Security
Security starts with clear boundaries.
How Niji Diary protects local records and separates online services.
Local data and keys
Saved records and supported files are encrypted in the device vault. Native platforms protect unlock material with operating-system facilities; browser storage uses the supported browser unlock path. Your vault decryption key is not a billing identifier and is not sent to RevenueCat.
Keep encrypted backups and recovery material separately. A readable export is plaintext. Device compromise, lost keys, browser storage removal and copies you share remain risks that encryption cannot remove.
Online boundaries
Online account authorization, store purchases and AI usage allowances are separate from the local vault. AI Off makes no AI requests. Microphone sessions require an explicit action. Opening this website or resuming the app never starts a voice session automatically.
Online AI receives content needed for the request you start. Direct sync connects authorized devices; its coordinator is not a cloud backup. Reports you explicitly submit use private storage with limited retention. Read the privacy policy for provider processing.
Report a security concern
Email support@nijidiary.com with “Security” in the subject, the app version or public route, and a minimal reproduction using invented data. Do not send live credentials, recovery codes, diary contents or another person’s information.
Do not disrupt availability, access other users’ accounts, use social engineering or test physical security. We do not offer a bug bounty or promise a fixed response time. This page does not claim an independent security certification.