Reflect encrypts every entry on your phone with AES-256-GCM. Encrypted cloud backup. Biometric lock. Free on iOS and Android.
Most "private" diary apps store your entries in plaintext SQLite behind a PIN. Reflect doesn't.
AES-256-GCM with HMAC tamper detection on every entry. Not an opt-in toggle hidden in settings, not a premium upsell. From the moment you write your first line, the file on disk is unreadable without your key.
When you back up, Reflect generates a random key for your backup and wraps it with a key derived from your recovery code using Argon2id. That recovery code is what restores your diary on a new phone, so keep it somewhere safe.
Optional cloud backup is encrypted on your phone before it is uploaded: entry text, photos, and voice memos. Backups have no plaintext mode. Real-time sync between your own devices works differently, and our privacy policy spells out exactly how.
Face ID, Touch ID, fingerprint, PIN, or password — pick what fits how you use your phone. Auto-locks the moment you switch apps. Hides preview thumbnails by default, so a glance at the multitasking switcher reveals nothing.
On the new device, your recovery code re-derives the key that unwraps your backup key, then your entries are decrypted on the phone. A fingerprint check catches a mistyped code before any decryption is attempted.
Reflect encrypts entries with AES-256-GCM and adds HMAC tamper detection. The same algorithm protects encrypted cloud backups, with the wrapping key derived from your recovery code via Argon2id. Photos and voice memos are encrypted with the same scheme before they ever reach storage.
Encryption is on by default. There is no toggle to disable it for entries on your device, and there is no plaintext fallback. Cloud backup is the only optional piece — and when you turn it on, backups are encrypted before they leave your phone.
If you enabled encrypted cloud backup, you can restore on a new device by signing in and entering your recovery code. The recovery code re-derives the key that unwraps your data; keep it safe, because without it the backup can't be restored. If you skipped cloud backup, your diary lives only on the lost device.
No. Entries are encrypted on your device before any sync. Our servers see ciphertext only. If you opt into AI features, the specific text you send for an insight is processed by the AI service in transit, with PII stripped first; the rest of your diary stays encrypted and inaccessible.
Free on iOS and Android. No account required. Encrypted from the first entry.