Your story stays yours.

What lives on the phone

When you sign in, Biojrnl opens one database file that belongs to your account alone. It is encrypted with SQLCipher (AES-256), and the key is generated once on first run and stored in the iOS Keychain or the Android Keystore. It is never written into the database, never put in ordinary app preferences and never written to a log.

One key per account matters on a shared phone: another account's key cannot open your file. Signing out closes your file and leaves it where it is.

This sits on top of the phone's own full-disk encryption rather than replacing it. The point is the case where the raw file is pulled off a lost handset.

What the app connects to, and when

Biojrnl is not cut off from the internet, so here is the whole list.

• Our servers, when you sign up or sign in. Biojrnl has no account-free mode. Your email address, your date of birth, the display name you choose and a record of your agreement to the terms are held there from the moment you sign up, whatever you do with the backup switch. The servers are run for us by Supabase in Paris, France.
• The same servers, for your record, only while cloud backup is on. With backup off, your health record stays on the handset and nothing in it is uploaded. With it on, your record is copied there so it survives a lost phone and can reach a second device. Sharing a profile with a co-manager or a guest requires backup to be on for that profile, because the other person's phone has to read it from somewhere: turning sharing on turns backup on, and turning backup off afterwards does not retract what sharing has already uploaded.
• Apple or Google, if you sign in with them, and the App Store or Google Play when you buy a plan. Payments are handled entirely by Apple and Google; we never see your card details.
• RevenueCat, our subscription service, each time the app starts. It receives your account's random identifier and, after a purchase, the receipt Apple or Google issues, so the app knows which plan you are on. Never your email address, never anything from your record.
• Sentry, our crash-reporting service, only while "Help improve Biojrnl" is switched on. With it off, nothing is sent. More below.

That is the list. Nothing else is contacted: no advertising network, no analytics company, no smartwatch or fitness service, no imported vitals. The record is what you chose to write, which is why it is worth reading. Each provider, with what it receives and where it is, is on the subprocessors page.

The sign-in log, and why it is not browsing history

Biojrnl collects no browsing history: it never knows which websites you visit, and it has no feed to scroll. It does keep one security log about your account. Each time your account signs in, we record the time, the network (IP) address the sign-in came from, and the kind of device or app used, so that access that should not be there can be spotted and investigated. Nobody but us can see that log, including the people you share profiles with. Each entry is deleted after 12 months, and the whole log goes when you delete your account.

Where the backup lives, and how it is protected

Cloud backup is held by Supabase, our database provider, on servers in Paris, France, inside the European Union. It travels there over TLS and is stored encrypted at rest with AES-256, the provider's standard disk encryption. Access is restricted by row-level security inside the database itself, so an account can only ever read its own records and the records explicitly shared with it. This is not end-to-end encryption: as with most cloud databases, the provider's infrastructure can decrypt data at rest. Your health record stays in the European Union wherever in the world you use Biojrnl.

Who can see a profile

Only the people you have put there.

• You see everything in your own account.
• Co-managers see and help keep the whole of a profile you have invited them to. Their access is all-or-nothing, and you can withdraw it at any time.
• Guests see the sections you choose, for the time you choose, including until you remove them. Every guest also sees the profile's allergies, ongoing conditions and any handover note and carer replies, whatever else you share; the app tells you this before you send the invitation. Home address, insurer details and national identifiers stay hidden from a guest unless you switch them on for that invitation.

Profiles do not leak into each other. One profile's entries never appear in another profile's screens, which is the first rule the app is built to and the one most heavily tested.

What Biojrnl does not do

• It does not sell your health data, and nothing from the app is ever shared with advertisers or data brokers. Our privacy policy binds us to that.
• It shows no adverts and builds no advertising profile.
• It asks for no location permission and collects no location. Places you type in yourself, such as a clinic address, are simply part of your record.
• It never receives your fingerprint or face. The app lock uses your phone's own check, which answers yes or no and keeps the biometric itself on the device.
• It uses no advertising identifiers.
• It does not infer anything about your health. It stores what you write and shows it back.
• There is no AI in the app or on our servers. Nothing reads, summarises, scores or learns from your record, and no entry is ever written for you.
• It does not diagnose, grade or interpret. Its only notifications are reminders you choose to set and activity messages about profiles you share. It is not a medical device.

Crash reports are opt in

The setting called "Help improve Biojrnl" is off unless you switch it on. With it on, technical crash reports go to Sentry, our error-reporting provider, in its European Union data region. The app strips the personal information it can detect before anything leaves the phone, and a report never carries health data. With the switch off, none are sent. Reports are kept for 90 days.

Your record, and getting it back out

You can export at any time, on any plan, including free. An app that holds your history hostage is not a record.

Deleting your account works like this. For 30 days your account and any cloud copy are kept, so you can change your mind by signing back in. When the 30 days end, your account, your record, your managed profiles, your sign-in log and your subscription record are erased from our live systems within a further 24 hours, and uploaded files follow on their deletion cycle. Our short-term disaster-recovery backups expire on their rolling cycle in the days that follow. The journal on the phone itself is removed the moment you delete.

What deletion does not reach: anything a co-manager or guest exported or wrote down while they had access; crash reports already sent to Sentry, which expire after 90 days on their own; and the purchase records Apple, Google and RevenueCat keep under their own terms, which hold your subscription history and nothing from your record. The steps are on the delete your account page.

Who we are, and who we use

Biojrnl is run by Biojrnl Ltd, a company registered in England and Wales. The infrastructure providers we rely on are listed one by one, with what each of them receives, on the subprocessors page.

For anything privacy related, write to [email protected]. To report a security problem, write to [email protected].