Our core commitment: Your journal entries are stored exclusively on your device, encrypted with a key held only in your device's Secure Enclave. We cannot read them. We do not sell your personal information. We do not use your journal content for advertising.
Marrow Journal is a private journaling application developed and operated by family.one ("we," "us," or "our"). We built Marrow Journal on a single principle: your most private thoughts belong to you, and only you. This Privacy Policy explains what personal information we handle, why we handle it, how it is protected, and what rights you have over it.
This Policy applies to:
By using Marrow Journal you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, please do not use Marrow Journal.
The data controller responsible for personal information processed in connection with Marrow Journal is:
Company: family.one
Privacy inquiries: please use the contact form on this website (choose the topic that best matches your request). We do not publish a direct email address.
For users in the European Economic Area ("EEA") or United Kingdom ("UK"), family.one acts as the data controller within the meaning of the General Data Protection Regulation ("GDPR") and UK GDPR. If you are in the EEA or UK and believe we have not adequately addressed your privacy concern, you have the right to lodge a complaint with your local supervisory authority.
For users in Canada, family.one is the organization accountable for personal information under the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation.
The following information is created by you, processed locally, and stored only on your device. It never leaves your device unless you explicitly enable an optional cloud feature:
Despite Marrow Journal's local-first design, a limited set of information reaches our servers:
We collect a small, strictly controlled set of anonymised usage events to understand how the app is used and improve it. Our telemetry schema is enforced by technical controls that prohibit string fields and block any free-text data. The only events we collect are:
Telemetry events contain only numeric and boolean values. No journal text, transcripts, emotion descriptions, entry content, or other free-text data is ever included.
When you use certain optional cloud features, your device generates an attestation assertion using Apple's App Attest framework. This assertion verifies that the request originates from a genuine, unmodified version of Marrow Journal running on a real Apple device. We use this assertion only to issue a short-lived access token; we do not retain personal information derived from App Attest assertions.
If you enable daily reminders, your device's Apple Push Notification Service ("APNs") token is stored on our servers. This token is used solely to send your scheduled reminders. Disabling notifications removes your token from our servers.
When you purchase a subscription, payment is processed by Apple through the App Store. We receive an encrypted receipt or entitlement record confirming your subscription status. We do not receive your payment card number, bank account details, or full financial information.
Marrow Journal offers two optional features that involve data leaving your device. Each must be explicitly enabled by you:
If you enable iCloud Sync in Settings, your encrypted journal files are copied to your personal iCloud Drive storage. Important:
On devices that cannot comfortably run the full on-device AI model, you may optionally enable cloud-assisted processing. If enabled:
| Information | Purpose(s) |
|---|---|
| Journal entries (on-device) | Core journaling experience; on-device AI question generation; identifying connected moments; emotional arc tracking. Not transmitted to us. |
| Derived insights (on-device) | Surfacing patterns, themes, and connected moments within the app. Not transmitted to us. |
| Anonymised telemetry | Understanding aggregate feature usage; improving Marrow Journal's design and performance. |
| App Attest assertion | Verifying device and app integrity for optional cloud requests; issuing short-lived access tokens. |
| APNs token | Delivering your scheduled daily reminder notification. |
| Subscription record | Verifying your entitlement to premium features. |
| iCloud sync (opt-in) | Backing up and synchronising your encrypted journal files across your Apple devices. |
| Semantic embeddings (opt-in) | Generating follow-up questions on our servers for the current entry only. Not retained. |
We do not use your information for:
Regardless of your location, you have the following controls:
If you are located in the EEA or UK, you have the following rights regarding personal data we process on our servers:
To exercise any of the above rights, submit a request through our contact form and we will respond within 30 days.
If you are a California resident, you have the following rights under the California Consumer Privacy Act:
We do not sell personal information or share it for cross-context behavioural advertising.
If you are a Canadian resident, you have the following rights under PIPEDA:
Marrow Journal is intended for users age 13 and older (or 16 in the EEA/UK where required). We do not knowingly collect personal information from children below the applicable minimum age. If you believe a child has provided personal information to us, please reach us through the contact form.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the features of Marrow Journal. For material changes, we will notify you via an in-app notice before the change takes effect. Continued use of Marrow Journal after the updated Policy is posted constitutes your acceptance of the changes.
Please use the contact form on this website for any privacy-related inquiry. We aim to respond within 30 days. We do not publish a direct email address.