The biggest red flag in a journaling app is no usable export, because it means you cannot take your writing with you. Other warning signs are export only as PDF or only on paid plans, an ad-supported business model, account deletion by email only, a privacy policy that will not say who processes your entries, silence about what happens if the company is sold, and broad rights to use "de-identified" entries. All eight can be checked in about ten minutes before you write anything personal. This guide explains each one, how to check it, and what people wrongly treat as a red flag.
What are the red flags in a journaling app?
The table lists eight warning signs, ordered by how much they cost you later, and how to check each one.
| Red flag | Why it matters | How to check |
|---|---|---|
| No export | Your entries end when the company does | Look in settings before writing anything |
| PDF-only export | You cannot import or search it elsewhere | Export one entry and open the file |
| Export only on paid plans | Access ends when you stop paying | Check the free and paid feature lists |
| Free and ad-supported | Stronger incentive to share data | Look for ads and advertising partners in the policy |
| Deletion by email only | Leaving is made deliberately hard | Search settings for delete account |
| Unnamed processors | Your text goes to parties you cannot see | Search the policy for subprocessors |
| Silent on acquisition | Terms can change after a sale | Search the policy for merger or acquisition |
| Broad de-identified data rights | Content stays personal without your name | Search for de-identified or aggregated |
Which red flags should stop you from using an app?
Any of the first three is enough to walk away, because each means you cannot get your writing back out.
No export at all means you are renting access to your own life. Years of entries disappear when the company closes or changes direction.
PDF-only export gives you a picture of your journal. You cannot import it into another app, search it reliably or reorganize it. PDF is fine as an extra and useless as your only backup.
Export locked behind a paid tier usually means access ends the day the subscription does, which is exactly when you need it.
Which red flags predict problems later?
The next three do not disqualify an app on their own, but each tends to go with worse behavior elsewhere.
Free and ad-supported. A May 2026 analysis of 25 popular Android mental health apps found that every one ran at least one tracker its privacy policy did not mention. Advertising-funded products have the strongest reason to collect and share data.
Account deletion only by emailing support. A self-service delete button is a deliberate engineering decision, and so is its absence.
A privacy policy that will not name its processors. "Trusted partners" hides a chain you cannot see, and most AI journaling apps send your text to a third-party AI model provider.
What red flags do most people miss?
Two warning signs are about what happens later, when you are no longer paying attention.
Nothing about acquisition or shutdown. Terms most often change when a company is bought, and changes are rarely announced loudly. A company that has thought about its own ending is thinking on the right timescale for something you plan to keep for a decade.
A broad clause about de-identified data. Removing your name from an entry does not remove the content. It is still an account of your divorce in your own voice. You may be fine with that, but it should be a decision, not a surprise.
What is not actually a red flag?
Charging money is not a red flag. It is usually the opposite. A subscription aligns the company's income with keeping your writing private, and the worst records in this category generally belong to free apps.
Cloud AI processing is not a red flag in itself. An app that responds to what you write has to read it. The question is what happens next: whether entries are stored, for how long, and whether they are used to train models.
A small company is not a red flag. Small teams built many of the best journaling apps. What matters is whether they have built you an exit, which you can check in minutes.
How do you check a journaling app in ten minutes?
Do this before writing anything personal:
- Write one test entry with a photo, export it, and open the file.
- Find the delete account option in settings.
- Search the privacy policy for: train, advertising, third parties, subprocessors, de-identified, acquisition.
- Turn on airplane mode and see what still works.
- Check what notifications show on the lock screen.
- Look for a named company, address and contact for privacy questions.
What rights do you have over your journal data?
Your rights depend on where you live. In the UK, Iceland, Norway and the EU countries, including Sweden, Denmark and Finland, GDPR gives you the right to access your data, have it deleted, and receive it in a portable, machine-readable format. That last right, data portability, means a company covered by GDPR should provide your data in a usable form on request.
In the US, rights vary by state, with California and several other states giving access and deletion rights. Canada, Australia, Israel and Singapore each have their own privacy laws. Wherever you are, an app that makes these requests easy is a good sign.
How does Reflectize approach these red flags?
Reflectize is an AI journal that remembers the people and plans you write about and asks about them later, and every red flag in this list applies to it too. It reaches iOS and Android soon, and signing up early is possible now. Apply every check in this article to Reflectize too. One design choice is relevant here: when Reflectize suggests saving part of a conversation as a note, event or goal, nothing is saved until you confirm it. When Reflectize launches, read its store listing and privacy policy with the same list, and ask the team directly if anything is unclear.
What should you do if your journaling app shows red flags?
Do not panic or delete everything at once. First, export your entries and open the file to confirm the export works. Second, decide whether the red flag matters for what you write: an ad-supported app may be fine for a gratitude list and wrong for writing about health or relationships.
If you decide to leave, move entries to the new app, check that dates and photos came across, then delete your account in the old app and keep the export somewhere safe. If you are covered by GDPR and the old app will not provide your data, you can make a formal access or portability request.
Can a journaling app company read my entries?
Unless an app uses end-to-end encryption, the company can technically access your entries on its servers, even if its policy limits who does. Apps with end-to-end encryption, such as Day One's encrypted journals or Apple Journal's iCloud sync, prevent that. AI journals need to process text to respond, so for them the important questions are storage, retention, access controls and AI training.
Sources
This piece is part of ai journal privacy. A journal only works if you trust it. These reads cover what happens to your entries, the difference between on-device and cloud processing, and the questions worth asking any app.