Journaling App Data Breach: What to Do, In Order

2026-10-08 · Yesterself

The notice arrives in the flat voice these things are written in. There has been an incident. An unauthorized party accessed a system. The company takes your privacy seriously.

Almost every piece of breach advice you can find was written with a credit card in mind. It assumes the stolen thing can be replaced: cancel the card, dispute the charges, watch the credit file. That fits a journal badly, because a journal is not reissuable. Nobody can send you a new version of the page about your marriage.

So here is a triage order written for diary content instead. The first step is the one people skip, and it decides everything after it.

1. Find out whether your entries were readable at all

Before anything else, establish what was actually exposed. Three broadly different outcomes are possible, and they call for three different weeks.

• Account data only. Email addresses, password hashes, device names, timestamps, billing records. Unpleasant, common, and a credential problem rather than a content problem.
• Ciphertext. The encrypted blobs your entries live in left the building, but the keys did not. Whether that matters depends on how the keys are derived, which is step three.
• Plaintext. Entries, or the parts of them the app kept readable, were exposed as text. This is the case the rest of this piece takes seriously.

Read the disclosure closely and notice the difference between "we have no evidence that entries were accessed" and "entries could not have been accessed." The first is a statement about their logging, the second about their design. Only the second is load-bearing.

Then write and ask specific things, because a specific question is harder to answer with a paragraph of reassurance.

• Which fields were in the affected store, listed by name?
• Was my account among the affected ones, yes or no?
• What date range of my data was in it?
• How did you determine which entries were accessed, rather than merely reachable?
• Has the entry point been closed, and how do you know that?

A journal leaks in unusual places, so ask about the odd corners: entry titles and preview text, tags, mood values, the calendar of which days you wrote, attachments and voice notes, the search index, server-side backups, and push notification text. Some apps encrypt the body and keep the preview line readable so lists render quickly, and that line is often the most revealing sentence in the entry. There is more on where the boundary sits in what an end-to-end encrypted journal app actually means.

2. Rotate everything that can be rotated, in this order

Do this the same day, before you have the full picture. It closes the door behind whoever came in.

1. Change the app's password, if the app has one.
2. Revoke sessions and devices. A stolen session token can outlive a password change. Look for "log out all devices" or a list of active sessions, and ask support to force it if the app has no such control.
3. Turn on two-factor authentication. An authenticator app or a hardware key is stronger than SMS.
4. Kill share links, integrations, and tokens. Public entry links, automation services you connected years ago, third-party clients, anything holding an old key.
5. Re-key, if the app allows it. Some encrypted apps let you rotate the key material behind the archive and re-upload. If yours does not, that is worth knowing now rather than later.

Then say the uncomfortable part out loud: none of this reaches backward. Rotation protects the archive from today forward, and what was exposed stays exposed. Accepting that early keeps you from spending the week fitting a lock to an open door.

3. If the app is end-to-end encrypted, check the key derivation

An app that lost ciphertext has had a far better week than one that lost text. But check one thing before you relax.

If your encryption key is derived from a password you invented, stolen ciphertext can be attacked offline, at whatever rate the attacker's hardware allows, with no server there to slow the attempts. A long, unique passphrase makes that expensive. A password you also used on a forum in 2014 makes it cheap. If the second describes you, treat the entries as potentially readable.

Keys held as a long random recovery phrase, rather than derived from something a person chose, are not guessable this way. Zero-knowledge encryption, explained without math covers why that distinction exists and what it costs you.

4. Assume the password is being tried everywhere else

This is the part with the clearest path to concrete loss, and it has nothing to do with your diary. Stolen email-and-password pairs get replayed against other services in bulk, by software, for months afterward.

• Check your address at Have I Been Pwned, Troy Hunt's breach index, to see what else you already appear in.
• Change the password anywhere you reused it. Start with your email account, because it is the recovery root for everything else, then banking, then the rest.
• Move to a unique password per service, which in practice means a password manager.
• Expect targeted phishing. A message that names your journaling app, and possibly quotes a line back to you, is far more convincing than the usual attempt. Do not act on links inside it; open the app yourself.

5. Think about the other people in your entries

If entries were readable, you were not the only person exposed. Journals are full of other people's material: a diagnosis told to you in confidence, a friend's immigration status, someone who is not out to their family, a complaint with names attached. Where a real person's safety or standing is affected, the honest move is to tell them rather than manage it quietly and hope. Say what was exposed, what you wrote that concerns them, and what you have done since.

This is not legal advice, and journaling is not medical treatment. If the exposure carries employment, custody, immigration, or safety consequences, talk to a qualified professional in that field. If the fallout is hard to carry, that is a conversation for a clinician, not an article.

6. Decide whether to stay or move

Give this a week rather than an evening; a panic migration lands people somewhere worse. Judge the company on the disclosure more than the incident, because what separates companies is what happened next.

• How long between discovery and telling you?
• Did they enumerate what was taken, or gesture at it?
• Did they state plainly what they do not yet know?
• Did the architecture limit the damage, or did it depend on the perimeter holding? A breach that yields unreadable blobs is a design doing its job. A breach that yields diaries had one line of defense.

Then check whether leaving is even possible. Export your archive now, in an open format, and open the file to confirm it holds what you expect. An app that makes export slow or partial has told you something more important than the breach did. Request deletion, if you want it, only after that export is in hand.

One question to carry into the alternatives: who at the new company can read entries, and by what mechanism. Can the people who make your journal app read it is that question asked properly.

What not to do

Do not stop writing honestly. The reflex after an exposure is to keep the real version nowhere, and a hedged journal is not worth the minutes it takes. What failed was a storage decision, not the practice. Fix the storage.

Yesterself is built so the worst realistic outcome is the merely annoying one in step one: end-to-end encrypted, with no account, no email address, and no password. Your identity is twelve BIP39 words that you hold, the server stores ciphertext it cannot read, and nothing is used to train anything. The honest cost is the one this article keeps circling: if those twelve words are gone, we cannot open your archive either. Export is free forever, in open formats, on the free tier too. The app is not released yet, so the waiting list is the only door.

Whatever you use, do step one before the panic sets the agenda, and step four before the week is out. Those two carry most of the weight.

Common questions

What is the first thing to do after a journaling app data breach?

Find out whether your entries were readable at all. A breach that exposed email addresses and password hashes calls for very different work than one that exposed the text of your diary, and the disclosure notice usually indicates which.

Can I change my journal entries the way I change a password?

No. Credentials can be rotated and cards can be reissued, but written text cannot be recalled. Rotation protects the archive from today forward, which is still worth doing the same day.

My journaling app is end-to-end encrypted. Does the breach still matter?

Usually much less, but check two things. Ask whether your key is derived from a password you chose, since stolen ciphertext can be attacked offline, and ask which fields sat outside the encrypted blob.

Should I delete my account after a breach?

Export your archive first, in an open format, and confirm the file opens. Deletion at a company whose security you cannot verify is a promise rather than a proof, so the export matters more than the deletion does.

What usually causes the concrete damage in an app breach?

Reused passwords. Stolen email and password pairs get replayed against other services, so change that password anywhere you used it, starting with your email account.