The short version
This release is fully offline. It ships with no INTERNET permission and makes no network connection of any kind — there is nothing to send and no way to send it. For Google Play Data safety, this app collects no data and shares no data.
There is one opt-in exception, entirely under your control: if you use the optional voice-dictation feature for journaling, your spoken audio is handed to your phone's own speech-recognition service (on many Android devices, provided by Google), which may process audio in the cloud. That is an operating-system service we do not control; everything the app itself does is local. See section 5.
1. What data Journey Forward stores
You can enter the following information into Journey Forward:
- Your username, sober date, daily spend amount, currency, and savings goal
- Daily pledges, gratitude entries, and intention check-ins
- Journal entries (mood, text, tags, prompts), including optional voice-to-text dictation
- Craving logs, thought records (CBT-style reframes), and activity and sleep logs
- Vision-board entries (text and photos you choose from your gallery)
- Custom affirmations and weekly recovery check-ins
- Future-letter and pre-craving-plan entries
- Recovery-meeting reminders (title, time, location)
- Emergency contact name and phone number (optional)
- Lock-method preference — a PIN is salted and hashed, never stored as plaintext
- Notification preferences (reminder times and toggles)
Where it lives
All of the above is stored locally on your device using the operating system's standard app storage. Sensitive collections (journal, cravings, thoughts, intentions, and the like) are written through Android's Keystore-encrypted storage so they remain encrypted at rest. The encryption key is managed by the OS and never leaves the Keystore boundary.
What we collect
Nothing. None of this information leaves your device. There is no account to sign up for, no profile created on a server, and no copy of your data held by us, by Google, or by any third party.
2. Fully offline
Journey Forward works fully offline. It has no INTERNET permission in its Android manifest, so the app itself cannot make any network connection at all.
- All fonts and visual assets are bundled inside the app.
- There are no analytics SDKs, crash reporters, advertising IDs, telemetry, or cloud sync — nothing that quietly phones home, ever.
- There is no account, no server of ours, and no backend anywhere in the path — because we don't run one.
- If you tap a link to a crisis line, support group, or external resource, your device opens it in your system browser or dialer — outside of Journey Forward — and your interaction there is subject to that destination's own privacy policy.
3. No analytics or tracking
There are no analytics SDKs, crash reporters, advertising IDs, or usage trackers in this app. Specifically, it does not include Google Analytics, Firebase, Crashlytics, the Facebook SDK, AppsFlyer, Adjust, any advertising network, or any custom telemetry. We do not collect any data about how you use the app, how often you open it, or which features you use.
4. Permissions we request, and why
Journey Forward requests the minimum permissions necessary to function. Each is used only for the purpose listed and only on your device.
- POST_NOTIFICATIONS — daily check-in reminders, milestone alerts, and meeting reminders
- RECEIVE_BOOT_COMPLETED — re-arms your scheduled reminders after a reboot or app update
- VIBRATE — optional haptic feedback
- USE_BIOMETRIC / USE_FINGERPRINT — optional fingerprint / face unlock for the in-app lock
- RECORD_AUDIO — optional voice dictation for journal entries; audio is never recorded to disk by the app
- READ_MEDIA_IMAGES (Android 13+) / READ_EXTERNAL_STORAGE (Android 12 and lower) — lets you pick photos from your gallery for your Vision Board
- ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION — optional, used only while you record a walk or run in the Planner; see section 5
- FOREGROUND_SERVICE / FOREGROUND_SERVICE_LOCATION — keeps an active walk/run recording running with a persistent notification while your screen is off, so it's never silent about tracking your location
Journey Forward does not request: internet, camera, contacts, SMS, phone state, or calendar.
5. Location and the walk/run recorder
The Planner tab includes an optional GPS-based walk/run recorder. Location is used only while a recording is running, to calculate distance and pace.
- Your coordinates are processed entirely on your device and are never transmitted anywhere — Journey Forward has no server to send them to.
- Once you save a session, only the summary (distance, duration, pace) is kept, encrypted at rest like your other data. Raw GPS coordinates are not retained.
