Meridian Privacy Policy

In the iOS app — your journal

Journal entries are created by you and stored locally on your device. While you are signed in, they are also backed up to our servers so they survive deleting the app and restore on a new device. This backup is a required part of having an account and cannot be turned off separately; if you do not want your entries on our servers, use the app without signing in.

The text of each entry is encrypted with a key unique to your account before it leaves your device. To be precise about what that does and does not mean: Meridian holds that key. This is a deliberate design choice — it is what lets us restore your journal onto a new device and run Meridian’s AI features on it (see “AI features” below). It also means entry text is not end-to-end encrypted, and we are technically able to decrypt it. We decrypt it only transiently, to run those features. We never use your journal content to train models, and it is never shown to other users.

Not everything is encrypted. The following are stored in a readable form, protected by access controls rather than encryption: photos you attach to entries; entry dates and word counts; themes and emotion labels derived by AI; place names and coordinates attached to entries (see “Location” below); folder names; goal titles; and numeric representations of entry meaning used for search and insights.

The names of the people, places and threads Meridian’s AI finds in your entries, and the names it gives the chapters of your galaxy, are encrypted; we match repeat mentions using a keyed fingerprint of each name rather than the name itself. Details stored in readable form about these items include what type of item each is, how a person relates to you (for example, “friend” or “family”), whether it is ongoing or finished, when and how often it comes up, where in an entry it appears (a position, not the words), and whether an entry touches a sensitive topic (the topic itself is encrypted). Notes you add about a person, place or thread, and the summaries Meridian writes for their pages, are encrypted under your per-account key.

Entries you share with other people are encrypted the same way. When you deliberately share an entry with a friend or a circle, its text is encrypted with your account’s key before it leaves your device, as your journal entries are. Meridian holds that key, and decrypts a shared entry only to show it to the people you shared it with, while they are still your friends or members of that circle. When you, or someone you have shared with, opens Social insights, their app sends the text of the entries shared between you to our backend and our AI provider to produce those insights; nothing from that analysis is kept on our servers. Comments written on a shared entry are stored in readable form.

Handwriting photos (optional) may be captured by you to extract text. Optical character recognition (OCR) is performed entirely on-device using Apple frameworks — the image is never sent to our servers for OCR. If you keep the photo on the entry, it is backed up with that entry as described above.

Voice entries (optional) are transcribed on your device. On iOS 26 and later, Meridian normally uses Apple’s on-device speech recognition; otherwise, it uses a speech-recognition model that the app downloads once from its publisher’s repository on Hugging Face and then runs on your device. Your audio is not stored and is not sent to us.

Location (optional). If you allow location access, the iOS app tags new entries with the place where they were written by default, using Apple’s location services; you can also search for a place with Apple Maps. The place name and its coordinates are saved with the entry, which shows the name so you can change or clear it, and are used for your own places map. Places you only mention in your writing are never looked up on a map.

Screen Time settings (optional) — if you enable app locking, you choose which apps to shield. Meridian uses Apple’s Family Controls APIs to apply shields based on your settings.

In the iOS app — account and cloud-synced data

If you create an account (email/password, Sign in with Apple, or Google), we collect authentication information through Supabase, our authentication and backend provider. This may include your email address and account identifiers.

When signed in, we sync certain account data to Supabase, including:

• Your journal entry text — encrypted at rest with a per-account key that Meridian holds (see above)
• Your photos, folder names, entry dates, word counts, AI-derived themes and emotion labels, and the places attached to your entries — stored in readable form, access-controlled to your account
• Notes you add to the pages for the people, places and threads in your galaxy — encrypted under your per-account key
• Profile information (such as display name and timezone, if provided)
• Stardust balance, streak count, and transaction ledger (reason strings only — not journal text)
• Subscription tier and status (free or Pro)
• Daily AI usage counters (feature call counts, not entry content)

Notifications. If you allow notifications, we store the push token for your iPhone or, in the web app, the push subscription your browser provides (an address at your browser’s push service and the keys used to encrypt messages to it), so that we can send reminders and notifications about your friends. Web notifications are delivered through your browser’s push service (for example, Apple, Google or Mozilla). Notifications we send never contain the text of your entries or the names of the people, places and threads in your journal. A notification about a friend can show that friend’s name and, when a friend sends you a question, the question itself. Some reminders are created by the iOS app on your device itself and can name a thread, goal, person or place from your journal; those are not sent through us.

