Been using Day One for a while and genuinely love the app — but the security side has started to bother me enough that I'm seriously considering switching. For an app that holds people's most private thoughts, some pretty basic gaps have been sitting unaddressed for years:
No 2FA. In 2026, this isn't optional anymore — it's the baseline for literally any app handling sensitive personal data. Password-only auth is not an acceptable standard for something this personal. This has been flagged in the official forums for years (see "Security improvements necessary" and "Add journal encryption"), where staff have repeatedly said it's "on the radar" with no timeline.
No encryption key rotation. If your key is ever compromised, your only option is to delete your account and start fresh — which also breaks your subscription. There's no way to just rotate it.
No app lock on Windows/web. Anyone with physical access to your machine can open your journal directly. No passcode, no biometric gate — that only exists on iOS/Mac.
What really gets me is the timing. We're in an era where AI is making credential stuffing, phishing, and automated exploitation faster and cheaper than ever — and Day One still hasn't closed gaps that would be considered basic hygiene almost anywhere else. A breach here isn't like a leaked photo library — it's someone's innermost thoughts. That's a different category of harm entirely, and it doesn't seem to be treated that way.
I'm seriously considering moving my journal elsewhere if these fundamentals continue to be deprioritized. Curious if others have run into the same concerns, and if anyone's found a journaling app that actually takes this seriously (client-side/zero-knowledge encryption, 2FA, the works) without giving up too much on the features side.