What leaves your device, when, and what we keep.

plainlog is a bullet journal kept in plain-text files. This page says what leaves your device, when, and what we keep. It is written from what the software actually does; when the software changes, this page changes with it.

There are three ways to use plainlog, and they send different things:

• The app on its own — nothing about you leaves the device.
• The app with usage stats switched on — anonymous numbers, once a day.
• The app with a sync account — encrypted copies of your journal and an email address, on a server we run.

Each is described below. The landing page has a section of its own at the end.

Your journal is files on your device: in the browser, in the browser's own private storage for this site; on a Mac, a folder in your home directory that you can open in Finder. Nothing is uploaded. There is no account and no sign-up. The app writes to your device from the first keystroke and never asks you to register first.

The app keeps a handful of settings on the device beside the journal: theme and palette, language, the ritual switch and its time of day, whether you have seen the first-run tour, and a hash of your app-lock PIN if you set one. The PIN itself is never stored. None of this is sent anywhere.

The only network request the free app makes on its own is a check for a newer version of itself — a plain fetch of one small file from the same host that served the app. It carries no identifier and nothing about your journal. (On the Mac app there is no such check.)

Export. Settings → Download journal as .zip assembles the archive on your device and hands it to the browser as a download. No copy passes through a server.

Erase. Settings → Start over deletes the journal and every setting on this device, including the usage-stats id below. Because nothing was uploaded, there is nothing to delete elsewhere.

Settings has a switch, Share anonymous usage stats. It is off by default and the app asks you once, on the first-run tour. While it is off the app sends nothing.

While it is on, at most once a day, the app sends one small JSON message containing exactly these classes of data:

• which platform and browser family the app runs in (the family is told by feature detection, not by reading the browser's user-agent string), and your language, theme and palette choice;
• whether the app is installed to the home screen and which of four size buckets the window falls in;
• local counts: entries created, edited, moved and deleted; days opened and app opens; how many times the first-run tour was completed, the ritual opened, closed or skipped, a carry made or undone, a sync door used; startup health — whether storage and the core loaded, how many errors went unhandled, how many saves had to merge;
• your journal's kind profile — how many entries of each kind and depth, as numbers;
• whether the daily ritual is on and its time of day; whether a sync session exists on this device;
• a random installation id.

It never contains journal text, file names, dates, or anything that names you. The installation id is sixteen random bytes minted on your device when you switch sharing on; it is derived from nothing and it is never shown on screen. Switching sharing off deletes it. Settings also has New random id, which replaces it with a fresh one. Start over erases it with everything else.

What the collector keeps. The receiving service stores the JSON body you sent and the time it arrived, one line per message, in a file on our server. By construction it cannot store your IP address or your browser's user-agent string: the proxy in front of it does not pass them on, and the service itself reads only the message body. There is no other identifier. Because the id is random and the body has no name in it, a message cannot be traced back to a person; for the same reason, we cannot delete "your" messages on request — we have no way to know which are yours. Switching off and starting fresh is the deletion.

Retention. These messages are kept until we clear the file; there is no automatic expiry today.

Sync is a paid feature. Turning it on creates an account, and from then on the app talks to a server we run at api.plainlog.mellonis.ru. Here is what that server holds, what it never holds, and for how long.

What the server never holds. The key that opens your journal. Before a line of your journal leaves the device it is encrypted with a key that only your devices have; the server stores the result and cannot read it. It has no password of yours either — sign-in is a passkey, which your device holds. Your journal's text, its file names and its dates never reach the server in the clear.

What the server holds for the journal.

• Encrypted copies of your journal, in the order your devices sent them. Ciphertext only.
• Wrappers — your journal key, sealed so that only one of your devices, or a recovery code, can open it. The server stores them and hands them back; it cannot open one.
• Your signing key's public half, which your devices use to check that a wrapper is genuine.
• A registry of your devices: an id, a coarse label such as "Chrome on macOS" derived from the browser's user-agent string, when it enrolled and when it last synced, and whether it was paused or revoked.
• While two devices are pairing, the short encrypted messages they exchange through the server, for the minutes the pairing takes.
• How much you have stored and how fast it grows, as numbers, to enforce a fair-use limit.

What the server holds for the account.

• An account id: sixteen random bytes, derived from nothing.
• Your passkeys' public halves and the labels you gave them.
• The email address you gave, and whether you have confirmed it. The address is a channel, not an identifier: it does not sign you in and two accounts may share one. It is used to get you back into the account if you lose every passkey, and to tell you when something happens to the account — a confirmation, an address change, a lock reset, a pending deletion.
• Sessions: a hash of each signed-in device's token and when it was last used. Tokens themselves are not stored. A session that goes unused for ninety days expires.
• Your subscription state and the timestamps that drive it; if a payment provider is ever connected, the ids of its events.
• Whether the app lock is set on any of your devices and when it was last cleared. Not the PIN.

What the server can see about your rhythm. It cannot read what you sync, but it can see when you sync and how much. Timing and volume reveal a rhythm; hiding them would take decoy traffic we will not ship.

Mailed links. Confirmation, recovery, address-change veto, lock reset, discard and deletion-cancel all arrive as links. The secret part of each link is in the URL fragment, which your browser never sends to a server; a link starts nothing until you press the button on the page it opens, so a mail scanner cannot spend it. Only a hash of each link's secret is stored. Beta fact, one sentence to the owner's wording: during the beta these mails are written to the server's log and handed over by the operator, so a link passes through a person until a mail transport ships.

Payments. No payment provider is connected yet. While that is so, nothing in the app can take a payment and no card or billing data is collected. When a provider is chosen, this page will name it and say what it receives.

Leaving.

• Sign out on a device forgets the account there. The journal on that device stays, and stays yours.
• Discard the server copy — when you have lost the key — seals the server's copy and the wrappers in a quarantine for thirty days, then destroys them. The account and subscription survive it; you start the sync log again from a device.
• Delete the account opens a seven-day window. You can cancel from the app or from the link mailed to you. When the window closes, the account, its journal copies, wrappers, devices, sessions and passkeys are erased and a final confirmation is mailed to an address we no longer hold.
• If a subscription lapses, the encrypted journal copies are kept for thirty days past the lapse, still downloadable, and then deleted. Wrappers and keys are not deleted by a lapse, so a device that still holds a key can keep working from its own copy.

The landing page at plainlog.mellonis.ru sends anonymous page-view events to the same collector described above: the page's URL, the language and theme in use, the address of the page that linked here, and a few interaction events (the demo was used, pricing was viewed, the theme or language was switched). No cookie is set and no identifier is sent; the collector cannot store your IP address. The page keeps your theme and language choice in the browser's local storage.

Every request to our hosts passes through a standard web server that keeps a standard access log — request line, time, status and the client's IP address — for the duration set by the host's log rotation — a number the owner must read off the host or set on purpose. This log is not joined to anything above: the collector is not given the IP, and the sync server never sees it either.

We do not protect a compromised client, and we do not pretend to. If code you did not ask for is running in your browser or on your machine — an extension, an infection — everything in that context is reachable: the journal in the clear, a device password as you type it, recovery codes on screen. The app lock hides the interface from onlookers; it encrypts nothing. Encryption of files at rest on your own device is your operating system's job.

• Export — Settings → Download journal as .zip, assembled on the device.
• Erase the device — Settings → Start over.
• Delete the account — Settings → account card, or ask us.
• Contact — support mailbox, to be created; an ops item.

This service is operated by legal name in jurisdiction. Lawyer's section: legal basis, data subjects' rights under the chosen jurisdiction, children, changes to this policy, effective date.