Privacy Policy
Last updated: 4 August 2026
Just Journal Limited ("we", "us", "our") operates the Just Journal website at justjournal.io and the Just Journal iOS application (together, "the Service").
This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have over it. We have tried to write it in plain English rather than legal boilerplate, because you should be able to understand what happens to your data without a law degree.
We are registered with the UK Information Commissioner's Office. ICO registration number: ZC156656.
Who we are
Data controller: Just Journal Limited, a company registered in England and Wales.
Contact: hello@justjournal.io
If you have any question about this policy or about your data, email us at that address and a person will reply.
What we collect
Information you give us
Your email address
Required to create an account, sign in, and receive your journal entries.
Your journal recordings
When you record a session, the audio is transmitted to our servers so it can be transcribed and turned into a written entry.
Your journal entries
The written entries generated from your recordings, plus any edits you make to them.
Payment information
If you subscribe, payment is processed by Stripe. We never see or store your card details — Stripe handles this entirely. We store only a customer reference and your subscription status.
Your notification preference
The time of day you have chosen to receive a daily reminder, if you set one.
Information collected automatically
Usage data
Your current streak, longest streak, total number of entries, and the date of your last entry. This powers the streak features and reminders.
Technical data
Basic technical information necessary to operate the Service, including error logs when something goes wrong.
What we do not collect
Personal identifiers
We do not collect your name, address, date of birth, phone number, or any other identifying information beyond your email address.
Advertising trackers
We do not use advertising trackers. We use Google Analytics on our website to understand how people find and use Just Journal in aggregate — this is not used for advertising and we do not sell or share this data.
What happens to your voice recordings
This matters, so we want to be specific.
When you finish a recording, the audio file is uploaded to our servers and passed to a transcription service to convert it into text. That text is then processed to produce your written journal entry.
The audio file is deleted immediately after processing. We do not keep recordings. There is no archive of your voice. Audio is retained only for the seconds it takes to transcribe it, and files are additionally subject to automatic deletion within 24 hours as a safeguard.
We do not use your voice to train voice models, we do not create voiceprints, and we do not share recordings with anyone.
How your journal entries are stored
Your written entries are encrypted before they are stored, using AWS Key Management Service. The encryption keys are held separately from the database and are never exposed to our application code.
In practice this means that anyone with access to our database — including us — sees only encrypted text, not readable journal entries. Entries are decrypted only when you request them through the app or website, and only for your own account.
Why we process your data, and our legal basis
Under UK GDPR we must have a lawful basis for processing your data. Ours are:
| What we do | Why | Legal basis |
|---|---|---|
| Create and maintain your account | So you can use the Service | Performance of a contract |
| Transcribe recordings and generate entries | This is the core function you signed up for | Performance of a contract |
| Store your entries | So you can access your journal | Performance of a contract |
| Send you your entries by email | So you receive what you created | Performance of a contract |
| Process payments | To provide a paid subscription | Performance of a contract |
| Send weekly summaries | Part of the Service you subscribed to | Performance of a contract |
| Send daily reminders | You asked for them | Consent — you can turn these off at any time |
| Send onboarding and product emails | To help you get value from the Service | Legitimate interests — you can unsubscribe at any time |
| Keep error logs | To fix problems and keep the Service working | Legitimate interests |
Who we share your data with
We use a small number of third-party service providers to operate Just Journal. Each processes data only on our instructions and only for the purpose described.
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Database and authentication | EU |
| Amazon Web Services | Processing, encryption, and temporary audio storage | UK (London) |
| OpenAI | Speech-to-text transcription and search indexing | US |
| Anthropic | Generating your written journal entry from the transcript | US |
| Stripe | Payment processing | US / EU |
| SendGrid | Sending your entries and account emails | US |
| Loops | Onboarding emails | US |
| Google (Google Analytics) | Website usage analytics | US |
Important: we do not sell your data. We do not share it with advertisers. We do not allow any provider to use your journal content to train AI models.
Where data is transferred outside the UK, we rely on appropriate safeguards including Standard Contractual Clauses and, where applicable, adequacy decisions.
How long we keep things
| Data | Retention |
|---|---|
| Voice recordings | Deleted immediately after transcription; automatic deletion within 24 hours as a safeguard |
| Journal entries | Kept until you delete them or close your account |
| Account information | Kept while your account is active |
| After account deletion | All data deleted within 30 days |
| Error logs | 30 days |
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct anything inaccurate — you can edit your entries directly in the app
- Delete your data. You can delete individual entries yourself, or request full account deletion
- Export your data in a portable format
- Object to processing based on legitimate interests
- Withdraw consent for reminders and marketing emails at any time
- Complain to the Information Commissioner's Office if you believe we have handled your data improperly
To exercise any of these rights, email hello@justjournal.io. We will respond within one month.
To complain to the regulator: ico.org.uk or 0303 123 1113.
Deleting your account and data
You can permanently delete your account and all associated data — journal entries, account information, and any recordings — at any time by opening the Just Journal app, going to Account → Delete account, and confirming. This immediately and permanently removes your data. This action cannot be undone.
If you no longer have the app installed, or prefer not to use the in-app option, you can request deletion at justjournal.io/delete-me, or by emailing hello@justjournal.io with the email address associated with your account. We will confirm once your data has been deleted, within 30 days.
Cookies and similar technologies
Essential cookies. The website uses cookies necessary to keep you signed in and to remember a referral code if you arrived via someone's referral link. These are required for the Service to function.
Analytics cookies. We use Google Analytics on our website to understand how visitors find and use Just Journal — for example, which pages people visit and where traffic comes from. This helps us improve the Service. Google Analytics sets cookies on your device and processes data in the United States.
You can opt out of Google Analytics across all websites using Google's browser add-on at tools.google.com/dlpage/gaoptout.
We do not use advertising cookies and we do not allow Google to use this data for advertising purposes.
The iOS app does not use Google Analytics or any analytics cookies. It stores only your session and a local cache of your recent entries on your device, so the app opens quickly. This stays on your device.
Your cookie choices
You can change your cookie preferences at any time.
Children
Just Journal is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
Security
We take the following measures to protect your data:
- Journal entries encrypted at rest using AWS KMS
- All data transmitted over encrypted connections (HTTPS/TLS)
- Voice recordings deleted immediately after processing
- Database access restricted and authenticated
- Row-level security ensuring you can only access your own data
No system is perfectly secure, but we have designed Just Journal so that even a breach of our database would not expose readable journal entries.
Changes to this policy
If we make material changes to this policy, we will notify you by email before they take effect. The "last updated" date at the top always reflects the current version.
Contact
Questions, requests, or concerns:
hello@justjournal.io
Just Journal Limited
Registered with the Information Commissioner's Office
ICO registration number: ZC156656