Security

Plaintext never reaches storage

Every piece of a journal entry is sealed before it is written. The text you type, the transcript of a voice note, the words recognised from a photographed page, and the metadata attached to each of them are encrypted with AES-256-GCM using Apple’s CryptoKit, and only the sealed bytes are stored.

GCM is an authenticated mode, which matters for a reason beyond secrecy: if a stored value is altered, decryption fails rather than returning wrong-but-plausible text. innerstory treats that failure as a failure. It will tell you a block could not be opened, and it deliberately refuses to let the app overwrite content it could not read — so a decryption problem can never quietly become data loss.

The key is generated on your phone and stays there

One 256-bit master key is generated on first use and stored in the iPhone’s keychain with the accessibility class WhenUnlockedThisDeviceOnly. That class has two consequences worth stating plainly: the key is unreadable while the phone is locked, and it is excluded from backups — including encrypted iTunes and iCloud backups — so it cannot be restored onto a different device.

While the app is locked, the key is not merely unused. It is evicted from memory.

There is no escrow, no recovery service and no copy held by anyone else. This is the point of the design, and it is also the trade-off: nobody can be compelled to hand over a key that does not exist off your device, and equally, nobody can recover your journal for you.

Photos and recordings

Media bytes are encrypted with the same key and written with iOS Complete File Protection, so the files are unreadable while the device is locked — not by the app, and not by anything else on the system.

The filename each block points at is a random identifier that reveals nothing about its contents. Images are stripped of location and camera metadata before they are stored, so a photograph of a notebook page does not quietly record where you were sitting.

The lock fails closed

innerstory starts locked. Only a successful Face ID, Touch ID or passcode authentication moves it to unlocked. Every other outcome — cancellation, a failed match, no biometrics enrolled, no passcode set — relocks the app and evicts the cached key.

There is no “nothing is configured, so let them in” branch. On a device with no passcode at all, the journal correctly refuses to open. That is intentional.

While locked, your content is not hidden behind an overlay — it is not built into the screen at all. When the app becomes inactive, a privacy veil is drawn first, so the card iOS captures for the app switcher shows the app’s name and never a line of your writing.

The analysis is local, and it is encrypted too

The feature that surfaces an earlier passage works by analysing your entries on the device — themes, entities, sentence embeddings, and similarity between passages. All of it runs on your iPhone using frameworks built into iOS.

That derived data is also sealed at rest. Analysis of a journal is at least as sensitive as the journal, and a sentence embedding is invertible enough that it should be treated as the text it came from. So the themes, entities and embeddings are encrypted with the same key as the entries themselves.

None of it is shown to you. innerstory computes what it needs to find a relevant passage, shows you the passage, and stops there. It does not report your mood, label your thinking, or present a summary of what kind of person its analysis thinks you are.

No network connections

Version 1.0 opens no connections. Not on first launch, not for licensing, not for configuration, not for analytics. There is no cloud sync and no CloudKit container. Transcription, handwriting recognition and analysis all run against frameworks already on the device.

This is checkable rather than a promise you have to take on faith: enable airplane mode and use the app. Every feature works. A network privileges monitor will show nothing, because there is nothing to show.

The app also ships an Apple privacy manifest declaring no tracking, no collected data types, and exactly one required-reason API — reading back a preference the app itself wrote.

What this costs you

Two things, and it would be dishonest to bury them.

• There is no backup. Nothing is uploaded, so nothing can be restored. If you lose the phone, the journal is gone. The export in Settings is your only copy — it writes plain text you can keep wherever you like, and you should use it.
• There is no sync. Your journal lives on one device, because the key does.

Reporting a problem

If you believe you have found a security issue, email support@innerstory.app with enough detail to reproduce it. There is no server to attack, so the interesting surface is the device: key handling, the lock, file protection, and anything that could cause plaintext to be written unsealed. Please give us a reasonable window to fix an issue before describing it publicly.

The formal commitments are in the Privacy Policy.