Almost every app's privacy policy makes some version of the same promise: we won't sell your data, we won't misuse it, we take your privacy seriously. I believe most of the people writing those policies mean it. I also think it's a weaker promise than it sounds, because it's a promise about intent — and intent can change with a new CEO, an acquisition, a funding crunch, or a well-lawyered "we've updated our terms" email.
I didn't want to make that promise. I wanted to build something where the promise wasn't necessary — where there's structurally nothing to sell, misuse, or hand over, regardless of who's running the company or what pressure they're under.
The difference between "won't" and "can't"
Typical policy
"We collect your journal entries to provide the service, and we promise not to sell or misuse them." This is a statement about current intent. It's a real commitment, but it's revocable — by a new owner, a new terms-of-service update, a data breach, or a government request the company is legally required to comply with.
Structural guarantee
"Your entries are stored on your device. We never receive them, so there's nothing for us to sell, misuse, or be compelled to hand over — regardless of who runs this company next year." This isn't a promise about behavior. It's a fact about architecture, and it doesn't change even if my intentions did.
A privacy policy tells you what a company plans to do. An architecture tells you what a company is even capable of doing.
What this means concretely for MirrorNotes
- No account. There's no login, no email collection, no user ID to build a profile around. I don't know who you are.
- No analytics on journal content. I can't see what you write, how often, or what mood you're in. There's no dashboard on my end showing "top themes across users" — building that would require reading journals, which the architecture doesn't allow.
- No third-party AI API. Your entries never get sent to OpenAI, Anthropic, Google, or anyone else's servers for processing. The model runs on your phone.
- Sync is your iCloud, not my database. When entries sync across your devices, that happens through Apple's CloudKit, under your Apple ID, encrypted in a way Apple itself can't read. I never touch that data pipeline.
Then how does this make money?
Fair question, since "we don't have your data" usually comes paired with "...so how do you pay for servers?" The honest answer is that MirrorNotes barely has server costs to begin with — there's no AI API bill, because inference runs on your device, not mine. The business model is a plain subscription through Apple's In-App Purchase system (via RevenueCat) for the AI features: Ask, Daily Nudge, Weekly Digest, Monthly Report. You pay for the AI layer directly. Free users keep unlimited writing, full history, search, and iCloud backup, forever — the free tier was never meant to be the bait for a data-driven business, because there isn't one.
This is a smaller, more boring business than "collect data, sell insights, run ads, or eventually get acquired by someone who monetizes the dataset." I think boring is correct for something that holds people's private thoughts.
Trust that doesn't require trusting me
The reason I'm comfortable making claims this specific is that they're checkable. The app's source is open (AGPL-3.0) — you don't have to take my word for any of this. You can read the code that touches your journal entries and confirm nothing leaves the device. That's a stronger form of "trust me" than any privacy policy can offer, mine included.
MirrorNotes
Private AI journaling for iPhone. No account, no server-side journal, nothing to sell.