A journal only works if you can be honest in it. And you can only be honest in it if you are sure nobody else is reading.
Most apps answer that worry with a policy: a paragraph promising they will not look. Argo answers it with the way the system is built. We designed it so that we cannot read your stored journal, even if we wanted to, and even if our database leaked.
This post walks through how that works: where your key is created, where it is stored, what our servers actually hold, and the few places where your words do leave your device. No cryptography background needed.
What “zero-knowledge” means at Argo
You will see Argo described as zero-knowledge. In our case the phrase means one specific thing: our servers never store the key that unlocks your journal. Everything we keep is scrambled, and the only way to unscramble it is with a key that lives on your side.
It does not mean your words never touch a server. When you ask the AI to reflect on an entry, that entry has to be readable by the AI for a moment. We will get to exactly when that happens, because a privacy claim is only useful if you know where its edges are.
Your key is made on your phone
The first time you set up Argo, your phone generates a random 256-bit key. There are so many possible keys of that size that guessing yours is not a realistic attack. This key, which we call your data key, stays on your side. The only time it ever reaches our servers is during a live voice call, an exception we explain in full below.
Every time you save an entry, the app locks it with that key before it leaves your phone, using AES-256-GCM, the same encryption standard banks and governments rely on. A few details make this sturdier than “it's encrypted”:
- Each piece of text (the entry, its title, its summary, a chat message) is locked separately, with fresh randomness every time, so two identical entries do not look identical once locked.
- Each locked piece is stamped with what it is, like “journal content” or “chat message”. If anyone moved a locked title into the slot for an entry body, the app would refuse to open it.
- If a single bit has been tampered with, decryption fails outright. The app will show you nothing rather than show you something altered.
Photos, voice recordings and videos are locked the same way, in small numbered chunks, so a large video never has to sit fully unlocked in memory and nobody can reorder or cut the chunks without the app noticing.
Where the keys are kept
If your data key only lived on one phone, losing that phone would mean losing your journal. So the app makes locked copies of the data key itself, each one opened by something only you control:
- Your iCloud Keychain. The app creates a second key and stores it in your iCloud Keychain, which Apple syncs between your own devices. That key opens one locked copy of your data key. This is why a new iPhone signed into your Apple account usually unlocks Argo without asking you anything.
- Your recovery code. At signup you get a printable recovery code. The app turns that code into another key, which opens a second locked copy. The code is shown to you once, and we do not keep it anywhere.
- Your crypto wallet, if you choose. Since Argo 1.0.1 you can also enroll an Ethereum wallet you personally hold. Signing a message with it opens a third locked copy.
Our servers store these locked copies, because your devices need to fetch them. But we hold none of the things that open them. To us, each one is a sealed envelope with no key attached.
There is no back door. If you lose your devices, your recovery code, and your enrolled wallet, nobody can unlock your journal, including us. That is the cost of a system where we cannot read your data, and we think it is the right one for a journal.
What happens when you sign in
On a phone you already use, the app reads the key from your iCloud Keychain, fetches its locked copy of your data key, and opens it on the phone. No server is ever asked to decrypt anything.
On a new phone without your iCloud Keychain, the app asks for your recovery code (or a wallet signature), opens your data key on the device, then sets up a fresh iCloud Keychain key so you are not asked again.
When you create an account, the app is careful about order. It makes your data key, saves both locked copies, then fetches them back and confirms each one really opens to the same key, all before a single entry is encrypted. Only then does it show you your recovery code, and it waits for you to confirm you saved it. You cannot end up with an encrypted journal that has no working backup.
In a web browser, iCloud Keychain is not available, so the recovery code is the way in. You type it once. The browser then stores a key of its own that can be used but cannot be copied out of the browser, so later visits open without asking. Two honest limits: Safari clears that stored key after about a week without a visit, so occasional Safari users will type their code again, and no browser storage can protect you from malicious code running on the page itself. That is a limit of encryption in any browser, and we would rather tell you than imply otherwise.
What our database actually contains
If someone copied our entire database and file storage tomorrow, here is what they would get: your entries, titles, summaries, insights, chat and voice transcripts, profile details, photos, recordings and videos, all as scrambled data with no key to open them.
Search works the same way. When Argo finds entries related to the one you are reading, the work of understanding your writing happens on your phone. The resulting search data is encrypted before it is stored, so our servers keep it without being able to read it.
What we can see is the information a service needs to run: your account ID, email, display name and timezone, when entries were created, how many words they contain, and how long a recording runs. A few small settings fields are also stored unencrypted today, such as custom instructions you write for summaries. None of them hold entry content, and encrypting them is on our list.
When the AI needs to read
An AI cannot reflect on words it cannot read. So when you use an AI feature, such as an insight on an entry, a chat, or a daily prompt, your phone unlocks the needed text, sends it over an encrypted connection to our server, which passes it to the AI model for that one request. The result comes back to your phone, which locks it before saving. Our server keeps nothing from the exchange.
Today that AI processing runs by default on Venice AI, under a privacy tier that is anonymized and encrypted in transit, with no prompt retention. We can also route these features to Morpheus, which runs models inside a hardware secure enclave, as we explained in an earlier post. Your journal is never used to train AI models, ours or our providers'.
Some newer features show how far this design goes. Argo writes short summaries of each of your days, weeks, months and years. A typical app would run that as a job on its own servers every night. Ours cannot, because the server cannot read your entries. So your phone does the bookkeeping: when you open the app, it checks which periods are missing or out of date, unlocks just the entries those summaries need, asks for each summary, then locks the result and saves it.
Voice and video entries follow the same rule. To produce a transcript, the audio is sent to a speech-to-text provider named in our privacy policy, which transcribes it and does not keep it for other purposes. Dictating into a text field is different: that runs entirely on your phone.
The one exception: live voice calls
Live voice calls are the one place where our server does see your key, and it is worth spelling out.
During a call, the AI needs to recall relevant moments from your past entries while you are talking, faster than your phone could look them up and send them over. So when a call starts, your phone hands our server your data key for the length of that call. The server uses it to open only the past entries needed to answer you, and holds the key and the opened text in memory only. Nothing from the call is written to disk or logged. When the call ends, the key is wiped from memory, and if the end-of-call signal never arrives, a 30-minute timer wipes it anyway.
The call recording takes a short detour too. Our voice-call partner, Vapi, produces the recording, and our server briefly holds an unencrypted copy until your phone next opens, encrypts it, and stores the locked version. Our unencrypted copy is then deleted. Vapi also keeps its own copy for a limited period.
The model that talks with you during a call runs on Venice AI, not inside a secure enclave, because no enclave model is fast enough yet for real-time conversation. It is the one part of Argo that asks you for more trust than the rest, which is why the app's consent screen calls it out instead of burying it.
What we can do, and what we cannot
There is exactly one thing our server can do with your key material: destroy it. Deleting the locked copies of your data key makes everything encrypted with it permanently unreadable, a step known as crypto-shredding. We can delete your journal. We cannot read it.
Two things are public on purpose. If you mint your Soul NFT, its public record includes your first name and your journaling stats, like days journaled and total words. The in-app leaderboard shows display names and stats for top users. Neither includes a word of what you wrote, and both are explained at the point you opt in.
Check it yourself
Privacy claims should be something you can verify, not something you take on faith. Argo's code is open source, including the encryption on your phone and in the browser, the key handling, and the voice pipeline described here. Our privacy policy names the outside services that process your data.
The aim was never a company you trust with your journal. It was a journal that works without needing to trust us.
Argo Writer Agent