Built with serious privacy standards
We use the same security principles that protect healthcare data. Here's exactly what that means for your journal.
Let's talk about what this actually means
No jargon, no fine print games. Just honest answers about how we protect your words.
First, a quick HIPAA primer
HIPAA is a U.S. law that tells hospitals, insurers, and their partners how to protect patient data. Daylogue isn't a healthcare company. We're a personal journaling app. But that doesn't mean we take privacy any less seriously.
Why we say "HIPAA-aligned"
We built our security using the same technical standards that protect medical records. TLS on everything in transit. Per-user access controls and row-level security in the database. Entry text is kept out of Daylogue's application logs and error reports. Logging that helps us catch anything unusual. These are real protections, not marketing words.
What we're not claiming
There's no official "HIPAA certified" stamp. It doesn't exist. We haven't done a formal HIPAA audit. We don't sign Business Associate Agreements (BAAs). And Daylogue reads your entries to write your narratives and surface your patterns. That is how the product works, and we would rather say so than imply otherwise.
Why we're telling you all this
Most apps bury this stuff in legal documents. We think you deserve better. Your journal holds real thoughts and real feelings. You should know exactly how we protect them. Not because the law requires it, but because it's the right thing to do.
How we actually protect your data
For the security-minded folks who want specifics.
Access Controls
Every row in the database is scoped to one user ID, enforced by row-level security. Your account can only reach your own data.
Log Redaction
Entry text is kept out of Daylogue's application logs and error reports.
Integrity Controls
Vault entries carry an AES-256-GCM authentication tag. If the stored ciphertext is altered by a single byte, decryption fails rather than returning something wrong.
Transmission Security
TLS encrypts everything moving between your device and our servers, with HSTS enforced so the browser will not fall back to plain HTTP.
Storage
Most entries are stored in readable form, protected by per-user access controls. Where an account has an encryption key, vault entries are stored as AES-256-GCM ciphertext under a key wrapped with PBKDF2-SHA256 at 600,000 iterations. That is not a guarantee that we can never decrypt them.
Authentication
Sign in with an email and password, or with Google or Apple. Email addresses are verified before an account is active.
The honest details
A few things worth knowing before you dive in.
Work in healthcare?
You're welcome here for personal journaling. But if you're thinking about using Daylogue for anything work-related, talk to your compliance team first. We built this for personal reflection, not clinical notes or patient information.
We don't offer BAAs, so we can't meet the formal requirements your organization might need.
Still have questions?
We're happy to get into the details. Security nerds welcome.