We Don't Sell Your Data — There's Nothing Readable to Sell

"We don't sell your data" might be the cheapest sentence in tech. Everyone says it. It costs nothing to print on a homepage, it's almost impossible to verify, and it quietly leaves the door open to a hundred things that aren't technically selling — sharing, licensing, "partnering," analyzing, training, or simply hanging onto everything until a future owner decides the promise no longer applies.

So we'd like to make a stronger, weirder claim. We don't sell your journal entries, and the reason isn't just our excellent character. It's that there's nothing readable on the shelf. Your entries live on our servers as ciphertext — scrambled boxes — never as text anyone could browse, package, or quietly hand to a partner.

The difference between "won't" and "won't, with receipts"

Most "we don't sell your data" promises are won't promises. The company has your readable data sitting right there, and they're assuring you they choose not to monetize it. Maybe they mean it. But "won't" is a decision, and decisions get revisited — when money's tight, when the company is acquired, when a tempting partnership appears, when the terms get quietly "updated" on a Tuesday.

Here's our version, with the honest details left in. Your entries are encrypted before they reach us and stored as ciphertext, always. By default we do keep one sealed spare key — it opens your journal when you sign in, and it lets the AI answer questions you ask, and that's the entire list. Nothing decrypted is ever stored, logged, or used to train anything, and that rule is enforced by tests in our codebase that fail the build if anyone breaks it. (The machinery, in detail.) So there's no pile of readable diaries anywhere in the building. There never is one, not even for a minute.

And if "tested and disclosed" still isn't enough, Private Vault deletes the spare key entirely. In that mode we couldn't read your journal if we tried, which means we couldn't sell it, share it, analyze it, or train on it if we tried either. That promise depends on math, and math doesn't get acquired.

"If it's free, you're the product" — so how do we eat?

Fair question, and a healthy instinct. The reason so many apps end up monetizing your data is that "free" has to get paid for somehow, and if you're not paying with money, the bill often gets settled with your information.

We dodge that by just... charging money. Hearth has a free tier that's genuinely useful, and paid tiers for people who want more. People pay us for the product, the way you'd pay for a notebook or a nice pen. That's the whole business model. No ads, no data brokering, no "free" tier secretly funded by selling the contents of your soul to advertisers. You're the customer, not the inventory.

It's almost retro. You give us money, we give you a good journal, nobody's diary gets auctioned. We think the old arrangement was underrated.

What we genuinely can and can't see

We don't believe in vague reassurance, so here's the honest line. We can see the boring operational stuff any service sees — that an account exists, that it's on the free or paid tier, roughly when it last synced, the size of the encrypted blobs we're storing. We need that to keep the lights on and the bills paid.

What we don't see is the thing that matters: the words you write. Entries, unsent letters, future-me notes — all of it is locked before it leaves your device and stored locked. The only moments anything is ever readable on our side are the ones you cause — signing in, or asking the AI a question — and those are transient, kept nowhere, and covered by the tests above. In Private Vault, even those moments stop existing. The valuable, private, sellable part is exactly the part that never sits anywhere.

Why this is the version we wanted

Anyone can promise not to sell your data. We wanted an arrangement you don't have to take on faith: nothing readable ever at rest, a no-reading rule our own build fails without, and a free switch that removes our access altogether — so selling your data isn't a temptation we're nobly resisting, it's a shelf that's empty by construction.

"We don't sell your data" is fine. "There's nothing readable to sell, and here's how you can check" is the one we actually trust — and it's the only one we were willing to put our name on.