In the web app

The web app at app.journalmeridian.com uses the same account and journal as the iOS app, and handles them as described in this policy. It does not use product analytics, session replay or crash-reporting services.

Voice in the web app (optional) runs on your device where your browser supports it, using a speech-recognition model downloaded once from our own storage and kept in your browser. Where it does not, the web app uses your browser’s built-in speech recognition, which may send your audio to your browser’s provider (for example, Google or Apple) under that provider’s terms; the web app tells you this before you record. Meridian does not store your audio.

In the Android app

The Android app uses the same account and journal as the iOS app, and handles them as described in this policy: your entries are stored on your phone and, while you are signed in, their text is encrypted with your per-account key before it leaves your phone and is backed up; photos, shared entries and Meridian’s AI features work as described above. Where it differs:

• Signing in. You can create an account or sign in with an email and password, with Google, or with a code that you approve in Meridian on another phone where you are already signed in. The Android app does not offer Sign in with Apple.
• Voice entries (optional) are transcribed by your phone’s speech recognizer. Where your phone can recognize your language on the device, your audio does not leave it. Where it cannot, the recognizer uses its maker’s online speech service (on most phones, Google’s), which receives your audio under that maker’s terms; the app tells you this before you record, and you can type instead. Meridian does not receive or store your audio.
• Location (optional). If you allow location access, the Android app tags new entries with the place where they were written, using your phone’s location services, and your phone’s geocoder (on most phones, Google’s) turns that position into a place name. You can also type a place name instead. The place name and its coordinates are saved with the entry, which shows the name so you can change or clear it. Places you only mention in your writing are never looked up on a map.
• Notifications. If you allow notifications, we store your phone’s push token from Google’s Firebase Cloud Messaging, which delivers our notifications to Android phones. Reminders are scheduled on our servers for the times you choose. As everywhere, notifications never contain the text of your entries or the names of the people, places and threads in your journal.
• Purchases. Nothing is sold in the Android app. A subscription bought in the iOS app shows as part of your account.
• Analytics and crash reports. The Android app sends product analytics events to PostHog and crash reports to Sentry, as described below, identified only by your internal account identifier. Like the iOS app, it uses session replay with sensitive content masked, as described below, and it does not use the Android advertising ID.

Product analytics and error reporting

We collect product analytics and error/crash reports in the iOS and Android apps using third-party services. We send product analytics events to PostHog (hosted on their US cloud, at us.i.posthog.com) and crash reports to Sentry.

The data sent to these third-party processors includes event names, event properties (such as counts, settings and which feature was used), app version and device information, an internal account identifier attached to each event while you are signed in, and crash stack traces. From the iOS and Android apps, we do not send your email address or your name to these services; your account is identified to them only by that internal identifier. Analytics event properties and crash reports never include journal entry text or search queries.

In the iOS and Android apps, we also use PostHog's session replay feature, which records a visual reconstruction of how the app is used (the screens visited, taps and scrolls, and technical details of the network requests made, such as their addresses and timings but not their contents) to help us understand how people use Meridian and diagnose issues. Session replay is configured to mask sensitive content on your device before a recording is captured. Journal entries and their photos, the camera view, AI-written summaries and suggestions, the names of the people and places in your journal and of your friends, Ask conversations, messages and entries shared with friends, search terms, and sign-in details such as your email address and password appear in a recording as blank blocks rather than as their contents.

Analytics are linked to your account. While you are signed in, analytics events — and the session recordings captured alongside them — carry an internal account identifier, so we can tell that a set of activity belongs to one person rather than to one device. We do this so our usage numbers are accurate: without it, the same person signing in on a phone and a tablet counts as two different users. It means that a session recording can be traced back to your account, and therefore to the account data described above (such as your email, streak, and subscription status).

We use this only to understand and improve how Meridian works, as described in “How We Use Information” below. Signing out ends the link for activity that follows it, and you can ask us to delete the analytics and recordings held against your account — see “Your Choices and Rights”.

On this website

If you join the waitlist, we collect first name, last name (optional), and email address so we can contact you about early access and product updates. When you join, we also record a sign-up event in PostHog that is identified by the email address you entered.

This website uses PostHog to measure visits and how visitors use its pages (for example, page views and button clicks), which may include session replay with form inputs masked, and Sentry to report errors. It also uses the Meta Pixel, which tells Meta when a page is visited and, on some pages, when a visitor taps through to the App Store, so that we can measure our advertising on Meta’s platforms. These services may use cookies or similar technologies in your browser.