How Dogood handles your data

Your journal

Entries, chapters, goals, habits, your book settings and preferences are saved in your browser’s own database (IndexedDB) on the device you use. They are not uploaded to Dogood. If you turn on sync (below), a copy goes to your own Google Drive, not to Dogood.

Because the journal lives in your browser, clearing that browser’s site data erases it. You can export a complete backup file at any time and restore it later, on the same or another device.

Dogood also keeps one yes-or-no note in your browser’s local storage saying whether a journal exists there, so opening Dogood’s address takes you straight to your journal instead of this site. It never leaves your device.

Encryption

If you add a passphrase, Dogood encrypts entry titles and text, chapter names, goals, habits and the days you ticked them, book settings and image links on your device with AES-256-GCM. The key is derived from your passphrase with PBKDF2 (SHA-256, 310,000 rounds), kept only in memory while Dogood is unlocked, and cleared when it locks — automatically after a period without activity.

Dates, moods and word counts are stored unencrypted so the calendar and statistics can be calculated. Backups of an encrypted journal stay encrypted. There is no recovery key: a forgotten passphrase cannot be reset.

On a device, you can also choose to unlock with a PIN of 6 to 8 digits, or with Face ID or a fingerprint. Each keeps a copy of the journal key on that device, encrypted under the PIN (PBKDF2, 1,000,000 rounds) or under a secret only your device’s passkey can give (WebAuthn PRF). Five wrong PINs turn the PIN off. Neither leaves the device, neither is in backups, and your passphrase still opens everything.

Photos

Photos you add from your device are resized on it and kept in the journal, in the same browser database, encrypted like the rest when you use a passphrase. They are part of your backups and are never uploaded.

For images added as links to the web, Dogood saves the link, not the file. Your browser loads each one from the website that hosts it, which may see your IP address, as with any image on the web. Dogood asks browsers not to send the page address along with those requests.

Sync with Google Drive (Dogood Plus, opt-in)

Sync is off unless you turn it on. Then Dogood keeps your journal in a hidden folder of your own Google Drive, the application data folder, which only Dogood can open: neither you, other apps nor other files see it there, and Dogood sees nothing else in your Drive. Every device signed in with the same Google account keeps the whole journal and adds what was written on the others. Your journal goes straight from your browser to Google; it never passes through Dogood, and Dogood never learns your Google account.

What is copied: your days and their photos, chapters, goals, habits, spaces, book settings, the timeline’s dates and the Dogood Plus licence. Preferences that belong to a device, such as quick unlock, usage sharing or a backup folder, stay on it. When your journal is protected with a passphrase, everything is sealed on your device before it leaves (AES-256-GCM, with the journal’s key): Google then holds files whose names and sizes it can see, never a word, a date, a mood or a photo. Without a passphrase, the copy on Drive is not encrypted by Dogood, and Google stores it like your other files.

Google signs Dogood in with a token that lasts an hour and is kept in memory only, with access to that folder alone (the drive.appdata permission). Dogood keeps on the device the address of the Google account, to show where your journal is synced, and what it last saw on Drive, to tell what changed. You can stop syncing on a device at any time, and erase Dogood’s folder on Drive from the app; you can also remove Dogood’s access from your Google account settings. Google’s handling of what it stores is set by its own privacy policy.

Dogood’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: what Dogood reads from your Drive is used only to keep your journal the same on your devices; it is never sent to Dogood or anyone else, never sold, never used for advertising, and never read by a person.

Usage sharing (anonymous, opt-in)

Usage sharing is off by default. If you turn it on — during onboarding or later from Usage sharing in the menu — Dogood sends counts of product actions so we can see which parts are used and where people get stuck:

• Events such as app_opened, entry_created, chapter_created, goal_created, habit_created, book_previewed, book_printed and feedback_submitted.
• A few non-identifying details: which section was opened, whether a new entry is dated in the future or has an image, a goal’s type, how many days a week a new habit is planned, a book’s scope and number of days, a feedback category and how many ratings it had.
• A random installation ID and session ID created in your browser, and the time of each event.

Usage sharing never includes entry text, titles, chapter, goal or habit names, searches, moods, image links or captions. You can turn it off at any time.

Feedback

When you send feedback from inside Dogood, we receive what you entered: your ratings, the type of note, your message, your email address if you chose to add one, and — if analytics were ever enabled — the random installation ID. Nothing from your journal is attached. A message sent from the contact page is kept the same way: its topic, your message, your email address and your name if you gave it, and it is also emailed to the publisher so it can be answered.

Dictation (Dogood Plus)

Dictation is the one feature that sends something you say off your device, and only when you tap Dictate. Dogood records the microphone in your browser and sends the recording, encrypted in transit and in pieces of up to a minute, to the Dogood server, which passes it to Whisper (large-v3-turbo), a speech-to-text model run by Cloudflare Workers AI. The text comes back to your browser and is added to your entry, where it is saved like anything you type.

Dogood stores neither the recording nor the text, and does not log them. Cloudflare does not use them to train any model (Workers AI privacy). To keep dictation within its monthly allowance, the Dogood server counts the seconds each licence dictates in a month, against the licence’s random number; nothing else. Dogood asks before the first dictation, and the browser asks for the microphone.

