What enGender protects, and what it does not

Your journal is stored on your device. There is no enGender account, no server with a copy of it on, and nothing syncing in the background. An entry you write goes into storage on the device you wrote it on and stays there until you export it or delete it.

There is no server, so there is no server to be breached, subpoenaed or sold. What you are trusting instead is your own device and whoever else can reach it.

App lock is off until you turn it on, like every control in enGender that hides something. Keeping a journal about your own life is an ordinary thing to do. Some people's circumstances make it dangerous anyway, and only you know whether that is yours.

What it does. App lock puts a PIN in front of the app, so somebody who picks up your unlocked phone cannot read your journal by opening it.

What it is not. It is not the encryption of what is stored; that is the passphrase's job, below. A PIN is a gate in the interface. Four digits will stop a glance over your shoulder. It will not stop somebody with your device, time and a reason.

If you forget the PIN, there is one way back in: an action on the lock screen that wipes the local journal and starts you over. There is no recovery that keeps your entries, because a PIN that could be recovered would not be protecting anything. Wrong attempts wait longer and longer before the next one is accepted, and nothing wipes your journal automatically after a set number of tries. A counter like that is one bored kid or one argument away from destroying a diary nobody decided to destroy.

What is covered. Your journal where it is stored, the working files kept beside it, the copy taken before an upgrade changes anything, and your photos and their thumbnails.

Photos are files rather than rows in a database, so encrypting the database never reaches them. Each one is encrypted on its own, under the same key. An import runs through memory and never lands in a temporary file, so there is no half-imported copy of your history left on the disk afterwards.

What is not covered. A few things stay outside, because the app has to be able to start and to let you unlock it: the wrapped key and the settings used to derive it; your theme, palette and language; whether lock on leave and disguise are switched on; and the timestamps that make repeated wrong PIN attempts wait longer each time. None of it is anything you wrote. Somebody reading that part of your browser profile learns which colours you chose and whether disguise is on, and learns nothing about a single entry.

On the web, you choose a passphrase. It does not encrypt the journal directly. It unlocks a random key that does, which is what lets you change the passphrase later without re-encrypting years of entries. After the browser session ends, the passphrase is needed again. No usable key is left sitting next to the data it would open.

Device-bound mode is the other way to hold that key: nothing to type on a cold start, and the key stays in the one browser profile or device you set it up in. The trade cuts both ways, and the app says so before you choose. Losing that profile or device loses the journal, with no passphrase to fall back on. And the key is not protected by anything you know, so a copy of that browser profile opens the journal with nothing typed. Tied to this device is a fact about where the key lives, not a wall.

On Android, the same random key is held by the Android Keystore rather than by a passphrase you type, and the Keystore releases it only after the phone has checked who is asking.

The passphrase cannot be recovered. Not by you and not by me. There is no reset that keeps your entries, no recovery email and no message to me that can help, because a way back in for me would be a way back in for anyone else. Put it in a password manager before you write anything you would be upset to lose. The app says this again at setup.

Export packs your journal into a single Archive file, encrypted with a password you choose, before the file goes anywhere. That password is not your PIN and not your Journal passphrase. It protects that one file.

What an Archive gives away. The first six bytes of the file spell GDIARY in plain text, followed by the format version and the settings used to turn your password into a key. That part has to be readable without the password, so that a file from a newer version can say so instead of decrypting into nonsense. Everything from your journal is behind the password. Somebody who finds the file learns that it is an enGender Archive, because the header names the format, and nothing about what is in it.

If you lose an Archive password, that file is not readable again. Other Archives made with other passwords are unaffected.

Opening the app in a browser means asking a web host for it, and that host can see an IP address, roughly when the request happened, and that the app was fetched. Checking for a new version is the same kind of request. This is true of every website you open, and it is true of this one.

What the host does not receive is your journal. Entries, photos, notes and lab values are not sent to it, because there is nowhere for them to be sent.

You will not read "enGender makes no network requests" here, because it is not true. Fetching the app is a network request. Your journal going somewhere is not.

Installing from Google Play means Google records that your account installed this app. That is between you and Google, and no setting inside enGender changes it.

If somebody already controls your device, none of this is what stands between them and your journal. An unlocked phone in somebody else's hands, an operating system that has been compromised, or the app sitting open in front of them are all outside what encryption at rest can do. enGender does not claim otherwise. Be wary of anything that does.