Privacy Policy

Last updated: 29 September 2026

1. Who we are

Hearth is a gratitude-journal app that runs in any browser and installs to your home screen on iPhone and Android. This policy explains what information Hearth handles and the choices you have. If anything here is unclear, contact us at support@hearthgratitudejournal.com. Hearth is currently operated by an individual in the United States; we are in the process of forming a registered business entity and will publish its legal name and a postal address here once that is complete.

2. What we collect — and what we don't

Your gratitude entries

Your entries (text, optional photos, optional voice transcriptions, mood) are stored on your device using your browser's local storage. By default they never leave your device. We cannot read them. One exception, and only when you choose it: speech-to-text is done by your browser's or phone's own online speech service (for example Google, Apple or Microsoft), which hears the audio to write it out. Hearth asks before the first use and never receives the audio itself.

On your device, Hearth keeps an index of your photos, and each photo’s row in that index is filed under the photo’s own fingerprint (its SHA-256, the same one Hearth uses to spot duplicates). When your journal is encrypted, everything else in the row is sealed under your journal key, but that fingerprint is not. So someone who has your unlocked phone or browser, or a copy of its storage, could tell how many photos you have and whether a picture they already hold is one of them — never the picture, the entry or the date. Our servers never see this fingerprint. Hearth accepts this small risk rather than risk losing photos by re-filing every row.

If you create an account (optional)

An account is entirely optional — Hearth works fully without one. If you create one, we store the information needed to sign you in:

• Your email address;
• A securely hashed password (we never store your password in readable form);
• An optional display name.

Registering an email address that already has an account gets a different answer from registering a new one — a new address signs in at once — so someone can find out whether an address is registered with Hearth. We limit how often that answer can be asked for, but we do not hide it; closing it completely would need every new address to be confirmed by email first, which Hearth does not do yet.

If you turn on cloud sync (optional)

Cloud sync is end-to-end encrypted and requires your on-device encryption passphrase to be set up first. Before anything leaves your device, each entry — its text, photos, moods, names, whether it uses text formatting, and even its timestamps — is encrypted on your device with a key only your passphrase (or recovery phrase) can open. What our server stores is unreadable ciphertext plus the bookkeeping sync needs: an edit counter, which app version's format it was saved in (so an older phone that hasn't updated yet can never overwrite what a newer one wrote), whether an entry is deleted, its encrypted size, and when it was last uploaded (not when you wrote it). We cannot read what you wrote and the dates inside your entries are encrypted too. You can turn sync off at any time; your local copy is never affected.

One limit on how changes to your key are guarded: a journal set up in an early version of Hearth, before key fingerprints existed, has nothing to check a change against, so its check is set the first time that account is unlocked on this version. Until that first unlock, someone who knew only your account password could set it first. If you began journaling with Hearth early on, open the app and unlock your journal once.

If you keep photos and recordings in the cloud (optional)

With sync on, photos and recordings travel as their own files, separate from your entries. Each one is encrypted on your device first, then stored as unreadable ciphertext with two independent storage providers: a main copy and a backup copy, each under a random name. To run this, our server keeps a ledger: which account a file belongs to, an identifier made with your own key (it cannot be matched to the photo), which of three sizes it is (a small preview, a full view, or the original — a recording only ever has the original, so this can tell a photo from a recording, never what is in either), its size, whether each copy exists, and when each copy was stored. While Hearth is shrinking a file to save space, the ledger briefly also holds the smaller copy's own size and when that started, until the swap finishes; and if a storage provider fails to remove something Hearth has already asked to delete, its (equally unreadable) name is kept in a short retry queue until every provider confirms it is gone. It never holds the key, so neither we nor the storage providers can open your photos. Your device talks to these two providers directly to upload and fetch the encrypted files, so — like any website you visit — each one sees your device's internet address and the time and size of each file it stores or serves, under its own logging and retention policy, but never what the file shows. "Delete forever" asks both storage providers to remove every copy, including any older version a provider's own backup system keeps internally — we ask for it to be removed right away, though exactly how fast a provider's own infrastructure finishes purging it is outside our control. Deleting your account does the same for everything you had stored. We will name both storage providers here before cloud photo storage is switched on.

Two limits, until Hearth’s planned follow-ups are built. First, the exact size of each stored file is visible to the storage providers and in our ledger, so someone who already holds a copy of a particular photo could match its size and tell that your account stored it — never the photo itself or the entry; Hearth plans to pad new files so that exact sizes stop giving this away. Second, Hearth does not yet check that each provider still holds every file, so a copy that a provider loses or damages is not noticed or repaired automatically.

