Privacy policy

Last updated 9 October 2026

Your child's journal stays on the iPad. Nothing about your child leaves it unless a grown-up sets up sharing — and then only what is listed in section 2, kept for your family alone, never used for advertising, analytics or tracking, and never sold. The app has no advertising, third-party analytics, or crash-reporting software.

1. What stays on your iPad

The app keeps the following on the device it is installed on and never sends it anywhere:

Profiles — a name, an optional photo, an optional four-digit PIN (stored only as a salted hash, never as the digits), and writing and practice settings such as the typeface, the size, and whether the practice sheet shows how each letter is formed.
The journal — the words your child spoke or typed, the pen strokes they wrote, accuracy scores, points, badges, and the date and time of each entry. A note a grown-up wrote back on a page (section 2) is kept with that entry once it has arrived.
Practice — which letters were traced on the practice sheet on which day, and the points that earned.
Setup and walkthroughs — that a grown-up agreed to these documents and to which version, whether they chose to let the iPad talk, and which of the app's short walkthroughs each child has already seen.
The grown-up PIN — four digits a signed-in grown-up chose, stored only as a salted hash in the iPad's keychain. The app asks for them before anything is sent, before a website opens, and before deleting or changing grown-up settings.

2. Sharing, when a grown-up turns it on

Version 1.2 lets a child send a finished page to their own grown-up, and — if a grown-up chooses — write notes to a friend whose family a grown-up invited. None of this happens until a grown-up signs in and agrees. Sharing uses a service we run for the app (the "relay"), hosted by Amazon Web Services in the United States. It holds only the following, for the family it belongs to:

The grown-up's account — the first name Sign in with Apple provides (or the one the grown-up gives), Apple's account identifier for our app, the name the children call them, and the answer to the age check: whether they are 18 or older, and how that is known. On iOS 26 or later Apple answers it. Before iOS 26 the app asks the year the grown-up was born; the year is not kept and never leaves the device, only the answer. An email address only if the grown-up signs in by email or asks to be emailed when a page arrives.
Consents — which agreement a grown-up gave, the words they agreed to, and when.
The family — its name as the grown-ups choose to show it to friend families, its grown-ups, and its paired iPads. Each iPad is known by a random identifier the relay makes, never Apple's device identifiers, and by a name a grown-up gives it on their iPhone (“iPad” until they do). Only the family's grown-ups see an iPad's name.
Children who may send — for each child a grown-up ticks on the iPad, a first name and a sticker. Never a photo, the journal, scores, voice, or location.
Pages sent to a grown-up — the page as a picture, the typed words under it, and the journal's date for it.
Notes a grown-up writes back — on a page a child sent them: up to 140 characters, a stamp, or both; which grown-up wrote it; and whether the iPad has it. Whether the child has read it stays on the iPad.
Notes to friends — the page as a picture and its words, which friend it is for, and each grown-up's answer (with the line a grown-up may write for their child).
Friend families — which families are friends, which of their children may write to each other, open invitations (with a copy of a page, if a grown-up chose to send one with it), and a child's request for a friend (the friend's first name as the child wrote or typed it, and a sticker).
Send to friends — the App Store's records of the subscription (see section 8).
Notifications — the tokens Apple gives the app to deliver notifications to a grown-up's iPhone and to wake a paired iPad, and whether a grown-up has switched on that iPad's alert (section 7).
Reports — a note a grown-up reported, with any reason they gave, until we have looked at it.

Who sees what. Pages go only to the child's own family's grown-ups: to all of them, or to the one grown-up the child chose, who is then the only one to see that page. A note a grown-up writes back on a page is read by the child, on the iPad that sent the page, and seen by the grown-ups that page went to; the child cannot answer it. A note to a friend is seen first by the child's own grown-up, then by the friend's grown-up, and only then by the friend. A friend family sees a child's first name and sticker, and the notes both families said yes to — never an email address, the rest of the journal, or where you live.

What an invitation shows. A grown-up invites another family with a link or a code. Whoever opens that link sees the inviting family's name as its grown-ups chose to show it, the first names of the children it offers, and — only if the inviting grown-up chose to send one — a page by one of those children. It is shown on the invitation's page on our website and in the app, until the invitation is answered, taken back or runs out. Send the link only to the family it is for.

How it travels. Pages and notes go straight from the iPad to storage, and back, through short-lived signed links over encrypted connections. Pairing codes and invitation links carry their secrets after the "#" in the address, which browsers do not send with the address. The invitation's page on our website hands its code to the relay, only to ask what that invitation shows; it asks nothing about the person opening it. The relay keeps logs to keep the service secure and working; they record what kind of request was made and whether it worked, not names or anything a child wrote, and are deleted after 30 days.

3. What the app does not collect

Handwritten Journal does not collect advertising identifiers, location, contacts, voice recordings, analytics or crash reports, on the iPad or anywhere else. Pen strokes, scores, badges and profile photos never leave the iPad.

