Security and your data

How your record is protected, how you get it back, and how long we keep it.

How your record is encrypted

Everything you put in Elephant Diary is encrypted in your browser before it leaves your device: entries, photos, screenshots, recordings, receipts, documents, your settings and your lawyer's details. We receive and store only the encrypted version.

• Your record has its own key. When you create your account, your device makes a random 256-bit key. Everything is encrypted with it using AES-256-GCM, which also detects any tampering with the encrypted data.
• Your password locks that key. Your device turns your password into a second key (PBKDF2 with SHA-256, 600,000 rounds, which makes guessing passwords slow), and uses it to lock your record's key. We store only the locked copy.
• Your password never leaves your device. To log you in, your device sends a separate sign-in token made from your password. We keep only a one-way hash of that token, which can't be turned back into your password or your key.
• Connections are encrypted too (HTTPS), and you can turn on two-step verification so a code by email is needed each time you log in.

Sealed, so changes show

Each entry is sealed with a SHA-256 fingerprint that includes the entry before it, so entries form a chain. Our server stamps each entry with the time it arrived and refuses to change or remove a single entry. If anything were altered or taken out, the chain would no longer check out. The lawyer package explains how to check it.

What we can and can't see

• We can't see what your entries say, your photos, recordings or documents, your children's names, the other parent's details, your settings or your lawyer's details.
• We can see your email address, when you joined, your subscription status, and that an entry or file arrived, when, and how large it is. We also see what you send us yourself, such as feedback and support emails.
• Payments go through Stripe. We never see your card number.

Getting your record back

• Log in on any phone or computer with your email and password. Your record opens there and nowhere else: when you log out or close the page, nothing is left on the device.
• Forgot your password? Your recovery code, given to you when you sign up, plus a code sent to your email, lets you choose a new one. Your record stays as it was.
• Lost both your password and your recovery code? Then nobody can open your record, including us. That's the cost of a record that only you can read. Keep your recovery code somewhere safe, away from your phone.
• Assisted recovery is an option you can turn on in Settings. We keep a copy of your key, locked by a separate key on our server, so an emailed code alone can reset your password. It's easier, but while it's on we technically could open your record. It's off unless you turn it on, and turning it off deletes our copy.
• Take a copy any time while your account is open: the lawyer package as a PDF, or every entry as a spreadsheet (CSV).

How long we keep your data

Separation doesn't run on a schedule. Things can be calm for months and then flare up again, so we don't delete a record the day a payment stops.

1. While your account is open, we keep everything so the app works.
2. If your trial ends, your subscription ends or a payment fails, your record is locked. It's kept as it is, but it can't be opened or downloaded until you choose a plan again. We email you when it locks, with the date it would be deleted.
3. Come back any time within 12 months. Choose a plan and everything opens as it was. You carry on where you left off, and your new entries join the same unbroken chain.
4. 30 days and 7 days before the 12 months are up, we email you again.
5. After 12 months locked, we delete your account and everything in it: every entry, photo, recording and document, and your settings. It can't be recovered, by you or by us. You're welcome to start a new account, but it starts empty.

• Planning to stop? Download your PDF and spreadsheet before your subscription ends, so you keep a copy whatever happens.
• Want it deleted sooner? Write to support@elephantdiary.com from your account's email and we'll delete it within 30 days. It also leaves our nightly backups as they expire, within about 5 weeks.
• Billing records (what you paid and when) are kept by us and Stripe as long as tax law requires. They don't include anything from your record.

Where it's stored

Your encrypted record and account details are stored on our servers in the United States (Hostinger). We plan to move them to Canada. The app itself is delivered by Cloudflare, which never receives your record. The database is backed up every night; backups hold the same encrypted data.

What you can do

• Use a strong password you don't use anywhere else, and turn on two-step verification.
• Keep your recovery code safe and private. Anyone with it and access to your email could reset your password.
• Lock your phone and computer, and log out on devices other people use.

No system is perfectly secure. Encryption means that even if someone broke into our servers, they wouldn't get the contents of your record. If you think you've found a security problem, please tell us at support@elephantdiary.com.