Last updated October 5, 2026
Privacy Policy
Told LLC operates Told, a private journal. You organize Entries in Spaces and choose what to share with other people. This policy describes how we handle information when you use the Told app and toldjournal.com. For privacy questions or requests, email support@toldjournal.com.
What Told is
Your writing is available on your signed-in device and synchronizes when a connection is available. Sharing gives other Space members access to the content you place there. There is no advertising network in the app.
Journal content and encryption
Entry content is encrypted on your device before it leaves it. Told’s Empire backend stores ciphertext and does not decrypt ordinary journal content. Encrypted media files are served from a public read-only object store; access to a file URL alone does not provide its decryption key. Account, membership, delivery, and other service metadata are separate from that encrypted content.
Your device keeps a local plaintext copy for the signed-in account so the app can work offline. If you lose the device and have no recovery backup, historical entries can become unreadable. Told cannot reconstruct those keys.
Account and sign-in
Sign-in is provided by Clerk. To create a Told account you need a Clerk user with a name, username, and primary email address. Empire stores those registration fields, the Clerk user ID, and an optional profile image URL so the service can identify the account, show members, and process deletion. That account metadata is not journal ciphertext.
Recovery & Backup can create an encrypted copy of your encryption key protected by a recovery code you save outside Told. Empire stores the encrypted backup, not the code or unencrypted key. The app verifies the downloaded backup before marking that code as verified.
On supported Apple devices, Told also saves a recovery copy in a synchronizable Keychain item. Delivery to another device depends on your Apple account and iCloud Keychain settings. A successful save on this device is not proof that another device received the key. Signing out preserves recovery copies; confirmed account deletion initiates removal of that account's copies from the deleting device and synchronizable Keychain. Propagation to other Apple devices depends on iCloud Keychain. Keep your recovery code or exported key private: someone with that key and the corresponding encrypted content can read the content.
Optional Curator analysis
If a Space administrator enables Curator (Told Bot), the app grants that bot access to the Space's encryption key. Curator decrypts selected Entry text and comments and sends them to Cloudflare Workers AI to generate findings. Those findings are encrypted before being saved. This is an additional recipient you choose to enable, not server access to every private journal. Do not enable Curator in a Space whose content you do not want processed this way.
Notifications
If you allow notifications, Told registers a device push token through Apple and Expo so Empire can deliver activity alerts. Lock-screen and inbox copy is generic. Told does not put journal text, photo contents, or other encrypted entry bodies into those notifications.
Content reports
A Space member can report an Entry they can see. The app encrypts a frozen copy of that Entry to Told moderators. Empire stores routing metadata and the encrypted report package; it does not decrypt the evidence. Moderators review reports in the app. Reasons include spam, harassment, hate, violence, sexual content, child safety, privacy, and other.
Account deletion
You can delete your account in the app under Profile settings. Deletion removes your Clerk sign-in, your active Empire registration, shares you created, memberships, notification delivery for that account, and the local data for that account on the device that performs deletion. You must transfer or delete Spaces you still own, and you cannot delete the last Admin account until another Admin exists. Encrypted media bytes may remain in storage until they are no longer referenced and ordinary cleanup runs. Deletion does not erase copies another person has already saved or received, or instantly remove information from service backups. Records needed to complete deletion safely, address abuse, or meet legal obligations may remain. Recovery copies and device cleanup are described above.
Device permissions
You control permissions in your device settings. Features may request:
- Camera, microphone, or photo library access for supported media features.
- Notifications, to tell you about activity in your Spaces.
Services that see account data
Journal ciphertext is stored on Cloudflare (Workers, D1 metadata, and R2 object storage). Account sign-in is handled by Clerk. Push delivery uses Apple and Expo. Optional Curator analysis uses Cloudflare Workers AI. Crash diagnostics use Sentry as described below. These providers process the information needed to deliver their services; ordinary network requests can expose technical information such as an IP address to the receiving provider.
The website uses Google Fonts. Loading those fonts makes requests to Google's font servers with ordinary connection information, including your IP address. The public encrypted Share viewer does not load those fonts or other third-party resources.
Crash and error diagnostics
Production Told builds use Sentry to diagnose crashes and application errors. Reports can include error names and messages, stack traces, app version and build, operating system and device information, and fixed labels identifying the operation that failed.
Told filters recognizable credentials and private content from error messages and excludes account identity, attached journal records, request bodies, and local variables. Filtering cannot guarantee that every error message from another library contains no personal data. Session replay, screenshots, screen hierarchies, console capture, performance tracing, and session tracking are disabled. Diagnostics are used to operate and improve Told, not for advertising.
Retention and your choices
We keep active account information and encrypted content to provide the service while your account and content remain in use. Deletion follows the process above; encrypted objects, service backups, and records needed for security, deletion, or legal obligations can have different lifetimes. Crash diagnostics are retained to investigate application failures under the diagnostic service's configured retention. Contact us with questions about retention or deletion of a particular record.
You choose the content you add and the people you share it with. You can change device permissions in iOS Settings, update your account details, and request account deletion. To withdraw a permission or request help when you cannot sign in, email support@toldjournal.com. Withdrawing access does not erase copies a recipient already received.
Privacy requests
Depending on where you live, you may have rights to access, correct, receive a copy of, or delete personal information, or to object to or restrict particular processing. Send requests to support@toldjournal.com. We may need to verify that you own the account before acting on a request. Do not send your recovery code or private encryption key. We cannot provide decrypted journal content that only your devices and authorized recipients can read. You may also contact your local data protection authority where applicable.
Where information is processed
Told and the providers described above may process information in the countries where their infrastructure operates. The protections available under local law can differ from those in your country. Contact us with questions about the providers or processing that applies to your account.
Changes to this policy
We will update this page when our data practices change and revise the date above. Material changes will be communicated through the app or another appropriate account contact channel.
Contact
Contact Told LLC at support@toldjournal.com, or visit toldjournal.com/support for account and recovery instructions. You do not need to sign in to contact us.