Privacy
What we hold, and why
Last updated 5 October 2026 · Lament
(com.lamentjournal.app)
What people write in this app is often the most private thing they own. This describes exactly what happens to it — no more and no less than what the code actually does.
- Your entries are stored in your account and restored when you sign in on a new device.
- They are readable by you and no other user. Access is enforced by the database, not by the app.
- Nothing here reads what you wrote. No analytics, no recommendations, no model training, and nobody sitting down to read entries.
- Nothing is uploaded for an AI reflection unless you tap to ask.
- Nothing is ever sold, shared with advertisers, or used to train any model.
- Your journal is not end-to-end encrypted, which is what lets you get it back if your phone is lost. Why we chose it that way.
How your entries are protected
Your journal is isolated to your account by the database itself, so no other user can reach it whatever the app does, and the storage is encrypted at rest. Nothing in the product reads what you wrote: no analytics, no recommendations, no model training, and nobody here sitting down to read entries. The only text that ever leaves is text you send yourself, by tapping the button for a reflection — the next section covers exactly what happens to it.
Why it is not end-to-end encrypted
End-to-end encryption would mean the key never leaves your phone, so nobody could open your journal — not us, not anyone. It sounds strictly better, and for a messaging app it usually is. For a journal it carries a cost people tend to discover at the worst possible moment: one forgotten passphrase, or a new phone without the old key, and years of writing are gone for good, with nobody able to help you get them back.
For writing that people would grieve losing, we thought that trade was the wrong way round. So your entries are held in a form we could technically open, and we don’t — not by policy, not by process, and not by anyone here. We would rather tell you that than let you assume a stronger promise than the one we are actually making.
If you would rather rely on something nobody could open, the app gives you exactly that. Encrypted export writes an AES-256-GCM file with a passphrase only you know — the same journal, genuinely unreadable without that passphrase, by us or by anyone, and kept wherever you choose to keep it.
What is stored on your device
A local copy of your entries is kept on the phone so the app works offline and opens instantly. It is a cache of your account, not the only copy — losing it costs nothing.
- Your entries — title, address, complaint, request, trust pivot, tags
- Drafts in progress, saved automatically so a crash or a phone call doesn’t lose your writing
- AI summaries and generated artwork, if you asked for them
- Your reminder time and app-lock preference
You can also turn on a screen lock for the app, requiring your fingerprint, face, or device passcode before the journal opens. It guards against someone picking up an unlocked phone; it is not a defence against someone with developer access to the device.
A PIN for the app itself
Separate from your phone’s screen lock, and built for a particular situation: someone who needs their journal private from a person who shares their home, and who may well know the phone’s passcode. A lock that uses that passcode is no help there.
So the PIN is not kept on your phone. It is checked against your account, and guessing is counted and slowed down somewhere the phone cannot reach. While a PIN is set, your entries are not readable even by a signed-in session that has not entered it — that restriction is enforced by the database, not by the app choosing to hide them.
If you forget it, there is no recovery. The only route past a forgotten PIN erases the journal it was protecting. That is deliberate, and it is the hardest decision in the app: any gentler route would also be a route for the person the PIN is keeping out. Choose one you will remember, and keep an encrypted backup.
Lament keeps this local copy out of the phone’s automatic cloud backup — the copy is only a cache, and duplicating it into a cloud drive would spread your entries further for no benefit.
What leaves your device, and when
Only when you explicitly ask for it.
Lament offers optional AI features — matching your entry to a biblical figure in a similar situation, reshaping your words into Hebrew poetic parallelism, writing a pastoral summary, generating watercolour artwork, and reflecting on patterns across your entries. Each runs only when you tap the button for it. Saving an entry does not trigger any of them.
When you do ask, the text of that entry is sent to Google’s Gemini API by way of Firebase AI Logic, processed to generate the response, and returned. Handling is governed by the Google APIs Terms of Service and the Firebase AI Logic terms. Lament keeps no separate server-side copy of the text sent for a reflection.
When an AI request fails or is not configured, the app shows its own pre-written material instead — and tells you that is what happened, so you are never shown a template presented as a reflection on your own words.
Voice notes
Voice capture uses your phone’s own speech recognition, not ours. Depending on the device and its settings, that may transcribe on the phone itself or send the audio to the speech service run by the maker of your phone’s operating system, under their terms rather than ours. Lament does not record, store, or transmit audio files; it receives only the transcribed text, which you can edit before saving.
