Secret Diary
Download Free
Last Updated: August 14, 2026

Privacy Policy

Our core privacy promise: We do not read, parse, share, or monetize your diary entries. Your thoughts belong strictly to you.

Summary in Plain English: Secret Diary is engineered as a Zero-Knowledge application. All diary notes, checklists, titles, and attachments are encrypted on your phone using AES-256 before being transmitted or stored. We never possess the mathematical keys to decrypt your personal entries.

1. Introduction

Plixlify Studio ("we", "our", or "us") provides the Secret Diary mobile application (package identifier: com.plixlify.secretdiary) and the associated cloud sync services at secretdiary.plixlify.com.

This Privacy Policy governs our collection, storage, and processing of information when you download, install, access, or use our mobile application and related services.

2. The Zero-Knowledge Privacy Architecture

Unlike traditional note-taking and journaling platforms, Secret Diary operates under strict cryptographic zero-knowledge protocols:

  • Client-Side Encryption: Your device generates a cryptographically random 256-bit symmetric Master Key (AES-256-GCM). All entries are encrypted locally on your phone before transmission.
  • No Plaintext Notes: Our servers, databases, third-party hosting providers, and developers only receive Base64-encoded ciphertext, initialization vectors (IVs), and authentication tags. We have zero ability to decrypt your diary content.
  • No Plaintext Passwords: We do not store or transmit your plaintext account password. Your password is used locally on your device via the memory-hard Argon2id algorithm to wrap your Master Key.

3. What Information We Do Process

To provide account authentication, cloud sync, and password recovery, we process minimal necessary data:

  • Account Profile Information: When you register an account, we store your full name and email address. This is required for account authentication, login OTP verification, and password reset authorizations.
  • Cryptographic Metadata: We store your user_wrapped_key, escrow_wrapped_key, and kdf_salt. These wrapped keys cannot be decrypted by anyone without the user's password or verified multi-factor identity escrow authorization.
  • Encrypted Diary Payloads: Ciphertext payloads, random 12-byte IVs, 16-byte authentication tags, category labels, pin/lock flags, and timestamps.
  • Subscription Status: If you purchase a Premium subscription through Google Play Billing, we process order identifiers and receipt tokens to unlock premium features. We do not collect or store your credit card or financial details.

4. Android Device Permissions

Secret Diary requests the absolute minimum number of permissions required to function:

  • android.permission.INTERNET: Required solely to communicate with our encrypted backend API for account synchronization and cloud backups. Cleartext HTTP traffic is disabled system-wide.
  • android.permission.USE_BIOMETRIC: Required to allow you to unlock your vault using your fingerprint or face recognition. Biometric validation occurs entirely within Android's local Hardware Keystore; biometric templates never leave your phone.

5. Google Drive Integration (Optional)

If you choose to link your Google Drive account for automatic backups, Secret Diary requests access solely to the dedicated https://www.googleapis.com/auth/drive.appdata application scope. This grants access only to files created by Secret Diary inside a hidden app folder. We cannot view, access, or modify any other files in your personal Google Drive. All files uploaded to Google Drive are pre-encrypted with AES-256 on your device.

6. Third-Party Services & Tracking Policy

We maintain an uncompromising stance against commercial tracking and advertising:

  • No Ad Networks: We do not integrate Google AdMob, Unity Ads, Facebook Audience Network, or any other advertising SDK.
  • No Behavioral Trackers: We do not track you across apps or websites, and we never sell user telemetry to data brokers.
  • Google Play Services: Used for secure authentication (Google OAuth) and Google Play Billing subscription management.

7. Data Retention & Permanent Account Deletion

You retain absolute sovereignty over your personal data:

  • Immediate In-App Deletion: You can permanently delete your account and all associated encrypted data directly inside the Android app (Settings → Account & Security → Delete Account).
  • Online Web Deletion Portal: If you uninstalled the app or lost your device, you can request immediate deletion via our Online Account & Data Deletion Portal.
  • Irrevocable Wipe: Deleting your account immediately triggers a database cascade deletion that irrevocably purges your user profile, escrow keys, and all encrypted notes from our production databases and backup snapshots.

8. Your Rights Under GDPR & CCPA

If you are a resident of the European Economic Area (EEA), the United Kingdom, or California, you are entitled to statutory rights including:

  • Right to Access: You may request an export of your account profile and encrypted data archives.
  • Right to Rectification: You may update your profile details at any time in the app settings.
  • Right to Erasure ("Right to Be Forgotten"): You may delete your account and all associated data instantly.
  • Right to Restrict or Object to Processing: You may opt-out of cloud synchronization and use Secret Diary in 100% offline mode.

9. Children's Privacy

Secret Diary is not directed to children under the age of 13 (or under 16 in the European Union). We do not knowingly collect personal data from children. If you believe a child has created an account without parental consent, please contact us immediately for prompt deletion.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect improvements or legal requirements. Material modifications will be announced through an in-app notice or via your registered email address before becoming effective.

11. Contact Us

For privacy inquiries, cryptographic questions, or data rights requests, please contact our Data Protection Officer:

Plixlify Studio
Email: support@secretdiary.plixlify.com
Website: secretdiary.plixlify.com