The entire value of a journal is that it is the one place you do not perform.
Which means the question of where it lives is not primarily a security question. It is a writing question — because if some part of you suspects the words could be read, you will write a slightly managed version of what you think, and the managed version is worthless. It is the same as the unmanaged one with the useful part removed.
People often discover this the wrong way round: they journal in a shared workspace for a month, produce nothing but bland entries, and conclude they are not a journalling sort of person.
The three things that make you self-censor
A shared or work account. Anything administered by an employer. Whether or not anyone would look, you know that someone could, and knowing is enough.
A device other people use. A family iPad, a laptop left open, a machine with a session that does not lock. The risk is not a breach; it is somebody walking past.
A service that reads your content. Anything doing automatic summarising, tagging or semantic indexing has, by construction, transmitted what you wrote. That is a real property of those features, not a suspicion, and it is worth knowing which side of it your app is on before you write down something you have told nobody.
The fix for all three is the same and it is architectural rather than behavioural: put the journal somewhere that has no route out.
What a private-by-construction arrangement looks like
A local file, on a machine you control. No account to breach, no server holding a copy, no support person with database access. The threat model becomes: someone with your unlocked laptop. Which is a threat you can actually reason about.
Encrypted where it sits. Full-disk encryption at minimum. Per-note locking on top, if the app offers it, so a shoulder does not read it and neither does anyone who gets past the disk.
No AI, or AI that provably runs locally. Not because the feature is bad, but because "summarise my journal" and "nothing leaves the machine" are mutually exclusive unless the model is on your disk.
An export you control. Journals are the notes people most want to still have in twenty years. That means a readable format and a backup, which is the one place this gets complicated — see below.
The one that actually needs thinking about: backups
Here is the tension nobody resolves cleanly.
A journal is the single hardest thing to lose and the single worst thing to have copied. Those pull in opposite directions, and most advice picks one and pretends the other does not exist.
The arrangement that handles both: an encrypted backup you control the key to. An external drive, encrypted, kept somewhere else. Or an encrypted archive of the export, in cloud storage — the storage provider holds a blob they cannot read, which is a genuinely different arrangement from them holding your text.
What does not work: putting the journal in a sync service for safety. That is a copy on someone else's infrastructure in readable form, and it undoes the entire arrangement in exchange for convenience.
If that sounds like too much, the honest minimum is: full-disk encryption on, one encrypted copy on an external drive, updated occasionally. That covers the fire and the theft, which are the realistic losses.
What actually goes in one
Since the question of what to write stops most people faster than where to put it.
No obligation to write daily. The daily streak is the most common reason people abandon journals, because a missed day becomes a small failure and three missed days become a stopped habit. Write when there is something.
The uncomfortable version. If the entry could be shown to a colleague without difficulty, it is probably not doing the job. The value is in what you are not saying out loud.
What you are actually worried about, not the tidy version. The tidy version is the one you have already told people, and you did not need to write it down.
Occasionally, what happened. Plain events with dates. Not for the writing — for the reading. In five years the emotional entries will be strange to you and the factual ones will be the ones you are glad exist.
Reading it back
The part that makes it worth having done, and the part almost nobody does.
Once or twice a year, read a year old. Two things happen reliably. Things you were certain about turn out to have been wrong, in ways that are useful and slightly humbling — the same mechanism as a decision journal, applied to your life rather than your choices. And things that felt enormous turn out to have been survivable, which is the most useful information a journal ever provides, and it is only available in your own handwriting about your own crisis.
Expect to find some of it embarrassing. That is what an honest record looks like, and the entries that are not embarrassing are usually the performed ones.
Paper, briefly
Worth mentioning honestly: paper is genuinely private, needs no threat model, and cannot be indexed by anything.
It also cannot be searched, is difficult to back up, and is readable by anyone who opens the drawer — which for a lot of living situations is a worse privacy property than an encrypted file, not a better one.
The reasonable answer is: paper if you like writing by hand and nobody goes in your drawer; an encrypted local file if you want to search it in ten years. Both are defensible. What is not defensible is a journal in a work account.
The honest version
If you have tried journalling and produced nothing but bland entries, the diagnosis is usually not discipline. It is that some part of you did not believe the document was private, and that belief is not something you can override by deciding to be honest.
Fix the arrangement first. The writing tends to follow.
Cyanote is private by construction rather than by policy: one SQLite database on your own Mac, no account, no sync, no analytics, no crash reporter, no AI reading anything. Any note can be locked with a password and is encrypted where it sits, so the journal can be locked while the shopping list is not. ⇧⌘D opens today's daily note when you do want a dated habit, and everything exports to one readable file — which, encrypted and kept on a drive somewhere else, is the version of a backup this particular material deserves.