Coffer — Privacy Policy

Coffer is a private, fully offline digital journal for Android. It was built on a simple principle: your journal belongs to you alone. Coffer collects no data, transmits no data, and has no ability to do either — the app requests no internet permission at all.

Summary

We do not collect, store, transmit, sell, or share any personal data. Everything you write or attach in Coffer stays on your device, encrypted. There are no accounts, no servers, no analytics, no advertising, and no third-party services of any kind.

1. Data collection

Coffer collects no personal data and no usage data. Specifically, the app does not collect:

journal entries, photos, or tags; names, email addresses, or any identifiers; device information, advertising IDs, or telemetry; crash reports or analytics events; location data; or any other information about you or your device.

Coffer requires no registration and has no sign-in. We have no way of knowing who uses the app or how it is used.

2. No network access

Coffer declares no internet permission in its Android manifest. The operating system therefore prevents the app from making any network connection. Your entries, photos, and backups cannot be transmitted to us or to anyone else, because the app is technically incapable of sending data off your device.

3. How your data is stored on your device

All content you create in Coffer is stored locally on your device and encrypted at rest:

Journal database. Entries and tags are stored in a SQLCipher-encrypted database (AES-256), protected by a 256-bit Journal Master Key.

Passphrase protection. Your passphrase is never stored. It is processed with the memory-hard Argon2id key-derivation function to unlock the Journal Master Key, which protects against brute-force attacks.

Photos. Photos you attach to entries are encrypted individually with AES-256-GCM. Sensitive EXIF metadata (such as GPS location) is stripped before the photo is stored.

Biometric unlock (optional). If you enable fingerprint or face unlock, the feature is backed by the Android Keystore hardware security module on your device. Biometric data is handled entirely by the Android operating system; Coffer never sees, stores, or has access to your biometric information.

4. Backups and exports

Coffer can export your journal, or individual entries, into passphrase-protected encrypted backup files. These files are created only when you request them, are saved to a location you choose, and remain encrypted with a passphrase only you know. You are in full control of these files — where they go, how they are shared, and when they are deleted. Coffer never uploads them anywhere.

5. Device permissions

Coffer requests only the minimum permissions needed for its features, and never requests internet access. Depending on your Android version and the features you use, this may include access to photos or the camera (only to attach images you explicitly select or capture) and biometric hardware (only if you enable biometric unlock). Permissions are used solely on-device for the feature you invoked.

6. Third-party services

Coffer integrates no third-party services: no analytics SDKs, no advertising networks, no crash reporters, and no cloud providers. There is nothing in the app that communicates with a third party.

7. Data deletion

Because all data lives only on your device, you are in complete control of deleting it. You can delete individual entries or photos inside the app at any time, and uninstalling Coffer removes the app's encrypted database and files from your device. Encrypted backup files you exported yourself remain wherever you saved them and can be deleted by you. Since we hold no copies of your data, there is nothing for us to delete on our side.

8. Children's privacy

Coffer does not collect data from anyone, including children. Since no information ever leaves the device, no personal information of children (or of any user) is ever received or processed by us.

9. Security features

In addition to encryption at rest, Coffer includes privacy hardening by design: screenshot and recent-apps preview blocking (FLAG_SECURE), and automatic locking when the app goes to the background or after a period of inactivity. These features run entirely on your device.

10. Changes to this policy

If this policy changes, the updated version will be published at this address with a new effective date. Because Coffer collects no data, any future change is expected to remain consistent with the core commitment above: your data stays on your device.

11. Contact

If you have questions about this privacy policy or about Coffer, contact us at [email protected].