If you subscribe to Hearth Premium (optional)

Payments are handled by Stripe; we never see or store your card number. We keep your Stripe customer and subscription identifiers, the subscription's status and renewal date (and, if you've cancelled but are still inside a period you already paid for, the date it actually ends), and how many 100 MB storage units your plan currently includes. To bill storage beyond what is included, we keep, for each billing month, the most encrypted cloud storage your account used: a number of bytes, never content, kept for about a year. Stripe keeps what it needs to take payments and send receipts, under its own privacy policy.

What we can see about accounts (internal only)

To run the service responsibly, we look at simple aggregate counts that our servers already hold as part of operating Hearth — for example: how many accounts exist, how many have sync set up, how many signed in or synced in the last 30 days, total encrypted storage used, and how many support tickets are open. These are totals across everyone. They are counts, never content. The admin screen also lists each account: its email, name, tier, how many entries it has synced and how much encrypted storage they use, and when it joined. That is how we run the service and help you when you ask. It never shows the contents of any entry. They are derived from operational records only, are never published or shared, and cannot include your entries — those are end-to-end encrypted and unreadable to us. We use no analytics trackers to produce them, nor any record of what any one person wrote. Our servers also keep short-lived security logs, for 24 hours only, to stop abuse: the internet address of requests to sign in, sync, reset a password, contact support, register, upload or view a cloud photo or recording, change your subscription or tier, or delete your account (and whether a sign-in succeeded — the email typed is kept only as a one-way hash). Messages you send to support are kept, tied to the email you sent them from, so we can answer them and any follow-up; we keep them for up to 24 months and then delete them. Someone who uses Hearth without ever creating an account or contacting us leaves no account, journal, or support record on our servers at all — only the ordinary technical traces any website leaves when a browser loads a page (a short-lived session marker holding no personal content, and our web server's own access log).

What we never collect

• No advertising identifiers, no ad networks, no ad tracking.
• No third-party analytics or behavioural tracking SDKs.
• No selling, renting, or sharing of your personal data with anyone.
• No scanning of your entries by humans or AI.

3. How we use information

We use the limited information above only to: provide the app, sign you in, and (if you enable it) sync your entries across your devices. That's it. We do not build profiles or use your data for advertising.

4. Where your data lives

On your device by default. If you enable sync or create an account, that data is stored on our hosting provider's servers (located in the United States) solely to operate the service. Encrypted photos and recordings you keep in the cloud are held, as ciphertext only, by the two storage providers described in section 2.

Who else touches your data

We use a small number of other companies to run Hearth: our hosting provider (above), Stripe to handle payments if you subscribe, and — once cloud photo storage is switched on — the two storage providers named in section 2. Each one receives only what it needs to do its job (hosting the encrypted database, processing a payment, or storing an encrypted file), and none of them can read your journal entries.

How long we keep it

We keep your account and its synced (still encrypted) entries for as long as the account exists. Deleting your account (section 5) removes the account record, every synced entry, every stored photo and recording at both providers, your sign-in tokens, and your tier history immediately. Support messages are kept for up to 24 months, tied to the email you sent them from, so we can answer follow-ups, and then deleted; a live Stripe subscription is cancelled as part of account deletion, but Stripe's own records of past payments are kept by Stripe under its own policy, since we do not control them.

5. Your rights and choices

• Export anytime. You can export everything you've written to open files (Markdown, JSON, CSV, PDF) from Settings → Data & backups. Your words are never held hostage.
• Use without an account. You are never required to register or go online.
• Delete your account. Settings → Account & sync → Delete cloud account removes your account and every synced entry from our servers, immediately and permanently. Your local copy remains yours. (See our support page for the exact steps.)
• Access, correct, or object. Depending on your region (e.g. GDPR/UK GDPR, CCPA), you may have rights to access, correct, delete, or restrict processing of your personal data. Contact us to exercise them.

6. Security

Connections use HTTPS. Passwords are hashed with a strong algorithm (Argon2id). Accounts are protected against automated guessing, and the app offers an optional passcode lock (a phone's own fingerprint/face unlock, where the device and browser support it, can be used to open that lock — Hearth never receives your biometric data itself, only the device's own yes/no answer). No system is perfectly secure, but we minimise what we hold so there is little to expose. If a breach affecting your personal data or your encrypted entries were to happen, we will notify affected account holders by email without undue delay and follow the notification timelines the law where you live requires.

Do Not Track

We don't use cross-site advertising trackers or behavioural profiling, on Hearth or anywhere else, so there is no tracking for a browser's "Do Not Track" signal to turn off; because of that we don't respond to the signal as its own setting.

In the Android app built for direct install, Hearth checks once a day whether a newer version is available by asking relay.atlaventures.com for a small file; the request carries no account, no entries, no photos and no identifier, and the Play Store build does not do this.

7. Children

Hearth is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their personal information.

8. Changes to this policy

If we make material changes, we will update the date above and, where appropriate, notify you in the app.

9. Contact

Questions or requests: support@hearthgratitudejournal.com.