What an emotional memory owes you.

Most privacy writing is about data in general — your email, your location, what you bought. The obligations discussed are real and the framing is roughly right for those categories. A record of your inner life is a different kind of object, and the difference is worth stating precisely rather than gesturing at.

Email is a record of what you sent to other people. It was, at the moment of creation, already shared. Location data is a record of where your body was, which was in public. Purchase history is a record of transactions you conducted with a counterparty who also has a copy.

A journal has no counterparty. It is the only category of personal data that has never been seen by anyone else at the moment it comes into existence. That is not a difference of degree.

The asymmetry that makes this different

There is a specific reason to be careful, beyond the general case for not leaking things.

What you write in a journal is often material you have never said aloud — to a partner, a friend, a therapist, anyone. Not because it is shameful, necessarily. Because saying it aloud makes it real in a way you were not ready for, or because the only people close enough to tell are the people it is about.

This means the exposure is not someone learns a thing you told others. It is someone learns a thing you have told no one. There is no prior disclosure to fall back on, no version of the information already circulating, no way for you to have anticipated it being known. And it cannot be un-known afterwards.

This is the specific shape of the problem in Indian households in particular, and we have written about it elsewhere — where the family is close, the physical journal has never been safe, and the assumption that what is in the house is available to the house is not a violation of the norm but the norm itself.

Four things we think follow

Encryption that means what people assume it means. Most users hear "encrypted" and understand "nobody can read this." That is the standard they should hold. Anything less — encrypted in transit only, encrypted at rest with a key the operator holds casually, encrypted except for the parts needed to run features — is a weaker claim wearing a stronger word.

The sensitive fields in Loopn are encrypted before they are written: the messages, the memories, the summaries, the letters. The key is held as a deployment secret, never in the source. We are stating the mechanism rather than the adjective, because the adjective has been worn out by people who meant less by it.

No third-party tracking, including the invisible kind. An analytics script on a page about your feelings tells a third party that you were reading about your feelings. This is true even if the script never sees the writing itself. The site you are reading has no analytics, no pixel, no tag manager and sets no cookies — which is also why it has no cookie banner.

Nothing goes outward. Ever, by design, not by policy. There is no sharing. No export-to-social. No "look what your year looked like" card for you to post. These are the features that make products spread, and their absence is a deliberate cost we are choosing to pay. A product that holds this material and also has a growth loop running through your feelings has a conflict of interest built into it at the foundation, and no amount of good intent survives that.

The right to correct the record, not merely to delete it. This one is less discussed and matters more than it sounds.

Being remembered wrongly

Deletion is the standard remedy. Data rights frameworks are largely built around it, and it is necessary. But for a record of a life it is a blunt instrument, because the failure mode is usually not you hold something about me — it is you hold something about me that is wrong.

You said in March that you were furious with a friend. You were, that week. You made up in April and it has been fine for a year. If the record still leads with the fury, deletion is the wrong tool: you do not want March erased, because March happened. You want it correctly placed as something that was true and stopped being true.

This is the part where memory research and product design meet uncomfortably. Human memory does this automatically, and does it so well that we underrate it — Frederic Bartlett's reconstructive account established that we do not replay the past so much as rebuild it in light of the present.¹ Elizabeth Loftus's work went further and showed how readily a memory can be reshaped by information arriving afterwards.² Human memory is, in a sense, too editable.

A written record has the opposite defect. It is too fixed. It will hold March's fury at full intensity forever, and repeat it back to you with the same confidence in year three. That is not fidelity; it is a different distortion, and it is the one machines are prone to.

So the obligation is not only to keep things safe. It is to let you say that was true then and it is not true now, and have the record actually absorb it — the earlier version kept, the later version leading, the change itself preserved because the change is often the most interesting thing in the file.

Somewhere between a memory that rewrites itself to suit today and one that refuses to update at all is the thing worth building. We are aiming at the middle, and we would rather describe the aim plainly than claim to have arrived.

If any of this resonated, you can read more about the journal as antidote to log-kya-kahenge or why we won’t tell you what your feelings mean.