The working copy stays on a device
This reduces routine cloud exposure. It does not stop someone using an unlocked device or browser profile, malicious software, or accidental loss when browser data is cleared.
plain-language threat model
“Private” needs a complete sentence.
Private from whom? On which device? Before or after sync? With whose key? Use seven questions to turn a reassuring label into a system you can evaluate.
01 / vocabulary
Six labels that solve different problems.
None is a complete privacy claim on its own.
The network path is protected
HTTPS protects data while it moves between device and service. The service may still receive readable content at either end.
The provider encrypts stored infrastructure
Useful against lost drives and some storage-layer incidents. The provider generally keeps the ability to decrypt.
Content leaves the device in encrypted form
Ask who holds the recovery key, whether the provider can obtain it, and what happens if the user loses it.
A barrier on an already running device
Biometric, PIN, or passcode locks help with casual device access. They do not replace storage encryption, a safe device passcode, or operating-system security.
A usable way to leave
A text export without its photos is not a complete visual journal. Test whether media, dates, notes, and structured context survive outside the app.
02 / worksheet
Ask seven questions.
Copy this into a note and answer it for any app before committing sensitive photos.
Private visual journal review
A product-agnostic threat-model worksheet.
PRIVATE VISUAL JOURNAL REVIEW 1. Where does the first copy of every photo and note live? 2. Exactly what leaves the device, and which action sends it? 3. Is cloud content encrypted before upload? Who can obtain the decryption key? 4. What readable metadata remains: dates, counts, sizes, categories, location, account, billing? 5. What protects the journal on an unlocked device or browser profile? 6. Does export include every photo, note, date, and structured field in a usable format? 7. How are local data, cloud data, analytics, account records, and billing records deleted? My priority threat: My accepted trade-off: My recovery plan: Date I verified the answers:
03 / photo hygiene
The app is only one layer.
Visual privacy begins before a file reaches the journal.
Frame out identifiers
Check mirrors, mail, badges, screens, medication labels, house numbers, distinctive windows, and other people before capture.
Review location behavior
Know whether the camera embeds location metadata and whether the journal preserves, reads, strips, or exports it. Do not assume screenshots or social shares behave the same way.
Separate sharing from storage
A private original and a shared recap are different artifacts. Share only the selected moment and preview the final file before sending.
Protect the recovery path
An encrypted backup is only as recoverable as its key. Keep the key separately from the device, and understand that a provider without the key may be unable to help if you lose it.
Test deletion by layer
Deleting an entry, a cloud backup, an account, analytics records, and payment records are separate operations. A privacy page should say which party controls each one.
04 / case study
jurn.ee’s current data map.
Published for scrutiny, not as a claim that any system is risk-free.
| Action | Journal content | What jurn.ee receives | Key limit |
|---|---|---|---|
| Normal meal, workout, or body entry | Saved on the current device in the browser. | jurn.ee does not receive the photo or note when the entry is saved. | This is not an app lock. Someone using the unlocked device or browser profile may be able to open the journal, and clearing site data can remove it. |
| Meal scan | A reduced-size copy of the meal photo is sent to create an editable receipt. | The configured scanning service receives that image. Body and workout photos are not sent through this feature. | Do not use meal scan for a photo you do not want the scanning service to receive. |
| Downloaded backup | The downloaded backup includes journal entries, templates, and photos. | The file is prepared on the device. Downloading it does not send the journal to jurn.ee. | The downloaded file is readable. Store it in a protected location. |
| Plus encrypted backup | Journal content is encrypted on the device before upload. | jurn.ee receives the encrypted backup and the limited information needed to store and restore it. | Only someone with the recovery key can open the backup. jurn.ee cannot recover a lost key, and this feature has not undergone a published independent security audit. |
| Purchase and access restore | Journal photos and entries are not sent to the payment provider. | The provider receives the purchase and account details needed to complete payment and restore paid access. | The payment provider may keep billing records under its own legal obligations. |
| Product usage measurement | Journal photos and notes are not included. | jurn.ee receives limited signals about which product features are used. | Feature-use information can still describe behavior. |
05 / realistic threats
What the design does—and does not—cover.
Designed to reduce
- Routine server possession of normal journal photos and notes.
- Readable journal content in the optional cloud backup when storage is accessed without the sync key.
- Accidental partial exports that silently omit a referenced photo.
- Public purchase-email enumeration during restore.
Not designed to defeat
- Someone who can use the unlocked device and browser profile.
- Malicious software or a compromised app running where the journal is open.
- A user sharing the original photo, readable backup, or recovery key with the wrong person.
- Loss of the only local copy before a usable backup exists.
- Every legal demand, compromised device, or unknown implementation flaw.
Why say this plainly?
OWASP recommends starting cryptographic storage design with a threat model and minimizing sensitive storage. The FTC similarly advises services to collect only what they need. A privacy promise is stronger when its boundary is visible.
06 / sources
Further reading.
- OWASP Cryptographic Storage Cheat Sheet — threat models, sensitive-data minimization, algorithms, and key separation.
- FTC: Protecting Personal Information — collect and keep only what the product needs.
- jurn.ee privacy notice — current product-specific processing, support, retention, and deletion details.
compare the answers
Open the app matrix