Crash reports
On during testing, and you can turn it off. While Lament is in testing, crash reports are on so that a crash somebody hits is a crash we can actually fix. Turn it off any time in Settings → Diagnostics; it stops straight away rather than at the next restart.
When it is on, and only when the app actually crashes, we receive where in our own code the crash happened and the app version; your operating system version and build, and your device model, make and processor type; which of the app’s permissions you have granted or declined; and whether the app was in the foreground.
We do not receive, and the app is built so that it cannot send: any part of what you wrote — no title, body, tags, reflections or artwork; a screenshot of the screen you were on, or the layout of it; or your email address, account, or any identifier that points back to you. Reports go to Sentry, who process them on our behalf and do not use them for anything else.
This is a separate switch from usage analytics because they are different questions. Wanting the app fixed when it breaks is not the same as agreeing to be measured, and you should be able to say yes to one and no to the other.
What is never collected
- No usage analytics or telemetry. Nothing measures how you use the app, which features you open, or how long you stay. There is no analytics code in the app at all.
- Nothing you wrote, in a crash report or anywhere else. Crash reports are on during testing (above) and carry no title, body, tag, reflection or artwork
- No advertising identifiers, and no advertising
- No location. The app never asks for the location permission and does not have it, and the approximate area a crash report could otherwise be traced to is filtered out before it is stored
- No contacts, photos, or device identifiers
- No profile of you, and nothing built from your writing that you did not ask for
Taking your journal with you
Your writing is never trapped here. You can export it at any time, and you should before deleting anything — deletion is permanent and there is nothing to restore from afterwards.
In the app, open Settings and choose:
- Encrypted backup (
.lamentbak), under Settings → Privacy — AES-256-GCM with a passphrase you choose. If you decline to set one, the file is only scrambled with a key built into the app that anyone with the app can derive; the export screen says so plainly. Set a passphrase if the file will leave your device. - Export as PDF — a readable document, unencrypted. Useful for printing or for handing to a counsellor. Treat it like any other document containing private writing.
Both write to wherever you point them. Once the file leaves the app it is yours to look after.
Removing everything
One entry at a time
Open the entry and delete it. It goes from your account and from every device you are signed in on.
The whole account
Open Settings → Danger zone → Delete my account. It asks you to confirm, then removes your entries, your generated artwork and the account itself, immediately. Nothing is archived and nothing is kept. The deletion page covers this in full.
If you no longer have the app, email support@wayfarersdigital.com from the address you signed up with. Requests are actioned within 30 days and in practice much sooner. We may need to confirm you control the address before deleting — that check exists so nobody else can delete your journal.
Cancel a subscription separately. Deleting your account does not stop it — the subscription is held by the app store you bought it from, not by us, and it keeps billing until you cancel it there, in the store’s own subscription settings.
Uninstalling the app on its own removes only the local cache. Your account and its entries stay until you delete them, which is deliberate — an uninstall is usually a new phone, not a decision to erase years of writing.
What is left afterwards
Nothing tied to you, on our side. Two things are worth knowing:
- Files you exported yourself stay wherever you put them. Backups and PDFs are outside the app, so clearing the app does not touch them. Delete those separately if you want them gone.
- Text you sent for an AI reflection was processed by Google under their terms. If you never used the AI features, nothing was ever sent.
Permissions
| Permission | Why |
|---|---|
| Internet connection | AI reflections and sync, each only when you turn it on |
| Microphone | Voice notes, only while you are recording |
| Notifications | The optional daily reminder, and restoring it after the phone restarts |
| Background audio | Keeping music playing while the app is off-screen, once you have started it |
Each of these is optional, and where the phone asks your permission, it asks the first time you use the feature.
Payment
Writing is free: the composer, unlimited entries, the library, music and encrypted export. Psalms, companions, reflections, paintings and patterns are part of full access, which includes three hundred reflections and fifteen paintings a month.
There is currently no way to buy one. While Lament is in testing the app has no price, no payment form and no checkout, and it asks your app store for nothing. Nobody is being charged for anything. If that changes, this page changes first.
Children
Lament is not directed at children under 13 and collects no personal information from anyone.
Crisis support
Lament is a journal, not a medical device, and it is not a substitute for professional care. It includes crisis information — in the United States, the 988 Suicide & Crisis Lifeline, by call or text. If you are in danger, please contact your local emergency services.
Changes
Material changes will be noted in the app’s release notes and the date above will be updated.
Contact
Questions about privacy in Lament: privacy@wayfarersdigital.com