How to keep a journal private (and why the lock is the easy part)

The founding experiment of expressive writing had a condition almost nobody remembers. One group of students was told to write about an upsetting event and to leave their feelings out entirely: the event in narrative form, nothing else. Months later that group looked like the control group, whose four sessions were spent describing their living rooms, the shoes they were wearing and a tree. Which is what privacy in a journal is actually for. Not guarding the pages you already wrote, but making possible the sentences you would never write with someone reading.

Almost everything published about how to keep a journal private is about the object — the lockable notebook, the passcode, the folder with a boring name. That advice is sound, and there is a version of it further down. It solves the smaller half of the problem.

The reader you imagine edits you first

Before anyone opens your journal, you have opened it for them. Most people write with a specific figure in mind. A partner, a roommate, a sibling who once read a diary out loud, a version of yourself in ten years. That figure sets the terms. What happened, yes. What it did to you, not in those words. The result is a record that is accurate and inert.

Pennebaker and Beall (1986) built that exact split into an experiment. Forty-six undergraduates wrote for fifteen minutes a night, four nights running, alone in cubicles. One group got trivial assigned topics. One wrote only about their feelings, with no mention of what had happened. One described the upsetting event and was instructed not to refer to their feelings at all. The fourth wrote both.

Four to six months later the researchers pulled student health center records. Illness visits rose by an average of 1.00 in the control group. They rose 1.18 among the students who wrote only the facts, and 1.25 among those who wrote only the feelings. The group that wrote both came out at 0.00. Two things should be said plainly. The interaction was marginal by conventional standards, F(3,42) = 2.74, p = .055. Forty-six students, eleven or twelve to a condition, is a small sample. The authors called their own work preliminary, and forty years later that is still the honest way to hold it.

The honest limit is that nobody in those cubicles was censoring themselves. The constraint arrived from outside, from an experimenter with instructions. The imaginary reader applies the same constraint from the inside, which makes this an analogy rather than a result. The shape is identical, though. Facts survive an audience. Feelings do not.

There is a subtler cost. Writing for someone makes you reach for the presentable word instead of the accurate one: stressed, fine, a lot going on. Barrett, Gross, Christensen and Benvenuto (2001) tracked people through a fourteen-day diary. Those who told their negative emotions apart in finer detail reached for regulation strategies more often, especially when the feeling was intense. The link is correlational, and it did not show up for positive emotions. Still, the imaginary reader takes precisely the vocabulary that was going to be useful.

Hiding the notebook protects the pages you already wrote

Physical secrecy is better than technical people admit and weaker than its fans believe. A paper notebook has no account, no terms of service, and no company that might change its policy in 2029. Live alone, and a notebook on a shelf is already more private than most things with a login. That is a real advantage, and pretending otherwise would be dishonest.

Its failure mode is that it depends on nobody having a reason to look. Reasons show up: a move, an illness, a curious teenager, someone tidying with good intentions. A passcode is a different category of protection, because it does not depend on a location staying secret. The two mediums trade off in more ways than this one, and the honest comparison of paper against an app covers the rest of them.

Neither one changes the audience in your head. That audience is not reading the finished page. It is standing behind the chair while you write.

Five questions to ask about wherever you write

Judge the place you write the way you would judge anywhere you keep sensitive documents — with five questions instead of a feeling. Who can open it without you. What happens if you lose it. Whether you can take everything out. Whether you can make it gone. What the people running it do with what is inside. Anything that cannot answer all five in plain language is not private, whatever its landing page says.

Who can open it without you. Not “is it secure” in the abstract, but who, by name. The shared family account. The laptop that never locks. The browser that autofills the password for anyone sitting at the desk. The machine your employer owns. On paper: everyone in the house with hands and a reason. The list is usually shorter and far more specific than the vague dread, and writing it down tells you what to change.

What happens if you lose it. A notebook is a single object: it stays in a taxi, it gets soaked, it disappears in a move with three years inside it. Digital storage inverts the risk — harder to lose, easier to copy. Neither medium is the safe one in the abstract, and choosing between them is choosing which of the two risks you would rather carry.

Whether you can take everything out. A journal you cannot export is a journal you are renting. Look for plain text, Markdown or PDF containing your actual entries — not a summary, not a chart of your moods. Paper passes this one by default, which is part of why people keep going back to it.

Whether you can make it gone. Two levels: deleting a single entry, and deleting everything. The question underneath is the one worth asking support directly — does closing the account delete the data, or only your access to it. On paper the answer is a shredder, and it is final in a way screens rarely are.

What the people running it do with what is inside. For anything digital, three claims should be findable in under a minute. Whether your text is encrypted in transit and at rest. Whether it is used to train models. Whether data is sold to anyone. A product that does not state all three has not decided all three. Silence is an answer.

Since we build one of these, the same five questions applied to it, and no further. Pluto Bloom encrypts your entries in transit and at rest, does not use your writing to train models, and does not sell data. Deleting your account from the app deletes what you wrote, not only your access to it. Two answers go against us. There is no export: you cannot download your entries as a file today. And the delete is account-wide, not entry by entry. If either one is your criterion, that is a fair reason to write somewhere else. There is no end-to-end encryption either, and we will not say otherwise. Your words are processed on a server, which is what makes it possible to quote them back to you with a date months later. If your standard is that no server ever sees what you write, the honest recommendation is paper, or an encrypted file on a machine you own.

How to tell whether your setup is private enough

There is a test for this that requires no technical knowledge. Write the sentence you have been rounding off — the resentment named exactly, the number, the person’s actual name — and then notice what you do next. If you can close the notebook or the app and leave it there, the setup is working. If you go back within the hour to soften it, the place is not private enough yet, and you have just learned something useful.

When that happens, change the place rather than the sentence. That order matters. Moving a journal to a locked app, a different account or a drawer nobody has business opening is a small logistical task. Trimming the sentence is a permanent tax on every entry you will ever write, paid quietly, and you stop noticing you are paying it.

There is also a legitimate version of not writing something. Some things you decide, deliberately, to keep out of any record at all — that is a choice about your life, not self-censorship. The difference is who made it. A choice you made is fine. A choice made for you by a lock you do not trust is the thing this whole piece is about.

And if you are starting from nothing, the format matters less than any of this. Five minutes and one honest question is a session, as the guide to starting lays out. Where you keep it decides what goes in.

Privacy is not a feature of the notebook. It is the condition under which the useful sentences turn up at all — the ones with a name in them, the ones that cost something to write. Lock what needs locking. Then write the part you would have edited out.