Built with serious privacy standards
We use the same security principles that protect healthcare data. Here's exactly what that means for your journal.
Let's talk about what this actually means
No jargon, no fine print games. Just honest answers about how we protect your words.
First, a quick HIPAA primer
HIPAA is a U.S. law that tells hospitals, insurers, and their partners how to protect patient data. Daylogue isn't a healthcare company. We're a personal journaling app. But that doesn't mean we take privacy any less seriously.
Why we say "HIPAA-aligned"
We built our security using the same technical standards that protect medical records. Strong encryption when your data is stored. Strong encryption when it travels. Access controls that make sure only you can see your entries. Logging that helps us catch anything suspicious. These are real protections, not marketing words.
What we're not claiming
There's no official "HIPAA certified" stamp. It doesn't exist. We haven't done a formal HIPAA audit. We don't sign Business Associate Agreements (BAAs). And when you use AI features, your content is briefly decrypted so the AI can read it. We want you to know all of this upfront.
Why we're telling you all this
Most apps bury this stuff in legal documents. We think you deserve better. Your journal holds real thoughts and real feelings. You should know exactly how we protect them. Not because the law requires it, but because it's the right thing to do.
How we actually protect your data
For the security-minded folks who want specifics.
Access Controls
Every user gets a unique ID. Sessions time out automatically. New devices need your approval before syncing.
Audit Controls
We log activity so we can spot anything unusual. You can see your own sync history too.
Integrity Controls
Cryptographic signatures verify your data hasn't been tampered with. If something changes, we'll know.
Transmission Security
TLS 1.3 encrypts everything moving between your device and our servers. No one can listen in.
Encryption at Rest
Your entries are encrypted with AES-256-GCM before they're stored. Even we can't read them.
Authentication
Secure login with email verification. No password? No problem. Magic links are just as safe.
The honest details
A few things worth knowing before you dive in.
Work in healthcare?
You're welcome here for personal journaling. But if you're thinking about using Daylogue for anything work-related, talk to your compliance team first. We built this for personal reflection, not clinical notes or patient information.
We don't offer BAAs, so we can't meet the formal requirements your organization might need.
Still have questions?
We're happy to get into the details. Security nerds welcome.