Save the recording on your device first. Let your private iCloud carry it forward.

The short answer

Journo saves a playable recording on the iPhone or iPad before depending on transcription or the network. When iCloud is available, Journo can sync entries and recordings through the private iCloud associated with the Apple Account on that device. No separate Journo account is required.

Apple describes a CloudKit private database as belonging to the iCloud user. By default, only that user can access it; its contents count toward the user’s iCloud storage and are not visible as customer records in the developer portal.

That is a meaningful ownership model. It does not mean every step of an AI voice journal happens inside iCloud.

Four storage layers that should not be confused

“Stored in your iCloud” describes the sync and recovery layer. It should not be used to imply that remote transcription never occurs or that Journo retains no backend text.

Why local-first comes before cloud sync

Cloud sync is valuable, but it should not be the first place a new recording exists. Connections fail, devices move between networks, and processing providers can be delayed.

Journo finalises a playable local audio file before upload begins. If transcription is delayed or fails, the recording remains part of the journal and can be retried. That separates the act of preserving a thought from the later act of turning it into readable text.

The order is intentional:

1. finish and validate the local recording;
2. attach it to the local journal entry;
3. begin remote processing when possible; and
4. allow iCloud to sync the durable journal state.

Cloud is then an additional recovery path, not a prerequisite for keeping the only copy of the moment.

What “private iCloud” means

CloudKit separates public, shared and private databases. Journo uses its private iCloud container for customer journal sync. Apple states that private data is stored in the appropriate container directory in the user’s iCloud account and is visible only to that user by default.

This provides several practical advantages:

• the customer uses the Apple Account already protected on the device;
• Journo does not need to collect an email and maintain another login;
• private data counts toward the customer’s iCloud storage rather than a public app database;
• compatible devices signed into the same Apple Account can receive synced journal state; and
• reinstall recovery can use the same Apple-controlled identity.

It is still important to protect the Apple Account and device passcode. Private cloud access depends on that account boundary.

Does Journo work without iCloud?

The journal is local-first and remains usable when iCloud is unavailable or still syncing. A customer can record and read locally without Journo creating a conventional account.

What changes is recovery. If iCloud is disabled, full, signed out or has not completed a sync, the newest entry may exist only on that device. Deleting Journo or losing the device before sync finishes can therefore remove the only customer-controlled copy.

Journo’s Settings screen reports its current iCloud state. Before deleting the app or moving to another device, wait until it says the journal is up to date.

What leaves iCloud for AI processing?

Journo is not a fully offline transcription app. A processing copy of the recording is uploaded so remote speech and language services can create a transcript and readable entry.

The uploaded audio is removed after successful processing. A storage lifecycle removes abandoned processing uploads within seven days. Transcript text, title and generated journal content are retained under a pseudonymous identifier so interrupted work can finish and results can be recovered.

This means a precise description is better than “everything stays in your cloud”:

The original recording is saved on your device first and can sync through your private iCloud. A temporary copy is remotely processed to create the entry.

If the requirement is that no audio or text ever leaves an Apple device, Journo is not the right product today.

Deleting an entry

Deleting a Journo entry removes the local recording and journal content. Deletion tombstones remove Journo-managed copies from private iCloud as devices sync. Temporary processing audio is removed after processing, with the separate lifecycle safeguard for abandoned uploads.

The current App Store build may not send deletion of retained backend text after every completed entry. A broader privacy deletion can be requested through Journo Support. That distinction should remain visible anywhere Journo discusses ownership or cloud storage.

A five-minute iCloud journal check

Use this test before trusting any journal with something important:

1. Record briefly without a network. Confirm that the source audio remains playable.
2. Inspect the sync status. The app should distinguish local safety from cloud progress.
3. Check the Apple Account. Confirm iCloud Drive and the app’s iCloud access are enabled as intended.
4. Use a second compatible device if available. Confirm the entry and audio arrive after sync.
5. Read the processing policy. Private iCloud does not answer whether AI transcription uploads a copy.
6. Delete a test entry. Understand what is removed locally, from iCloud and from any company backend.

The useful promise is not cloud for its own sake. It is continuity without another identity system: a recording preserved locally, a journal carried by the Apple Account the customer already controls, and honest disclosure of the processing that happens outside it.