Your journal is stored on your phone and nowhere else. There is no account, no sign-in, and no copy of your writing on any server. One optional paid feature sends an entry away to be tidied up, and only when you ask it to. That is the only time anything you have written leaves your device.
Scriptum is made by ANNR Studio, based in the Netherlands. ANNR Studio is the data controller for the small amount of personal data described below. For anything in this policy, write to admin@annrstudio.com.
Your entries, any photos you attach, your first name if you gave one, your settings, and whether you have seen the introduction — all of it is written to Scriptum's own storage on your device and is never transmitted anywhere.
Your passcode is kept in the device keychain, marked as available only on the phone that created it, and deliberately excluded from backups. A restored phone will not bring it with you; you will be asked to set a new one.
We cannot read, recover, or reset any of this. If you delete the app it goes with it. If you lose your phone and have no backup, your journal is gone, and we cannot help — we never had a copy.
Clean Up. This is a paid feature that tidies an entry, and it runs only when you tap it. Scriptum sends the text of that one entry, plus an anonymous purchase identifier, to a small server we run on Cloudflare. That server checks with RevenueCat that the identifier belongs to an active subscription, then forwards the text to Anthropic, whose model produces the tidied version. Our server stores nothing of what you wrote — the entry exists for the length of the request. The only thing kept is an hourly request counter, which stops a leaked identifier running up a bill and expires by itself. Anthropic's handling of the text is governed by their own privacy policy. If you never use Clean Up, nothing you have written ever leaves your phone.
Dictation. Scriptum asks your phone to transcribe speech on the device, without sending audio anywhere. That request is honoured on iOS 17 and later and Android 13 and later. On older versions the operating system quietly ignores it and uses its own network service instead — so on an older phone, your spoken words go to Apple or Google to be turned into text. We cannot control or reliably detect this, so we would rather say so than promise something your phone may not honour. Scriptum never receives or stores the audio either way.
Purchases. Payment is handled entirely by Apple or Google. We never see your card, billing address, or store account. We use RevenueCat to know whether a purchase is active; it receives an anonymous identifier generated on your device and the store's receipt. That identifier is not derived from your name or any account — it identifies a purchase, not a person.
Where an install came from (iPhone only). If you found Scriptum through an advert on the App Store, iOS hands the app a token naming the campaign that brought you — a campaign, not a person. It is collected once, on first launch, and passed to RevenueCat so we can see which adverts led to purchases rather than only to downloads. It carries no identifier for you, is never combined with anything else, is not used to build a profile, and is not shared onward. This is why Scriptum asks for no tracking permission: Apple does not class this as tracking, and there is nothing to send if you did not arrive through an advert. Android does nothing of the kind.
App updates. When Scriptum checks for an update it contacts Expo's update service, which receives your IP address, app version and platform, and nothing about your journal.
Export. If you export your journal, the file is made on your device and handed to your phone's share sheet. Where it goes next is your choice. We receive no copy.
Email. If you write to admin@annrstudio.com we have your email and whatever is in it. Please do not paste your journal into a support email.
Your journal is included in your phone's own backup — iCloud or Google — if you have that switched on. That backup belongs to Apple or Google, not to us; we cannot see, restore or delete it. Your passcode is not included, for the reason above, and Android caps how much each app may back up, so a journal with many photos can exceed it.
Clean Up and the subscription check are necessary to provide something you asked for and paid for (GDPR Art. 6(1)(b)). The rate limit on our own server and answering your emails rest on our legitimate interest in preventing abuse and in supporting you (Art. 6(1)(f)). Everything else is on your device and is not our processing at all.
There are no others. No analytics provider, no crash reporter, no advertising network, no data broker. Anthropic, RevenueCat and Cloudflare are established in or operate from the United States; transfers rely on the European Commission's Standard Contractual Clauses or an equivalent mechanism.
You have the right to access your personal data, correct it, erase it, restrict or object to its processing, and receive it in a portable form. Because there is no account and nothing about you on a server, most of these you exercise directly: Settings exports your whole journal as a file, and Settings deletes every entry. Deleting the app removes the rest, including your passcode.
For the little we do hold — a support email, or the hourly counter tied to a purchase identifier — write to admin@annrstudio.com.
You may also complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.
Scriptum is not intended for anyone under 16, and we do not knowingly collect personal data from children.
If this policy changes, the date at the top changes with it. If a change materially affects what happens to your writing, we will say so in the app rather than rely on you to re-read this page.
Also see our Terms of Use.