Frequently asked questions

No. Every entry is encrypted on your device and persists only there. We have no per-user account, no cloud database, and no way to read your writing. Multi-device sync already works and still does not involve us: you point two devices at a folder you already sync — iCloud Drive, Dropbox, a network share — and they exchange sealed files under a key derived from your passphrase. It is in beta, it moves on demand rather than in the background, and the folder provider sees ciphertext only. There is no Graphophone sync service to sign up for, and none is planned.

Yes — completely. Writing, search, mood tracking, and the on-device AI (reflection, summaries, and ask-your-journal) all run with no network connection. After an optional one-time model download, you can put the device in airplane mode and everything still works. The only time the app touches the network is for things you explicitly opt into — and a banner tells you whenever it does.

Only if you set that up. Out of the box the AI runs on your device and makes no network AI calls at all. You can point it at a model server you run yourself (Ollama, LM Studio) on your own machine or network — then the conversation goes to that machine, and entries tagged #private, #medical, #therapy, #confidential or #legal stay behind unless you opt those in too. An entry tagged #no-ai is never sent to any model either way. Folder sync is a separate opt-in again, and it goes to a folder you choose rather than to us. Any future cloud feature will be its own opt-in you can revoke independently; none is enabled until you turn it on. When the app is in the middle of a network call — for *any* reason — a banner at the top of the screen tells you.

Three ways, all on your device by default: instant keyword search with operators (exact phrases, exclusions, and tag filters); semantic “find by meaning” that surfaces related entries even when you don’t remember the exact words; and “ask your journal”, which answers a natural-language question from your own entries with tappable citations. Entries you tag no-AI are never used by the meaning-based ones.

Because it has to download quickly and run on a four-year-old phone. The app picks the largest free model your device can comfortably run: a 1.5B on 4 GB+ phones and a compact 0.5B on the most memory-constrained ones — downloaded once on first run. With Graphophone Depth it recommends a 4B Qwen 3 on 8 GB+ phones, and 16 GB+ desktops can opt up to 7B. More capability is on the roadmap: further downloadable larger models and bring-your-own-key cloud are planned, both opt-in and never the default. By default every reflection runs on this device; the one network AI path that ships today is a model server you run yourself, and it is off until you set it up.

Two ways, and the second one catches people out. First: if you lose both your passphrase and your recovery code, your entries are unrecoverable. We treat that as a feature — we cannot reset a password we cannot read — so store the recovery code in a password manager when you create your vault. Second, and far more likely: Graphophone deliberately keeps its vault out of your device's own backup, so setting up a new device from an iCloud or Google backup will not bring your journal across. That is what stops a copy of your journal landing somewhere we cannot defend, and the cost is that you have to carry it yourself. Make an encrypted .ajbackup before you change, wipe, or sell a device.

The app produces a single encrypted .ajbackup file you can store anywhere — iCloud Drive, a USB stick, your home server. The file is encrypted under a passphrase you choose; restoring on a new device works with that passphrase plus a fresh vault passphrase.

A separate passphrase opens a parallel, benign-looking vault on the same device. It unlocks through the same field with no difference in behaviour, and the app itself cannot tell whether a decoy has been set — so surrendering the decoy passphrase under coercion reveals nothing of what your real journal holds. One limit is worth knowing before you rely on it: encryption hides what files contain, not how large they are. Both vault slots are always present on disk, and someone who can list the data directory can compare them and see that one holds far more than the other. Decoy mode conceals what your real journal says, not that you have one. Our threat model sets out this residual and the other open side channels in full.

A single confirmed action that hard-deletes every vault file, attachment blob, and entitlement record on the device. The recovery code is the only path back — and only if you set one up earlier and stored it elsewhere.

No advertising, on any tier. Paying for Graphophone Depth — a one-time Lifetime Pass, or a monthly or yearly subscription (price set by the store) — adds bigger on-device models, a year of history in Insights, hands-free conversation, your own model server, and an automatic weekly read. The whole core is free either way. We do not collect telemetry. We do not sell or share data.