Effective Date: August 30, 2026

This Privacy Policy describes how Diaryx ("we", "us") collects, uses, and protects your information when you use our applications and services (the "Service").

The short version

Diaryx is local-first, and there is no cloud sync. Your notes are files in a folder on your own device. We never receive them.

The only content that reaches our servers is content you explicitly publish. Everything below is mostly about that, and about the small amount of account data needed to run it.

Of that, the part you publish privately — a site behind a share link or a password — is encrypted on your device before it is uploaded. We store it, serve it, and cannot read it.

1. Information We Collect

Information You Provide

• Email address: Used to create your account and to sign you in by emailed link or code.
• Device name: Your device's own name (for example "Adam's iPhone") is sent when you sign in, so registered devices are recognizable in your account settings. You can rename or remove them there.
• Published content: Notes and attachments you choose to publish are uploaded to our servers and served at the audience level you configure. An audience you publish publicly is uploaded as ordinary web pages, which we can read because anyone can. An audience you put behind a share link or a password is encrypted on your device first, and what we receive is ciphertext under a key we are never sent — see §3.
• Custom domains: Any domain name you register with us for a published site.
• Audience passwords: If you password-protect an audience, the password itself never leaves your device. Your device runs it through Argon2id and sends us a hash of the result, which is what we compare a reader's attempt against. We store that hash and the (public) Argon2id salt and cost parameters a reader's browser needs to repeat the same derivation.

Information Collected Automatically

• Device identifier: A locally-generated device ID, created by the app to identify your sign-in session. It is not derived from any hardware identifier.
• Device signing key (public half): The app generates a signing key on each device and keeps the private half in that device's Keychain; it never leaves the device. The public half is sent when you sign in and recorded against the device, so that device can sign in again by proving it holds the key rather than by a new email code, and so readers of your published sites can check that what they received was signed by your device. Removing the device from your account settings removes its key with it. The key is generated by the app and is not derived from any hardware identifier.
• Request metadata: Because the Service runs on Cloudflare's network, Cloudflare processes the metadata of every request to it, including your IP address, timestamp, and user-agent string, and retains invocation logs under its own retention policy. We do not keep application logs of request contents.
• Usage counters: Aggregate counts of storage used and sites published, so your plan limits can be enforced and shown to you.

Payment Information

Payment is processed entirely by Stripe (web) or Apple (iOS/macOS). We never see or store your card details. We store only the identifiers those providers give us to recognize your subscription: a Stripe customer and subscription ID, or an Apple original transaction ID.

Information We Do NOT Collect

• Your unpublished notes. They are never transmitted to us. We have no copy of them and could not produce one.
• We do not use analytics or tracking SDKs.
• We do not collect browsing history, location data, or contacts.
• We do not sell or share your personal data with third parties for advertising.

2. How We Use Your Information

• Authentication: Your email address is used to send sign-in links and codes.
• Publishing: Content you publish is stored and served to the audience you configure. Public content is, by design, available to anyone who has the URL.
• Custom domains: Your domain names are used to route requests to your site and are registered with Cloudflare so a TLS certificate can be issued for them. Certificate issuance makes a domain name publicly logged in Certificate Transparency logs, which is inherent to HTTPS and not specific to Diaryx.
• Billing: See Stripe's Privacy Policy and Apple's Privacy Policy.
• Enforcing plan limits: Usage counters are compared against your plan's limits.
• Service operation: Request metadata is used for debugging, rate limiting, security monitoring, and reliability.

We never use your content to train AI models. Diaryx does not send your notes to any AI provider on its own initiative. Where the Service offers an optional AI-assisted feature, content is sent to the model provider only for the specific request you invoke, and only when you invoke it. (As of July 30, 2026, no AI-assisted content is available in the Service, optional or otherwise.)

3. Data Storage and Security

• The Service runs entirely on Cloudflare. The API is a Cloudflare Worker reached at app.diaryx.org/api.
• Account and publishing metadata — your email address, devices, workspaces, sites, domains, and usage counters — is stored in a Cloudflare D1 database.
• Published content and attachments are stored in Cloudflare R2. The mapping from a hostname to the site it serves is stored in Cloudflare KV.
• Data is encrypted in transit (TLS).
• A public site is stored in the clear. It is stored so that it can be served, which means it is readable by our infrastructure, and it is meant to be readable by anyone with the address.
• A private site is encrypted before we receive it. When an audience has a share link or a password on it, your device renders and encrypts that audience's pages (AES-256-GCM) under a key derived from a secret generated on your device, and uploads only the result. We never receive that key and cannot derive it. Object names are blinded too, so the filenames do not disclose what the pages are. A reader gets the key from the link you sent them — carried in the fragment of the URL, which browsers do not transmit to a server — or by deriving it from the password they type.
• What we can still see about a private site, because hosting it requires it: how many objects it has, how large each is (padded into buckets), when you published, which audience an object belongs to, and the fact that a given audience has a gate at all.
• The account data in §1 — your email address, devices, domains, and usage counters — is not covered by that encryption. It is ordinary stored data.
• We implement reasonable security measures, but no method of transmission or storage is 100% secure.

4. Data Retention

• Your published content and account data are retained as long as your account is active.
• Unpublishing removes content from our servers. It may briefly persist in caches.
• Deleting your account removes your account record, your published sites, your stored attachments, and your domain mappings. Deletion is attempted outside-in and any step that fails is logged and re-swept; your account record itself is not deleted unless it can be deleted.
• Deleting your account does not touch the files on your own devices. Your notes remain yours and remain where they are.
• Invocation logs are retained by Cloudflare under its own retention policy, not ours.

5. Third-Party Services

We use the following third-party services:

We do not sell your data to third parties.

6. Your Rights

You may:

• Access your data: Your notes are files on your own disk, readable with or without Diaryx. Your account data — email, registered devices, workspaces, published sites, storage used — is shown in the app's account settings.
• Export your data: Diaryx stores notes as standard Markdown files with YAML frontmatter, so there is nothing to export from — you already have them. The diaryx export command can additionally produce an audience-filtered copy of a vault.
• Correct your data: Device names and site settings can be edited in the app. For anything else, contact us.
• Delete your data: Delete individual notes at any time; unpublish a site to remove it from our servers; delete your account to remove your server-side data entirely.
• Cancel your subscription: At any time, via your device's subscription management (Apple) or the Manage Billing page in Settings (Stripe).

If you are in the EU/EEA or the UK, you also have rights under the GDPR including rectification, erasure, data portability, restriction of processing, and the right to lodge a complaint with your supervisory authority. To exercise any of them, contact us at the address below.

7. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us so we can delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the Service or by email. The "Effective Date" at the top indicates when the policy was last updated.

9. Contact

If you have questions about this Privacy Policy, contact us at contact@diaryx.org.