Who owns your journal?

You own your journal if you can take everything out of it, in a format that opens anywhere, and if the company behind it isn't using your private thoughts to train something else. Most people never check either one before they start writing. This is a short checklist to ask any journal app, including this one, before you hand it years of your life.

A diary is not like other data, and it's worth pausing on why before getting to the checklist. Your shopping history says what you bought. Your location history says where you went. Your journal says what you were afraid of, who you resent, what you're hiding from your partner, what you actually think about your own body, your work, your kids. It is arguably the single most sensitive thing most people ever produce in writing, private in a way that most of the rest of your digital life isn't, and it usually gets less scrutiny than a banking app that holds far less of you.

That mismatch is the reason this checklist exists. Nobody reads a full privacy policy before starting a diary. Three direct questions get you most of the way there in five minutes.

Can you take everything out?

The first question is simple: if you stopped paying tomorrow, could you leave with every entry, in a file you could open without that company's software? Not a partial export. Not a format only their own import tool understands. Real files — Markdown, PDF, CSV — that a plain text editor or spreadsheet can open in ten years, long after the app itself might be gone, acquired, or shut down.

This matters more for a journal than almost anything else you put online. A photo app losing your trust costs you convenience — you switch, you're mildly annoyed, life goes on. A journal app locking in your entries costs you your own memory of your life, which isn't recoverable the way a photo library usually is, because you're unlikely to have kept a second copy of your own private writing anywhere else. Test this before you write your first real entry, not after your hundredth: find the export button and use it on day one, before you've trusted it with anything you'd mind losing.

MetaLife exports to Markdown, PDF, and CSV, any time, from settings, with no waiting period and no support ticket required to unlock it.

Is it training AI models on what you write?

The second question is whether your entries are being used to train the company's models, or anyone else's. This is worth asking plainly, because the answer is rarely volunteered in the marketing copy, and it changes what a private confession actually means once you've typed it — an entry you wrote for yourself at midnight is a very different thing if it's also quietly become training data for a system other people will eventually query.

Read the privacy policy for the specific phrase, not a general "we take privacy seriously" line, which is close to meaningless on its own. Companies that don't use your content for training tend to say so directly and specifically, because it's a real differentiator worth stating plainly rather than burying. Vague language, or language that only talks about "improving our services," is itself an answer worth taking seriously.

MetaLife does not use your entries to train AI models, and does not sell your data. That line is written into the terms, not just implied by an absence of mention.

What happens when you leave?

The third question is what happens to your data after you stop using the product — not just whether you can export it, but whether you can actually delete it, and whether deletion means something or just hides the row from your own view while it sits on a server somewhere indefinitely.

Ask directly: is there a delete option in the account itself, or does it require an email to support and an open-ended wait for someone to get to it? Does deletion remove the underlying data, or just archive it out of sight? A product that makes leaving easy, with a clear self-serve path and a real deletion, is usually one that also treats staying with more respect, because the two attitudes tend to come from the same place.

MetaLife lets you delete your account and data at any time from the account itself, no support ticket required. Everything is encrypted in transit, and backups are encrypted — separate protections from the deletion policy and worth checking for on their own. See how it works for what happens to an entry between the moment you write it and where it ends up stored.

Why does this matter more for a journal than other apps?

Because a journal is a record of your inner life over years, not a single transaction you can shrug off. A leaked shopping cart is embarrassing for a day. A leaked diary is a different category of harm entirely — it can involve other people you wrote about without their knowledge, health details, financial fears, relationship problems, things said in a low moment that you'd never say out loud to anyone. The stakes are higher, so the bar for "who can see this, and what can they do with it" should be higher too, not treated as an afterthought behind the feature list. See what an invisible journal does for how the actual processing works day to day, and the glossary for terms like "structured data" and "export" used across this checklist.

Does this apply if I just use paper?

Yes, in a different shape, and it's worth thinking through even if software isn't part of your plan. A paper journal has its own ownership questions: who can physically find it, what happens to it if you move house or if something happens to you, whether anyone else living with you reads it when you're not around. Paper solves the export and training questions by default — there's no server to export from and no model to train on — but it solves nothing about physical access, fire, water damage, or backup. If paper is what you trust, that's a reasonable answer to this whole checklist, and the point of writing this isn't to push everyone toward software. It's to make sure that whatever you pick, paper or an app, you actually asked the questions first instead of assuming the answers.

What should you actually do with these three answers?

Write them down before you commit, the same way you'd note a decision anywhere else. If a product can't answer all three plainly — export format, training use, deletion — in language you can find in under five minutes, treat that as the answer itself. A company confident in its privacy stance usually says so in plain sentences, not through the absence of a complaint.

Q: Does exporting delete anything or change my account?
No. Export is a copy; your entries stay exactly as they are in the app after you download it, and you can export as many times as you like.

Q: If a company says data is "anonymized" for training, is that safe?
Be skeptical. Journal entries are hard to truly anonymize — names, places, and specific details often make an entry identifiable even with your own name stripped out of it. "We don't use entries for training" is a clearer, stronger answer than any anonymization promise, because it removes the question rather than trying to manage the risk.

Q: What should I look for beyond a privacy promise?
Technical controls that back the policy up — encryption in transit, encrypted backups, and a deletion path you can trigger yourself, without a support ticket. A promise is a policy, made by people, and policies can change. Controls keep protecting your entries regardless of what the policy says at the time.

Ask these three questions before you commit a year of entries to anything. The right answers should be easy to state plainly, and easy to verify yourself, not something you have to take on faith from a company that would rather you didn't ask.