4. Children

Handwritten Journal is designed for children and used with a grown-up. Children never sign in and have no accounts. Before any information about a child leaves the iPad, a grown-up signs in, an age check says they are 18 or older (Apple's on iOS 26 or later; before that, the app's own question), and they read exactly what will be sent and agree to it. Send to friends asks for a second, separate agreement, and a parent check: for the family that subscribes, its first payment; for an invited family, Apple's confirmed age check, which needs iOS 26 or later.

A child cannot find, search for or contact anyone. They can write only to a friend whose family a grown-up invited by a link, and only after that family accepted; every note passes a grown-up in both families before it is seen. A child can ask for a friend, but only a grown-up can invite a family. A page that goes with an invitation is one the inviting grown-up picked; a child cannot add one.

5. Your choices and rights

See everything we hold about your family, in the grown-ups' Settings on the iPhone.
Pause all sharing; untick a child so their name is deleted from the relay; switch off a friendship, or remove a friend family.
Delete a page, or remove a note from the Mailbox, at any time. Take back a note you wrote back on a page; on the iPad, a grown-up can remove any such note from the journal.
Stop sharing and leave: every iPad is unpaired and everything the relay holds about your family is deleted — including its notes in other families' Mailboxes. We keep only a record, with no names, of when the family left and which versions of our agreements it had given, as the law may require us to show.
Delete your account: your sign-in and profile are deleted, and the family too if no other grown-up is in it.

A parent or guardian can also ask us to review, correct or delete their child's information, or to stop collecting it, by writing to the address in section 12.

6. How long we keep it

What	How long
Pages sent to a grown-up	30 days, or until a grown-up deletes them
Notes a grown-up writes back	As long as the page they are on, or until taken back. If the page is deleted first, a note the iPad has not collected yet waits for it: until the iPad has it, and at most 30 days from when it was written. On the iPad it stays with the journal entry.
Notes to friends	Until both grown-ups answer (at most seven days from sending); a note given to a friend then stays 30 days in their Mailbox, or until a grown-up removes it. Pictures of notes that end sooner are deleted when they end.
Invitations; a child's request for a friend	14 days; 30 days
A page sent with an invitation	Until the invitation is answered or taken back; at most 14 days
Sign-in sessions	30 days without use, and at most 180 days
Notification tokens	180 days, or until replaced
Your account, family, children who may send, consents and subscription records	Until you leave or delete your account
A reported note	Until we have reviewed it; then a record of what was done, without the picture, for a year
Service logs	30 days

7. Speech and permissions

Speech is converted to text using Apple's on-device speech recognition. The app does not record audio or keep audio files: the microphone feeds the recognizer and nothing else.

The app also speaks. A grown-up chooses at the welcome whether the iPad talks, and every profile has its own Voice feedback switch in Settings. Every line it says is a recording made before release and shipped inside the app: nothing is generated on the iPad, and nothing your child says, writes, or is called is sent anywhere to be spoken. It never reads the journal, a friend's note, or a grown-up's note, aloud.

The app asks for permissions only when a feature needs them, explains why first, and works without each of them:

Permission	Used for	If you decline
Microphone and speech recognition	Turning what your child says into words to trace	The words can be typed instead
Camera	A profile photo, only when you tap Take Photo; scanning a grown-up's pairing code	Choose a photo from the library, or use the initial-letter avatar; type the code's six letters
Photos	Choosing a profile photo through the system picker; saving a page a child sent to a grown-up's photos	Use the initial-letter avatar; share the page instead
Notifications (the grown-up's iPhone)	Saying a page arrived or a note waits for an answer	Open the app to see what waits
Notifications (the child's iPad)	Only if a grown-up switches it on, behind the grown-up PIN: a quiet line on the lock screen saying a grown-up wrote back. It names no one, shows none of the note's words, and makes no sound.	It stays off; the note waits in the journal's Mailbox

When a grown-up exports a page or the journal as a PDF, or saves or shares a page, what happens to that file afterwards is governed by whichever app or service they choose.

8. We will never sell your data

The basic app is always free, because we want children to thrive. If we introduce additional features, they may be paid — because we will never sell your data, show advertising, or share what the app collects with anyone for their own purposes.

9. Purchases

Send to friends is an auto-renewable subscription sold by Apple through the App Store. Apple processes the payment; we never see card details. The relay receives Apple's signed records of the subscription — which product, when it started and renews, whether it was shared through Family Sharing, and a random identifier that ties it to your family — and checks them with Apple. Pages to a child's own grown-up are free.

10. Who helps us

Amazon Web Services hosts the relay, stores pages and notes, and sends email; Apple provides Sign in with Apple, the age check on iOS 26 or later, notifications and the App Store. They process this information only to provide those services to us. We do not use any other company to handle your family's information.

11. This website and changes to this policy

This website is a set of static pages with no forms, analytics, advertising, or third-party tracking scripts. The company that hosts the site may keep standard server logs, such as the requesting address, the time, and the page requested, for security and reliability. If you email us, we keep your message for as long as we need it to reply and keep a record of the conversation.

If the app or the website changes in a way that affects this policy, the policy will be updated here with the date at the top before that version is released, and the app will ask a grown-up to agree again.

12. Contact

Questions about privacy, or a request about your child's information: hello@handwrittenjournal.app.