Candor for Android is a private journal with an AI brilliant enough to be useful — and architected so it can never read you. Gemma 4 on your device. AES-256 + SQLCipher under it. Encrypted backups to your own Drive.
You don't want a paper notebook your kids might find. You don't want a cloud journal that, somewhere in its terms of service, reserves the right to be acquired. And you definitely don't want to paste the worst week of your year into a chatbot trained on a hundred million strangers.
So you stopped. Or you only write the safe version. Or you keep meaning to start again.
The problem was never the writing. The problem was that no journal had earned the right to hold what you actually have to say.
Every entry — typed, spoken, photographed — is encrypted on your device the moment it lands. The AI that helps you reflect runs on your phone, not in someone else's cloud. There is no server reading your text. There is no model training on your life. There is a vault, a key, and you.
Write honestly. Get the intelligence anyway.
Type, talk, attach a photo. The entry is encrypted before it touches the disk.
Tap Snapshot to see what's been on your mind, ask Buddy a question, or run a Year-in-Reflection. The AI runs on your phone — even on a plane, even with no signal.
One encrypted backup works across Android, iOS, and web. Or export everything to plain markdown. Your archive belongs to you, forever.
A calm, paper-feeling place to write. A library that turns into a self-portrait. An AI hub that does the thinking work, on your phone.
Per-record AES-256-GCM. SQLCipher full-database encryption. Master key wrapped by the Android Keystore, unlocked by your biometric. We don't have a "we won't read it" policy because we structurally can't.
Gemma 4 runs on your device — for chat, summaries, reflections, action-item extraction. No cloud round-trip. No telemetry. No training. Verify it yourself in the on-device privacy receipt.
Snapshot recaps your week. Year-in-Reflection maps the whole year. On-This-Day surfaces what you were thinking about a year ago today. Every entry makes the next one more valuable.
One encrypted vault format. Auto-backed-up to your own Google Drive or iCloud. Exportable to plain markdown into Obsidian or anywhere else. The day you want to leave, you take everything with you.
No surveillance trade-off, no half-measures.
| Feature | Why you care |
|---|---|
| On-device Gemma 4 (LiteRT-LM) | The smartest journaling AI shipping today, running on your phone. No cloud bill. No cloud risk. |
| Buddy chat with journal context | Talk to an AI that actually knows what you wrote last week — without that knowledge ever leaving your device. |
| Snapshot | "What's been on my mind lately?" Answered in ten seconds, instead of thirty minutes of scrolling. |
| Year-in-Reflection heatmap | A 52-week mood-and-activity grid. Patterns paper journaling cannot show you. |
| On-device voice entries | Walk-and-talk journaling on a hike with no signal. Transcribed on your phone — no Google or Apple cloud round-trip. Optional multilingual model for non-English entries. |
| Multi-modal entries | Text, voice, and photos in one entry. The whole memory in one place. |
| Per-record AES-256-GCM + SQLCipher | Lose the phone, lose nothing. Defense-in-depth, not "encrypted at rest" boilerplate. |
| Biometric unlock (cryptographically bound) | Your fingerprint or face is the key, not just a UI gate. |
| Encrypted .ilbk backups, cross-platform · Pro | Move your vault between Android, iOS, and web. One passphrase. Your data, portable. |
| Obsidian / markdown export · Pro | Walk away whenever you want. We bet you won't. |
| Auto Google Drive / iCloud backups · Pro | Encrypted before it leaves the device. Restored with your passphrase. We never see plaintext. |
| Privacy receipt | A 7-day local log of every AI call: tier, length, time. Never content. Verifiable privacy, not promised privacy. |
| Focus mode | Distraction-free fullscreen writing. Just the words. |
| Temporary chat mode | A conversation that isn't saved — for the 2 a.m. spirals you don't want to revisit. |
| Auto-mood capture | One five-dot tap after you write. No streaks. No nagging. |
Founder, lead, writer, knowledge worker. Journals to think, not to vent. Uses Snapshot every Sunday. Year-in-Reflection in late December.
Already on Signal, Proton, GrapheneOS. Reads architecture pages before downloading. Pays for tools that earn it.
Reads on self-awareness, habits, and decision-making. Wants a journal that turns reflection into a feedback loop, not a streak counter.
Voice entries on a hike. No signal. The AI still works.
Already has years of entries somewhere. Wants a final home. Imports to markdown, exports back, sleeps better.
30+ minutes/week saved on retrospective re-reading. Snapshot does it in ten seconds.
One year-in-review you actually finish. Most people don't. The heatmap does most of the work.
Zero rows in any vendor's database with your inner-life text in them.
One vault. Encrypted on your phone, backed up to your own Drive or iCloud, restorable when you need it. Not theirs.
A practice that sticks — because the journal pays you back the moment you re-open it.
Every word you write, every AI feature, every voice entry — free, on your device, forever. Pay only when you want a safety net for the archive: encrypted cloud backups, full-vault export, the ability to walk away whenever you choose.
Most journaling apps add AI by adding a cloud call. Candor adds AI by running a model on your device. The difference is structural, not marketing.
Warm cream by day. Deep, restful black at night. Both ship with the app.
No. Not technically, not with a warrant, not by accident. Your entries are encrypted on your device with a key derived from your passphrase and bound to your device's hardware-backed Keystore. We never see plaintext. Even if we wanted to, we couldn't.
On your phone. We use Google's Gemma 4 model (≈3.6 GB) loaded into Google's LiteRT-LM runtime, with GPU acceleration where available. No cloud round-trip. You can confirm this in the in-app privacy receipt and by airplane-moding your phone — the AI keeps working.
If you're on Pro, restore from your auto-encrypted Google Drive or iCloud backup with your passphrase, or import the .ilbk file you exported. We never hold your backup or your passphrase. If you're on Free, your local journal lives only on the device — set up Pro before you need it.
We can't recover it. That's the architecture working as designed. We strongly recommend exporting an encrypted backup and storing the passphrase in a password manager — that's the only safe recovery path. Set this up on day one.
Yes, with Pro — to a markdown ZIP that imports cleanly into Obsidian or any markdown tool, or to an encrypted .ilbk file for cross-device restore. We want the export to work; vendor lock-in is the opposite of trust. Pro is the tier where data sovereignty lives.
With Pro: turn on auto-encrypted backups (Google Drive on Android, iCloud on iOS), and your vault restores on any new device with your passphrase. You can also export an encrypted .ilbk file or a markdown ZIP and store them anywhere — a USB stick, a hard drive, your password manager. Free users can keep journaling forever on a single device; backups, restores, and exports are the Pro features.
Gemma 4 E4B is the most capable model class running on phones today. It's not GPT-4 — it's not trying to be. It's good enough to summarize a week, ask a useful question, and pull action items out of a 90-day window. Try Snapshot once and you'll know.
Free for the journal itself — unlimited entries, on-device AI, voice transcription, photos, mood tracking, year-in-review. Pay only for the safety net: encrypted cloud backups, full-vault export, restore on any device.
Candor is the private AI journal from Belvantis. Encrypted on your device. Intelligence on your device. Yours for life.