How Private Vault Works

There's a switch in Hearth's settings that fires us.

Not from keeping your journal safe — we still do that. It fires us from any possibility of ever reading it. It's called Private Vault, it's free on every plan, and it's the most important switch in the app. So let's walk through what it actually does, spare key by spare key.

First, how the default works

Every entry you write is encrypted before it's stored. Always, on every plan, no setting required. What sits on our servers is a locked box.

But by default, Hearth keeps one sealed spare copy of the key to that box. It exists for exactly two reasons:

So signing in opens your journal. No passphrase to memorize, no losing ten years of writing because a string of words you invented in March has evaporated. You prove it's you, your journal opens.
So the AI can answer you. When you ask Inkling what you were stressed about last spring, or ask through ChatGPT or Claude, the spare briefly opens the entries needed to answer — in the moment, in memory — and then everything decrypted is dropped. Nothing readable is ever stored or logged, and that rule is enforced by tests in our own codebase, not by good intentions. (Every glance burns after reading — the full story is here.)

So the default promise is: we don't read your journal. Said plainly, tested constantly, no fine print. But notice the verb. It's a don't. And for some people, for some writing, a don't isn't enough.

The switch

Flip on Private Vault and three things happen.

You set a passphrase. Your journal's key gets locked to that passphrase instead of to your sign-in. And our sealed spare is deleted. Not archived, not moved to a slower drawer. Destroyed.

From that moment, "we can't read your journal" is literally true. Not policy — math. There is no key on our side to misuse, no key to leak in a breach, no key to hand a court, no key for a future owner of the company to get creative with. We hold scrambled boxes and nothing else, forever.

What it costs you

Honesty is the house style, so here's the bill:

The AI goes quiet. Inkling's memory, ask-your-journal from ChatGPT or Claude — all of it stops, because answering requires reading and reading is now impossible. On our side there is nothing left that can open an entry.
We can't rescue you. Lose your passphrase and your recovery key, and your journal is gone. Actually gone. Unrecoverable by design, because the wall that keeps us out doesn't care that you're crying on the other side of it. We can't make exceptions. That's what makes it a wall.

The recovery-key ceremony

Because of that second cost, flipping the switch comes with a small ceremony, and we'd like you to take it seriously.

When you set your passphrase, Hearth generates a recovery key — one long, boring string of characters. You save it somewhere real: a password manager, a piece of paper in the place you keep your passport. Then you confirm you've done it. That recovery key is the only spare in existence now, and it's yours. We never see it, and we couldn't regenerate it if you begged.

Two keys, both in your hands, zero in ours. That's the whole arrangement.

Who should flip it

If the idea of anyone holding a spare key — however sealed, however tested — keeps a small editor perched on your shoulder while you write, flip it. If you're writing things that could genuinely cost you something, flip it. If you just want the certainty, the kind you can't get from any promise, flip it. It's free, and it's the strongest privacy we know how to build.

And if you'd rather never face a lost-passphrase cliff, and you like a journal that remembers things for you? The default is an honest place to live too. We don't read it, we can prove we don't, and the switch will still be there whenever you want don't upgraded to can't.

It's your journal. We just made it possible to lock us out of it.