Dogood Plus, gifts and payments

Dogood Plus is paid through Creem, our merchant of record, which handles the payment, tax and receipt. Card details go to Creem and never to Dogood. From Creem, Dogood receives what was bought, the amount, your country and your email address, which we use only to send the link that turns Plus on, or the gift link, and to send it again if you ask.

The licence that turns Plus on is kept with your journal on your device and in its backups. It holds a random number, where it came from, the day it was made and the random number of the journal it belongs to; nothing about you or what you write. The Dogood server keeps which journal number each licence belongs to, so that one Plus stays in one journal. Turning Plus on, and once a day checking that it has not moved to another journal, sends the server the licence and that journal number, never anything written in the journal.

If you ask Dogood to email a gift on the day, Christmas morning or another day you choose, we keep the address of the person it is for, the names and the few words you wrote, with the time zone, until the day and hour chosen. The email goes out then, and they are erased; until then you can change or cancel it from the gift’s page. They are used for nothing else.

If you ask for your link for the friends’ offer, the Dogood server keeps its code with your licence and marks each purchase made with it. You are told how many friends bought Dogood Plus through it, never who, nor their email address.

Printed books are ordered from the print shop of your choice, under its own privacy policy: you send it the files, Dogood is not involved.

Writing buddies (opt-in)

If you invite someone as a writing buddy, or accept an invitation, your journal sends the Dogood server the first name you chose, your current streak, how many days you have written and the last day you wrote, each time these change. Each of your writing buddies, up to ten, sees exactly that, and you see the same of them. They do not see one another unless they are writing buddies too. Never a word, a title, a mood, a photo or a date other than the last day written.

An invitation can carry the affiliate code of the person who sends it. Dogood then asks whether to credit them, and keeps their code only if you agree, as for any partner link.

Each journal holds a random token that lets it send its numbers; the server keeps only a scrambled form (a hash) of it. An invitation nobody opens is deleted after 14 days. Either of you can stop sharing at any time: both of you then stop seeing the other, and the server deletes what it kept for the two of you.

Newsletter (opt-in)

If you subscribe to the newsletter, from the site’s footer, your email address and language are kept to send you a few emails a year: an offer, a giveaway, news worth having. You are on the list only once you confirm from the email you get, and we keep the date and time you confirmed; an address not confirmed within a week is deleted.

The newsletter is sent through Resend, our email provider. Each email has a link to unsubscribe in one click, and unsubscribing deletes your address. Until you confirm, and a week at most, a scrambled form (a hash) of the network address that asked is kept with it, only to stop anyone using the form to send emails to others.

Teams and quotes

Opening a team link asks for no name and no email. Dogood counts how many times each team link opens, by day, so a pack stays within its size and its buyer can follow it in the team space; nothing else, and nothing about who opened it. The team space is reached with a random address sent to the buyer.

When you ask for a quote on the teams page, we receive what you enter: your company, name, work email, the number of people, how you would like to pay and anything you add. We use it only to answer you and to prepare the order, and delete it once it is no longer needed. To slow down abuse, we keep a scrambled form (a hash) of the address the request came from, never the address itself.

A hospital or an association asking for Dogood Plus on the page for them sends the same kind of details: its name, yours, an email, about how many people and who it is for. They are used only to answer and to make the link, and kept no longer than needed.

Cookies

Dogood sets no cookies. What it keeps in your browser, and for how long, is listed on cookies and storage.

Where things run

Dogood’s files are served by Cloudflare Pages. Sync, if you turn it on, stores your journal with Google Drive, in your own account. The optional feedback, analytics, Dogood Plus and dictation service runs on Cloudflare Workers and stores what it receives in a Cloudflare D1 database; dictation is transcribed by Cloudflare Workers AI. Like any website, the servers delivering Dogood’s files process basic request information such as your IP address in order to serve them. The website’s pages (never the journal app) count visits with Cloudflare Web Analytics: no cookie, nothing kept on your device, nothing that recognises you; only the page, the site you came from, your country and your kind of device.

How long things are kept

Feedback: three years, then deleted. Anonymous usage events: thirteen months. Quote requests: three years. A Dogood Plus purchase (your email address and the licence it carries): as long as Dogood Plus exists, so your licence can be sent to you again; the payment and its invoice are Creem’s records. A gift emailed on a chosen day: the recipient’s address, the names and the message are deleted as soon as it is sent. The newsletter: until you unsubscribe; an address never confirmed is deleted after a week. Writing buddies: until one of you stops. Dictation: neither the recording nor its text is kept.

Your rights

The data controller is Benoît Morin, entrepreneur individuel, who publishes Dogood (see the legal notice). What you turn on yourself (usage sharing, the newsletter, writing buddies, sync, dictation) rests on your consent, which you can withdraw at any time; a purchase rests on its contract; answering feedback and keeping the service safe rest on Dogood’s legitimate interest. You can ask to see, correct, delete or receive a copy of what concerns you, or object to its use, by writing to [email protected]; most of it you can do yourself in Dogood. If you think your data is mishandled, you can complain to the CNIL or to the data protection authority of your country. Cloudflare, Google and Resend, named above, are based in the United States: they take part in the EU–US Data Privacy Framework or rely on the European Commission’s standard contractual clauses.

Children

Dogood needs no account and can be used at any age. Under 15, or the age your country sets, ask a parent before turning on what sends something from your device: usage sharing, the newsletter, writing buddies, sync or dictation. A parent who finds that their child sent us something can write to us, and we delete it.

Questions

Write to [email protected].