The short version

GravesWare receives nothing from GravesDiary. Your diary stays on your computer, encrypted, and goes to a sync folder only if you choose one. Nothing you write is ever sent to GravesWare.

What we collect

Nothing.

GravesDiary contains no telemetry, no analytics, no crash reporting, no update check, no advertising and no licensing call-home. There is no GravesWare account to create and nothing to sign in to. GravesDiary connects to no GravesWare server, because there is none.

GravesWare, LLC does not receive your entries, your photos, your tags, the names of the people you write about, your password, your sync passphrase, your backups or their passphrase, or any record of when or how you use the software. What Microsoft reports to GravesWare about a copy from the Microsoft Store is described under The Microsoft Store version below.

What is stored on your computer

Your diary

Every entry, its rating, mood, tags, people and place, and every photo or file you attach, in one encrypted database, with the files SQLite keeps beside it while it is open:

The whole file is encrypted with AES-256 (SQLCipher). With a password, the password is the key. Without one, the key is a random value in device.key in the same folder, which only your user account can read: that protects a copy of the diary file, but not the diary from someone signed in as you.

The settings GravesDiary keeps — which sync folder, the key that opens it, a random identifier for this computer used only to name its folder in the sync folder, which backup folder, and the key that backups are encrypted with — are inside the same encrypted database.

THE MICROSOFT STORE VERSION KEEPS THIS FOLDER WHERE WINDOWS PUTS EVERY STORE APP’S DATA, under %LOCALAPPDATA%\Packages, AND WINDOWS DELETES IT WHEN THE APP IS UNINSTALLED. Your diary goes with it. Make a backup to a folder of your own choosing, or set up a sync folder, before uninstalling.

Your language

The language you choose in Settings, so GravesDiary comes back in it.

It holds a language code and nothing else, and only your account can read it. It is kept outside the encrypted diary because the window that asks for your password needs it before the diary can be opened.

Backups

If you set up backups, each one is a single file in the folder you chose, holding the whole diary — entries, photos and files, and settings — encrypted with AES-256 under a key that your backup passphrase unlocks. GravesDiary writes backups nowhere else and sends them nowhere.

While a backup is being made, and while one is being restored, a working copy of the diary exists in the diary folder. It is encrypted, and it is removed when the backup or restore finishes. After a restore, the diary that was replaced is kept in that folder, still encrypted, as diary.db.before-restore, until the next restore replaces it.

A backup’s file name, size and date are not encrypted.

Exports

An export writes the entries you choose to a file where you choose, unencrypted, because that is what you asked for. GravesDiary sends it nowhere.

Photos while you look at them

A photo opened from an entry is decoded in memory and shown from there. It is never written out to a temporary file. Thumbnails are made the same way.

Copies you ask for

“Save a copy” on an attachment writes it where you choose, unencrypted, because that is what you asked for.

GravesDiary keeps no log.

The editor

The page you write on is displayed by the web engine your system provides: Microsoft Edge WebView2 on Windows, WebKitGTK on Linux. GravesDiary loads nothing from the internet into it; the page forbids it, and links in an entry do not open inside it. On Linux GravesDiary tells WebKitGTK to keep no cache or storage on disk. These engines are parts of your system, kept up to date by your system’s own update mechanism, not by GravesDiary.

Passwords and passphrases

Your diary password is never written to disk. While the diary is open, the encryption library holds the key derived from it in memory, because the diary cannot be read or written without it.

The sync passphrase is not stored either. What is stored, inside the encrypted diary, is the sync folder’s key that the passphrase unlocked, so that you are asked once per computer rather than every time.

The backup passphrase is not stored either. What is stored, inside the encrypted diary, is the key that backups are encrypted with, so that making a backup does not ask for the passphrase each time, and a copy of that key locked by the passphrase, which is written into each backup file so that the passphrase alone can open it on another computer.

An attacker who can read the memory of a running process, capture a crash dump, or read a swap file may still recover a key while the diary is open. No application-level measure can prevent that.

If you forget your password, your sync passphrase or your backup passphrase, GravesWare cannot recover it and neither can anyone else. There is no backdoor, no recovery key, and no master password. This is the intended behaviour of the encryption, not a limitation of the software.

Sync folders

If you choose a sync folder in Settings, GravesDiary writes your changes into it and reads other computers’ changes from it. That is the only place it ever writes your diary other than your own computer.

With a sync passphrase, every file GravesDiary writes there is encrypted with AES-256-GCM, including attachments and the name of each computer. What stays visible to anyone who can see the folder — including the provider of the service that copies it — is that the files exist, how many there are, their sizes and when they were written.

Without a sync passphrase, which GravesDiary asks you to confirm, the files are readable by anyone who can see the folder, including that provider.

GravesDiary does not connect to OneDrive, Dropbox, Google Drive or any other service. It writes files to a folder on your computer; the service you have set up copies that folder, under its own terms and privacy policy.

What leaves your computer

Only what you send yourself:

GravesDiary initiates no other transfer.

The Microsoft Store version

When GravesDiary is obtained through the Microsoft Store, that involves Microsoft, not GravesDiary, and it is described here so nothing is left out.

Purchases

If you buy GravesDiary, Microsoft processes the purchase. GravesWare, LLC does not receive or store payment card details, and is not told your name or email address.

Your licence

Windows and the Microsoft Store check that your copy is licensed, as they do for every app from the Store. GravesDiary makes no licensing check of its own.

Reports Microsoft gives GravesWare

Microsoft gives every publisher reports on its Store apps: how many copies were acquired, in which countries, and the ratings and reviews customers choose to post. Depending on your Windows diagnostic data settings, Windows may also tell Microsoft how often apps are used and when they crash, and Microsoft shows publishers totals and crash summaries from that. These reports are made by Windows and Microsoft, are governed by your Windows settings and Microsoft’s privacy statement, and do not identify you to GravesWare. GravesDiary adds nothing to them.

To limit what Windows sends, see Settings > Privacy & security > Diagnostics & feedback.

Children

GravesDiary collects no information from anyone, including children.

Changes

If this statement changes, the revised version ships with the release it applies to. Because nothing is collected, changes here describe the software’s behaviour rather than any use of your data.

Contact

Questions about this statement, or about what GravesDiary does with your diary:

GravesWare, LLC
support@gravesware.com