- While recording, Android shows a persistent notification (a foreground service) so you always know location is in use, and you can stop at any time.
- Location is entirely optional. If you deny the permission, or never open the walk/run recorder, no location data is ever accessed.
6. Voice dictation and speech recognition
The voice-input feature uses your device's built-in speech-recognition service. On Android, this is provided by Google's Speech Services (or whichever speech service you have set as your default).
- Audio is processed by the OS, not by Journey Forward.
- Journey Forward only receives the final transcribed text and stores it on your device.
- Whether transcription happens on-device or in Google's cloud depends on your Android version and device settings — that behaviour is controlled by Android, not by us.
- You can disable voice input entirely by denying the microphone permission.
7. Emergency contact
If you add an emergency contact, their name and phone number are stored only on your device as part of your profile. This information is never shared, never synced, and never automatically backed up. Tapping the call button uses your phone's standard dialer.
8. Backup and restore
Journey Forward includes an opt-in backup feature, either triggered by you or scheduled weekly:
- When you tap Backup → Export, the app produces a file containing the data you've created and shares it via your device's standard share sheet — the same way you share a photo.
- You can choose an encrypted backup (
.jfwbk, protected by a passphrase you set, using PBKDF2-SHA256 key derivation and an AEAD-style stream cipher) or a plain JSON file.
- You can also turn on an optional automatic weekly backup in Settings. When enabled, it works the same way and is always encrypted with your passphrase — the file is saved locally to your device's own Downloads folder roughly once a week. Nothing is uploaded; it is the same on-device file as a manual export, just on a schedule.
- Journey Forward does not receive a copy of any backup file. You control where it goes — your email, cloud drive, USB stick, anywhere.
- We have disabled Android's automatic Google Drive backup (
allowBackup="false"), so your data is never swept into a Google account backup without you explicitly exporting it.
A backup contains only the data you have created in the app. Once you choose to send or store that file somewhere, it is governed by the privacy policy of wherever you put it.
9. PIN and biometric lock
If you set a PIN, it is never stored as plaintext. It is combined with a per-install random salt and hashed with a slow key-derivation function (PBKDF2-HMAC-SHA256, 150,000 iterations); the salt and hash are written to Android's Keystore-encrypted storage and compared in constant time when you unlock.
If you choose biometric unlock, the app calls your device's native biometric framework (BiometricPrompt). Journey Forward never accesses, reads, or stores your fingerprint, face, or any biometric template — that data stays inside your phone's secure hardware and is handled entirely by the operating system.
If you haven't set a PIN or biometric lock, screenshots and screen recording work normally throughout the app, so you can share your own progress. As soon as you set one, the entire app becomes screenshot-protected on Android (FLAG_SECURE) while that lock is active — it does not appear in the Recents thumbnail and cannot be screen-captured or screen-recorded until you unlock it.
10. How to delete your data
Two options, both 100% effective:
- Uninstall the app. All data stored by Journey Forward is removed when the app is uninstalled.
- Clear app data in Android Settings → Apps → Journey Forward → Storage → "Clear data", which wipes every key without uninstalling.
There is no account to delete because there is no account. There is no data to request because we never received any.
11. Children's privacy
Journey Forward is designed for adults aged 18 and over. The app is not directed at children and does not knowingly collect any information from anyone under the age of 18. Recovery content can be intense and is intended for adult users.
12. Open-source components in the app
For transparency, Journey Forward is built with the following open-source Flutter packages. They run on your device only and transmit none of your data: flutter_local_notifications, flutter_secure_storage, local_auth, speech_to_text, just_audio, share_plus, image_picker, file_picker, url_launcher, geolocator, quick_actions, pdf, and internal plumbing (flutter_riverpod, go_router, fl_chart, intl, uuid, crypto). None of these packages is network-capable in this build.
13. Updates to this policy
If this privacy policy changes, the update will be included in a new app version and published here. Because we collect no data, changes will only reflect improvements in transparency, new features, or clarifications. The "Effective date" at the top of this document reflects the most recent change.
14. Contact
Questions about this policy? Shawn Fourie / Journey Forward — shawn@journeyforward.app