Skip to content
Graphophone

Privacy policy

Privacy

Last updated: 2026-10-14.

In plain words

We don't have your journal.

That's the short version. The long version is below. It is unusually short for a privacy policy because the company has unusually little data about you.

The seven invariants

Every feature in Graphophone is gated by these rules. If we ever break one, we have failed the product.

  1. 01

    The app works fully offline

    Capture, search, and reflection all work on a tiny model that downloads to your device once. That one download comes from huggingface.co, the public host for open model weights — like any file download it shows them the request's IP address, and it carries nothing of yours: no account, no identifier, and not a word of your journal. After it, a network connection is never required.

  2. 02

    Nothing leaves the device unless you opt in

    Opt-in is per-feature, not a global toggle. Turning on cloud Q&A doesn't turn on cloud summarisation. Every network call is announced in the UI before it happens.

  3. 03

    If you point it at your own model server

    Graphophone can use an OpenAI-compatible model server you run yourself (Ollama, LM Studio, llama.cpp and similar). This is off until you configure it. While it is configured, the text you are reflecting on — the conversation turns or the entry body, plus any memory facts the reply draws on — is sent to that address so it can generate the reply. If the address is on your own network rather than this device, that traffic is plaintext HTTP on your local network, and the network indicator is lit for the whole call. Entries tagged #private, #medical, #therapy, #confidential or #legal are capped to this device and are refused to a server that leaves it, unless you separately turn on the setting that raises that cap; #no-ai entries are never sent to any model, on the device or off it, and that one cannot be overridden. We operate no server in this path and receive nothing: the address is yours.

  4. 04

    No third-party trackers, ever

    Not on this site, not in the app. No Google Analytics, no Meta Pixel, no Hotjar, no Segment, no Sentry-with-content, no fingerprinting SDK.

  5. 05

    Encryption you can audit

    Argon2id for the passphrase, XChaCha20-Poly1305 for entry titles, bodies, and tags, HKDF-SHA256 for subkeys. Every primitive is a standard, peer-reviewed construction implemented by widely used open-source libraries.

  6. 06

    Lose the passphrase, lose the data

    We cannot recover your journal. This is a feature — if we could recover it, so could someone with a subpoena or a hard drive. Keep the recovery code somewhere safe.

  7. 07

    You own your data, with no friction

    Export the whole vault to plain Markdown with one tap, anytime, free. Lock-in is a non-goal.

Cloud opt-in: what is actually sent

Today, Graphophone's AI runs on your device by default. Bring-your-own-key cloud routing — sending your text to OpenAI or Anthropic — is built in the core but not enabled in the app, so nothing goes to us or to an AI company. The one exception you can switch on yourself is a model server you run, described in invariant 3 above: that text goes to the address you chose and nowhere else. The rest of this section describes how BYOK will work once it ships.

If you supply your own OpenAI or Anthropic API key, requests for the features you have opted in to will be sent directly from your device to that provider's API. We do not proxy or log these calls. Whatever happens between your device and them is governed by their terms.

We strongly recommend reading the chosen provider's data-handling policy. Opt-in is per-feature so you can use the cloud for daily prompts but never for entry bodies, if you prefer.

No advertising

Graphophone shows no advertising, on any tier. There is no ad SDK, no ad server, no ad network, and no remote ad call — so there is no ad impression to profile, and nothing about you is available to an advertiser because no advertiser is involved.

Your rights

Privacy laws like the GDPR and the CCPA give you rights over data a company holds about you — access, portability, correction, deletion, and freedom from profiling. Graphophone satisfies them structurally, because the company holds nothing:

  • Access and portability. Your journal lives on your device, readable in the app at any time, and the whole vault exports to plain Markdown with one tap, free. There is no server copy to request.
  • Correction and deletion. Edit or delete any entry directly. Deleting the vault (or the app) removes everything — there is no account to close and no backend retaining a copy.
  • No profiling, no sale of data. We build no profile of you and have nothing to sell. AI runs on your device by default, and there is no advertising on any tier — so there is no ad request that could carry an identity.
  • The little we may hold. Two things, and only these two. If you email us, we have that email, and we process it to answer you. If you joined the launch list, we have the address you typed into it. We are the data controller for both, and for nothing beyond them. Ask and we will produce, correct or delete either: hello@graphophone.app. Deletion reaches what we hold when your request arrives, so if you ask and we hold nothing, we will say so plainly rather than leave you guessing. We keep support mail until your question is resolved and then no longer than twelve months, and sooner if you ask; a launch-list address stays until you unsubscribe or ask us to delete it.
  • Please don't paste your journal into an email. We don't need it to help you, and email isn't encrypted the way your journal is. If you send it anyway we won't use it for anything but answering you, and it goes when the correspondence goes.
  • How to ask. However you like. There is no form, no portal, and no particular wording required — the address above is just the fastest route. You also have the right to complain to your local data-protection authority. Under the GDPR you can additionally object to or restrict processing; in practice that reaches the support correspondence and the launch list, which is all there is to reach.
  • If you join the launch list. The optional "notify me" form submits the email you type to our mailing-list service at list.graphophone.app, used only to send the one launch email you asked for. It is never linked to your journal (which we can't read) and you can unsubscribe or ask us to delete it any time. Don't submit the form and nothing is collected.
  • If you buy through the web. A web purchase is sold to you by Lemon Squeezy, the merchant of record — it is the seller you contract with, not a processor acting for us. It receives the payment details you enter and handles them under its own privacy policy; we receive only the confirmation needed to mint your redemption code. In-app purchases go through the Apple App Store or Google Play instead, under their policies. Either way, a purchase is never tied to the contents of your journal.

Consumer health data

Some U.S. state laws — Washington's My Health My Data Act, Nevada's SB 370, and Connecticut's health-data amendments — regulate "consumer health data," which can include mental-health information and voice recordings. A journal can contain exactly that. Because your content stays encrypted on your device and is never transmitted to or received by us, we collect, share, and sell no consumer health data. The details, in the specific terms those laws require, are in our dedicated Consumer Health Data Privacy notice.

Crash reports and contact

The app has no crash reporting of any kind — no automatic reports, no opt-in toggle, no stack traces or device data sent anywhere. If something breaks, the only way we hear about it is if you choose to tell us. Contact: hello@graphophone.app.

This page is plain HTML — no analytics, no scripts, no fonts loaded from third parties. Confirm it for yourself: open the developer tools, look at the network tab, refresh. See also our Terms of Service.