The Private Page

What is the private page, and why does it matter now?

The private page is a simple idea: your journal should be the one surface in your digital life that nothing else reads — no company server, no analytics pipeline, no AI model learning from what you confessed at midnight. I'm Ishaan Rawat, and I make Pennen, an iPad journaling app. I want to argue, plainly and in the first person, for that idea.

For most of the history of diaries, privacy was the default. A notebook in a drawer was read by exactly one person. Software quietly inverted that. The thoughts you'd never say aloud now travel through someone else's infrastructure, get backed up to someone else's cloud, and — increasingly — get fed to a model that summarizes, prompts, and "goes deeper" with you.

I don't think any of that is evil. Some of it is genuinely useful. But a journal is not a productivity tool, and it is not a chat partner. It is the place you go to be honest without an audience. The moment a second reader exists — even a well-intentioned, end-to-end-encrypted, opt-in one — the page stops being fully private. Pennen, the iPad journaling app, is my attempt to keep the page private by construction, not by promise.

Are journaling apps now reading and training AI on your entries?

Many of the biggest journaling apps added AI features in 2025 and 2026 that can read your entries — usually opt-in, often with reassuring privacy language, but reading them nonetheless. This is the trend I want to name fairly rather than caricature.

In April 2026, Day One — the best-known journaling app, and a genuinely good one — introduced a "Gold" tier built around AI: Daily Chat, Go Deeper prompts, entry summaries, title suggestions, and image generation, priced at $74.99 per year (9to5Mac, April 2026). Day One is careful here: it says Daily Chat is optional, end-to-end encrypted, and that nothing is stored or used for training, and it says it is exploring on-device models to make these experiences more private over time (9to5Mac, April 2026). Those are real, meaningful protections, and I want to credit them.

But the architecture still changed. A journaling app that once just stored your words now also has features whose entire purpose is to read them. Other apps are AI-first by design: Rosebud, for example, routes entries through providers like OpenAI, Anthropic, and Groq — anonymized and under zero-data-retention agreements, per its policy (Rosebud Privacy Policy, 2025). Privacy writers note that the deeper risk with AI journaling is structural rather than a matter of any one company's intentions: when the app itself can read your entries, your privacy rests on policy and key custody rather than on the page being unreadable by design (Blanksheet.ai, 2025). My point isn't that these companies are reckless. It's that once reading your entries is a feature, the only thing standing between you and that reader is policy. I'd rather not need a policy. (If you're weighing options on this axis, we keep an honest guide to choosing a journaling app without AI.)

How is Pennen actually built to stay private?

Pennen has no Pennen-owned servers, no analytics, and no AI. Your pages live on your device and in your own iCloud private database, locked behind a passcode — and I, the developer, cannot read them. Here's the concrete mechanism, because privacy claims should be checkable, not vibes.

• On-device first. Every page you write is stored locally on your iPad in a Core Data store. The app works fully offline; iCloud is optional.
• Your iCloud, not mine. Sync uses Apple's CloudKit private database inside your own iCloud account. There is no Pennen backend in the middle. I never provision a server that sees your entries, because there is no server. (We walk through exactly where your journal data lives in a separate explainer.)
• Apple's encryption, not my honor system. CloudKit private databases are protected by a key hierarchy rooted on your trusted devices; for end-to-end-encrypted iCloud data, the service keys are never made available to Apple's servers (Apple Platform Security, 2024). With Advanced Data Protection on, your devices retain sole access to the keys for most iCloud data (Apple).
• A passcode lock gates the app itself, stored in iCloud Keychain so it survives reinstalls without a Pennen account.
• No analytics, no tracking, no AI. Nothing phones home about how you write or what you write. There is no model — on-device or remote — that reads a single stroke of ink.

The handwriting matters here too. Pennen is handwriting-first: you write with Apple Pencil on a paper-like canvas, one page a day. Ink is harder to mine than text, and that's a feature, not a limitation.

AI-era journal app vs. Pennen: how do they compare?

The clearest way to see the difference is side by side: who can read the page, where it lives, and what the business model rewards. I've kept this honest — the AI-era column describes a typical, reasonably privacy-conscious app, not a villain.

The bottom row is quietly the most important. A subscription that unlocks AI rewards a company for getting deeper into your entries. A one-time lifetime option lets me get out of your way and stay there. The fuller case for a journal app without a subscription is its own essay.

Doesn't AI make journaling better? What are you giving up?

You give up the prompts, the summaries, and the chatty reflection partner — and I think, for a journal specifically, that's the right trade. I want to be fair: AI journaling helps real people. If a daily prompt is what gets you to write at all, that's a genuine win, and apps like Rosebud and Day One Gold do it well.

But there's a difference between a tool that helps you think and a tool that helps you perform thinking. When an app summarizes your week, it decides what mattered. When it suggests how to "go deeper," it shapes the groove your mind runs in. A blank page does none of that. It just waits. The friction of an empty page — the thing AI is designed to remove — is, in journaling, often the point. That's where the unrehearsed thought lives.

There's also the laggy reality of handwriting on general-purpose apps. Apple's own Journal app supports Pencil, but users on iPadOS 26 report significant lag and heat when handwriting, and no ruled or grid paper options (MacRumors forums, 2025). I built Pennen narrow on purpose: one quiet page a day, calm paper, fast ink, and nothing watching. I gave up the features so the page could stay private and the writing could stay yours.

Why should you trust a solo developer over a big company?

You shouldn't trust me on faith — you should trust the architecture, which is designed so that trusting me is unnecessary. That distinction is the whole philosophy.

Big companies have real security teams and real encryption, and in some ways their infrastructure is more robust than anything I can build alone. I'm not pretending otherwise. But scale creates pressure: investors, growth targets, a roadmap that bends toward engagement and data. The safest entry is the one that was never collected, and the safest reader is the one that doesn't exist. Pennen has no analytics to leak, no AI to repurpose, and no server logs to subpoena, because I built none of them.

I'm Ishaan Rawat, one person. I journal in Pennen every day — in the same local build I ship — and those entries land in my own iCloud, not on any machine I control. That's the test I hold the app to: if I wouldn't trust it with my own worst week, I won't ask you to. The private page isn't a marketing position for me. It's the reason the app exists.