Joyful privacy policy

Who this covers

This policy covers the Joyful app, made by Pettigrew Lab LLC, on every device it runs on.

What Joyful stores, and where

Everything you put in the app: the people you add, what you record about them, your memories and photos, your milestones, your gift ideas and your settings.

All of it is stored on your device and nowhere else. Each record is encrypted with AES-GCM under a random key Joyful creates on your phone the first time you open it. That key stays in the app’s own storage, in a form the app can use but nothing can read back out, and it’s never transmitted or seen by us.

One exception to the encryption: the home-screen widget, on Android. If you add it, Joyful keeps the picture the widget shows as an ordinary image file in the app’s private storage, because your phone’s home screen has to be able to draw it. Other apps can’t read that file, and it’s removed when you take the widget off or delete the journal. If you never add the widget, the file is never made.

Joyful doesn’t have its own lock screen. Your phone’s screen lock is what keeps the journal private, so anyone who can get into your unlocked phone can open it. Keep a screen lock on your phone.

What we collect

Nothing. There’s no account to create, no sign-in, no profile, no analytics or crash reporting, no advertising and no third-party SDK that observes what you do.

We have no server that holds your journal, so there’s nothing for us to hand over, sell, lose or be compelled to disclose.

When Joyful uses the internet

Once, and only if you choose to pay: buying the one-time unlock that opens the journal past three friendships goes through the store you got Joyful from: Google Play on Android, the App Store on iPhone. That transaction is handled entirely by Google or Apple and never includes anything you have written.

Nothing else in the app opens a network connection. A link you share into Joyful from another app is stored as text exactly as it arrived; Joyful doesn’t fetch it, and doesn’t download a preview of it. If you tap a saved link, your phone opens it in your browser, the same as tapping a link anywhere else.

Reminders

Milestone reminders, and the optional nudge on days with a memory from an earlier year, are scheduled by your phone for itself. There is no push service, so no reminder passes through us or anyone else, and they work with no connection.

Because your phone stores scheduled notifications outside the app’s encryption, Joyful leaves your friends’ names out of reminder text by default. A reminder says that something is coming up, not who it is about. You can turn names on in Settings, and the app explains the trade before you do.

Backups you make yourself

Because the journal lives only on your device, Joyful can export an encrypted backup file. It’s protected by a passphrase you choose and is unreadable without it, so it’s safe to keep wherever you like.

Joyful can also export a calendar file of your milestones, and a shareable web page of a friendship you want to give to someone. The app states clearly that this shared page is no longer encrypted. That’s the point of giving it to a person.

What you do with any exported file after Joyful has created it is up to you. Anywhere you put it is covered by that service’s own policies, not this one.

Phone backups

Joyful keeps your journal out of your phone’s automatic backups. On Android it isn’t copied to your Google Drive, and on iPhone it isn’t copied to iCloud or to a computer backup. Moving to a new phone is what the encrypted backup export is for.

Permissions

Internet: used by the store purchase for the one-time unlock, and nothing else.

Notifications: used to show milestone reminders your device has scheduled for itself.

Contacts: only if you tap “From your contacts” when adding a friend. You pick one person in your phone’s own contact picker, and Joyful reads that one person’s name and birthday and nothing else. On iPhone the picker hands them over without any contacts permission. On Android, Joyful asks for the permission after you pick, only to read that birthday; say no and the name still comes over. Either way they go into your journal on your phone and are never sent anywhere.

Joyful doesn’t ask for your location, your microphone or your files. “Snap a memory” uses your phone’s camera for the one photo you take. On Android it hands off to your camera app with no camera permission; on iPhone, iOS asks you the first time. Other photos are chosen by you, one at a time, through the system picker.

Children

Joyful isn’t directed at children and collects nothing from anyone, of any age.

Deleting everything

Settings has a “Delete this journal from the device” button that removes everything immediately and can’t be undone. Uninstalling the app also removes it.

There’s no server-side copy, so there’s nothing else to request the deletion of. If you’d like that confirmed in writing, email us and we’ll say so.

Changes

If this policy changes, the date at the top changes with it, and the updated policy is published here before the release it describes.