What Happens When You Delete Your Diary (With Us: It's Actually Gone)

You tap delete. The entry slides off your screen. Satisfying. Final.

Except a lot of the time, it isn't final at all. The entry just stopped being shown to you. Behind the curtain, it might be sitting in a backup, a "recently deleted" limbo, an analytics pipeline, or a server log, perfectly intact and perfectly readable. Delete, in most software, means "hide." It's a magician's trick. The card's still in the deck.

This matters more for a journal than for almost anything else, because the whole reason you'd delete a diary entry is that you really, genuinely don't want it to exist anymore.

Why "delete" is usually theater

When your readable entries live on a company's server, deleting them is a request, not an act. You're asking the company to go remove the thing. Whether it actually disappears depends on plumbing you can't see:

It might linger in backups for weeks or months, because backups are designed to undelete things.
It might survive in logs that recorded the content as it passed through.
It might already be copied into some analytics or training system that has its own life now.
It might sit in a "deleted items" holding pen for 30 days so you can change your mind — which is friendly, but means "deleted" meant "scheduled for deletion, maybe."

None of this is necessarily sinister. It's just how big systems work. But it means "delete" is a promise about the company's future behavior, not a fact about the present. Sound familiar? It's the same shape as the "we won't read it" problem. (We have feelings about that one.)

The neat trick of deleting the key instead

Here's where end-to-end encryption does something genuinely clever about deletion, almost by accident.

If your entries are only ever stored as scrambled, locked boxes — and the key lives with you, not us — then there's a second way to make something disappear. You don't have to chase down every copy of the box. You just destroy the key.

A locked box with no key in the universe isn't a diary anymore. It's noise. Random bytes. Even if a copy survived in some backup we forgot about, even if someone grabbed it years ago, it's unreadable forever, because the only thing that ever made it readable is gone. This has a suitably dramatic name: crypto-erasure. Destroy the key, and the data is mathematically, permanently scrambled, no matter how many copies exist.

It's the difference between trying to shred every photocopy of a document versus just burning the only decoder ring. One is a frantic scavenger hunt. The other is over in an instant.

What this means at Hearth

When you delete your account at Hearth, we don't just hide your entries and cross our fingers about the backups. We destroy every key that ever made your data readable — including the sealed spare key we keep in the default mode, the one that opens your journal when you sign in. All of them, gone. After that, whatever ciphertext might still be sitting anywhere is permanently meaningless — to us, to a future us, to anyone who ever gets their hands on it. Gone isn't a euphemism here. It's the literal state of things, in every mode, on every plan.

We even hold ourselves to this with tests that check the invariant, because "trust us, it's gone" is exactly the kind of claim that deserves to be checked rather than asserted.

The flip side, said out loud

Honesty, as always: this cuts both ways, and we'd be lying by omission if we didn't say so. "Gone means gone" is wonderful right up until you delete something you wish you hadn't. There's no secret backup for us to quietly restore from, because a secret backup we could restore from is a secret backup a hacker could steal from and a court could demand. The same property that makes deletion trustworthy makes it unforgiving.

So delete with a little intention. But know that when you do, you're getting the real thing — not a card palmed back into the deck, but a genuine vanishing. For a diary, that's exactly the kind of delete button you want.