Last updated: October 9, 2026
Cedar (“the App”, Android package com.simplejournal.app) is a private journal. This policy explains exactly what
happens to your information. The short version:
| Data | Where it lives | Leaves the device? |
|---|---|---|
| Journal entries (title, text, date, mood, tags) | Private app database | Only if you export or share it (Section 3.4), or via Android device backup (Section 3.5) |
| Attached photos | Copies in the App’s private folder | Same as above |
| Custom moods, theme, font and other preferences | Private app settings | Same as above |
| App Lock PIN or pattern | Stored only as a one-way hash, never in readable form | No |
| Backup password (if you set one) | Never stored. Only a key derived from it is kept, protected by the Android Keystore | No |
| Recently deleted entries | Private app database, for 30 days after you delete them | Not included in exports or backups |
| Reminder settings (time, days) | Private app settings | Same as other preferences |
Streaks, statistics, “days this week”, favorites, the daily prompt, “On this day” memories and the “What’s new” notes are all computed and stored on your device from your own entries.
The App uses the Android system Photo Picker. It cannot browse your gallery; it only receives the specific photos you choose, and it copies them into its private folder.
App Lock (PIN, pattern, or biometrics) stops someone who picks up your unlocked phone from opening your journal. It does not encrypt the journal database. Biometric checks are performed by Android; the App never receives your fingerprint or face data.
Recognizing text in a photo of a handwritten or printed note is done entirely on your device using Google’s ML Kit text-recognition library, delivered through Google Play services. Your photos and the recognized text are not sent anywhere.
The ML Kit library itself sends limited technical diagnostics to Google, as described in Google’s ML Kit data disclosure: device model and OS version, app package and version, a per-installation identifier, performance timings, feature configuration, and error codes. Google states this data is used for diagnostics and usage analytics, is encrypted in transit, and is not shared with third parties. It does not include your journal content. The developer does not receive this data.
When you tap the microphone, the App asks Android’s speech-recognition service (for example, the Google app) to listen and return text. That service records and processes your voice under its own privacy policy and settings, which may include sending audio to its provider’s servers. Cedar only receives the resulting text and never has access to your microphone itself.
After you finish a couple of entries, the App may show Google Play’s own rating sheet. Your rating and review go to Google Play under Google’s terms; the App never sees them, or whether you rated at all. If you start the Cedar Pro free trial, Google Play handles the subscription and payment details, as with any other purchase (see section 3.6).
Backups (ZIP) and PDF exports are created only when you tap Export, Save or Share, or by automatic backup if you turn it on. When you save a file to a location you pick, or send it through the Android share sheet (for example to Google Drive or email), the destination’s privacy policy applies.
Automatic backup (off unless you turn it on). You choose one backup file with Android’s file picker (on your device, in Google Drive, Proton Drive or any other app the picker offers). After changes to your journal, the App rewrites that file on your device’s behalf; the app that owns the location (for example Google Drive) stores and syncs it under its own privacy policy. The App itself never connects to those services or to any server. You can turn it off or change the location in Settings at any time.
Backup protection. By default a backup file is not encrypted: anyone with a copy can read it, so store and share it with care. In Settings you can choose a backup password. Every backup, manual and automatic, is then encrypted on your device (AES-256) and can be opened only with that password, which the developer cannot recover or reset. The key derived from your password stays on your device, protected by the Android Keystore, so automatic backups can run without asking for it.
Text exports. Markdown and plain-text exports are ordinary, readable files that you save or share where you choose, like any other export.
If Android’s device backup is on, Android includes Cedar’s journal, photos and settings in your Google account backup only when that backup is end-to-end encrypted, which Android does when your phone has a screen lock (PIN, pattern or password). Without a screen lock, Cedar’s data is left out of cloud backups. Moving to a new phone with Android’s transfer tool also carries the journal over. You can turn device backup off in your phone’s system settings.
If you buy Cedar Pro, the payment is processed entirely by Google Play. The developer receives confirmation that a purchase exists, never your payment details.
If you turn on the daily reminder, the App asks Android for permission to show notifications and schedules the reminder with Android’s alarm service on your device. The notification contains a writing prompt only, never anything from your journal, and is marked private so it is hidden on a locked screen when your phone is set to hide sensitive content. No server is involved. You can turn it off in Settings or in Android’s notification settings at any time.
“Import from another app” reads an export file that you pick (from Day One, Journey, Daylio, or Markdown and text files) and copies its entries and photos into your journal on your device. The file is read locally and nothing is sent anywhere. The temporary copy made while you preview an import is deleted when you finish or cancel.
Journals are separate sections of your journal that are stored on your device with the rest of your entries; they are included in backups and exports like everything else. The home-screen widget, the app shortcuts and the Quick Settings tile only open the App. The widget shows a writing prompt and, if App Lock is off, how many days this week you wrote; with App Lock on it shows nothing from your journal. When you share text or photos to Cedar from another app, the App copies them into your journal on your device. Nothing is sent anywhere, and the App asks for no extra permissions for any of this.
| Permission | Why |
|---|---|
| Internet / network state | Added by Google’s ML Kit library for its diagnostics (Section 3.1). Cedar’s own code makes no network requests. |
Biometrics (USE_BIOMETRIC) |
Fingerprint or face unlock for App Lock, if you enable it. |
Vibration (VIBRATE) |
Subtle haptic feedback on taps and saves; can be turned off in Settings. |
Notifications (POST_NOTIFICATIONS) |
Shows the daily reminder, only if you turn it on; Android asks you first. |
Background work (WAKE_LOCK, RECEIVE_BOOT_COMPLETED) |
Lets an automatic backup you turned on finish in the background, and re-schedules your reminder after a restart. |
The App does not request access to your microphone, photo library, files, contacts, location, camera, or phone state.
Nothing. There is no developer-operated server, no account system, no crash reporting, no advertising, and no analytics in the App other than the Google-library diagnostics described in Section 3.1.
The App is not directed at children under 13, and the developer does not collect personal information from anyone.
If this policy changes, the new version will be published at this address with a new “Last updated” date. Material changes will also be noted in the App’s release notes.
Questions about this policy or your data: contact.cedar@pm.me