or on the tone of your voice. It works only from what you choose to share.
We don't offer Business Associate Agreements (BAAs) at this time.
If you work in healthcare and want to use this professionally, check with your compliance team first.

Work in healthcare?

You're welcome here for personal journaling. But if you're thinking about using Daylogue for anything work-related, talk to your compliance team first. We built this for personal reflection, not clinical notes or patient information.

We don't offer BAAs, so we can't meet the formal requirements your organization might need.

Questions?

Still have questions?

We're happy to get into the details. Security nerds welcome.