A quiet place,
kept yours.

Sanctum is a journaling app for the people who actually write things down — and would like everything they write to stay theirs. Encrypted on the device, on-device AI, and a sync that prefers your home network over a server.

Available on the App Store iPhone, iPad, and Mac Privacy by design

Download on the App Store

Encrypted on device · On-device AI · No tracking

A journal that doesn't
read what you wrote

The category leaders treat your journal like a feature surface for their roadmap. Subscriptions creep up, AI gets bolted on through someone else's cloud, photo quality silently degrades on import. Sanctum is a deliberate retreat from all of that — an app that opens fast, holds your words inside encryption, and stays out of the way of why you started writing in the first place.

Sanctum is for journalers who keep going for years — the ones who want a calendar, a search that works, a mood pattern they can actually see, and a private space to put down the things they would not say out loud. iPhone, iPad, and Mac. One pass with Face ID and you're inside; one tap and you're writing.

The shape of the app matches the shape of the privacy: simple, finished, yours. Sanctum ships once and stays yours — no renewal anxiety, no loyalty trap, no upsell at the bottom of your most recent entry.

Six tools, quietly considered.

Each one earned its place by solving a real friction in long-term journaling — not by filling a marketing bullet.

Encrypted on Device

Every entry, photo, and mood is sealed with AES-256-GCM before it touches storage. Encryption is the default, not a tier — there is no plaintext mode.

On-Device Intelligence

Apple Intelligence draws entry titles, summaries, and mood patterns directly on your device. No cloud, no telemetry, no "we send only metadata" footnotes.

Sync Without the Internet

Multipeer Connectivity carries entries between your iPhone, iPad, and Mac over the local network — no server, no account, no upload. iCloud is there if you want it; it isn't required.

Mood & Pattern

Fifteen named moods across three categories, charted over the dates you actually wrote. Patterns get surfaced gently — sleep against fatigue, season against mood — and never as a notification you didn't ask for.

On This Day & Widgets

A WidgetKit home-screen widget surfaces last year's entry on this date and lets you start a new one in a tap. The point of journaling for years is finding what you wrote — Sanctum makes that the easy part.

Gift the Whole App

Ed25519-signed gift codes let you hand the full app to someone who would actually use it — verified offline, redeemed in one tap, no account required.

How it actually works

The data layer is a SQLite.swift database where every row is sealed before write. The encryption envelope is AES-256-GCM with per-record nonces; the master key lives in the Secure Enclave behind Face ID or device passcode. There is no opt-in toggle for plaintext storage — entries do not touch the disk in any other form. Photos attached to an entry are encrypted alongside the row and copied at original quality, without the silent HEIC-to-JPG conversion that general-purpose journals impose.

Sync is two-tier and optional on both rails. Inside your home, MultipeerConnectivity over Bonjour negotiates a direct device-to-device channel and merges entries without an intermediary — no internet involved, no account on a server, no provider that could be subpoenaed. When you are not on the same network, an opt-in iCloud sync via CloudKit picks up the gap. Both rails carry the same encrypted blobs; the keys never leave the devices.

AI features run on Apple Intelligence's on-device foundation models — entry titles, summaries, mood analysis, text polish — with no provider key, no cloud round-trip, no metadata sent for "model improvement." Devices that do not support on-device AI fall back to a no-AI mode rather than to a cloud provider; the choice is honest by default. The app ships with WidgetKit for home-screen quick capture, the Mac build is a Catalyst app, and the entire bundle is sandboxed on both platforms.

A journal that nobody else can read

AES-256-GCM, every record

Encryption is the storage layer, not an option in Settings. There is no plaintext fallback path.

Zero analytics, zero tracking

No event pipeline, no telemetry SDK, no behavioral profiling. Crash reports are opt-in and stripped of content.

On-device AI only

Apple Intelligence runs locally. The fallback when on-device AI is unavailable is no AI — not a cloud provider.

Sync without an account

Peer-to-peer sync over your local network needs no server, no account, no profile. iCloud sync is opt-in and end-to-end encrypted.

Your data, exportable any time

Every entry can be exported as a clean archive on demand. Importing from Day One and other journals is built in — you can leave any time you want.

A quiet place,
kept yours.

A journal that doesn't
read what you wrote