The Case for a Diary Nobody — Including Us — Can Read

Imagine knowing — not hoping, not assuming, but knowing, with the certainty of a locked door you hold the only key to — that nobody on earth can read what you're about to write. Not a person in your house. Not a hacker. Not the company that made the app. Not a court, not a future buyer, not anyone, ever.

What would you write then?

That question is the whole reason Hearth has a mode called Private Vault, because the honest answer, for most people, is "something quite different from what they write now."

The editor you don't know you have

Here's the thing about privacy that's easy to miss: you don't notice the cost of not having it, because the self-censorship runs in the background, below the level you'd call a decision.

Even in a "private" notebook, some small part of you knows it could be found. The roommate. The partner. The parent who "wasn't snooping." So a quiet editor sits on your shoulder while you write, softening the harsh thing, skipping the shameful thing, phrasing the dangerous thing carefully — just in case. You don't experience this as censorship. You experience it as "that's just what I wrote." But it's a managed version. A version with an audience it's pretending not to have.

The promise of a diary nobody can read is that the editor finally clocks off. And when the editor leaves, what comes out is different. Truer. Messier. More useful. You write the actual thought instead of the presentable cousin of the thought.

Why "private" usually has an asterisk

Most apps that call themselves private mean it the way a diary with a tiny brass lock means it: a gesture, not a guarantee. The data sits readable on a server, protected by a promise not to look and a hope nobody breaks in. (You can test whether yours is like this in about ten seconds.)

That asterisk is enough to keep the shoulder-editor employed. Some part of you knows the privacy is conditional — on the company's good behavior, on no breach ever happening, on the terms never changing — and conditional privacy produces conditional honesty. You can't fully let go while a part of you is still hedging.

A diary nobody can read removes the asterisk. The privacy stops being a promise that could break and becomes a property of how the thing is built.

Here's how that looks at Hearth, honestly. Every entry is encrypted before it's stored — always, on every plan. By default we keep one sealed spare key, so signing in opens your journal and the AI can answer questions you ask; we don't read anything with it, and our own tests enforce that. That's a strong don't. But a don't still has a faint shadow of the asterisk. So there's Private Vault: flip it on, set a passphrase, and our spare key is deleted. From then on your words are locked with keys only you hold, we store scrambled boxes we can't open, and there's no "we won't look" left to trust — because there's no looking available to anyone.

What it's actually for

People sometimes hear all this and think it sounds paranoid. Why would a normal person need military-grade privacy for their feelings about a Tuesday?

But it was never about hiding from spies. It's about the quality of your own honesty. The unsent rage at someone you love. The fear you'd be embarrassed to say out loud. The half-formed thought that might be terrible or might be the truest thing you've realized all year. The petty, the shameful, the tender, the unresolved. That material is exactly where journaling does its best work — and it's exactly the material the shoulder-editor strangles when there's any doubt about who's watching.

Real privacy isn't a luxury feature bolted onto a diary. It's the precondition for the diary working at all. A journal you don't fully trust gets a guarded, performed version of you, which is the one thing a journal was supposed to free you from.

So: a diary nobody can read, including us — one switch away, free, on every plan. Not as a brag about encryption. As the thing that lets you finally write the true version, because you know, for certain, that it's safe to.