Security and privacy
Keeping your journal safe
A transparent guide to what Miroven protects and what you need to watch out for.
Encryption starts on your device
Miroven encrypts entries and photos on your device. Sync sends ciphertext to the server. Plaintext entries, photos, PINs, recovery codes, and keys capable of decrypting your vault are not sent to the API.
Some information is visible to the server
The server may see metadata needed to operate the service, such as your account email, access and modification times, and ciphertext sizes. Encryption does not eliminate all information processing.
The limits of encryption
Encryption cannot protect against every risk, including a modified client, malicious scripts, or access to an unlocked device. Keep your device and browser secure, and do not share your recovery code.
Prepare separately for recovery
Signing in does not recover your vault. Store a file backup and your recovery code safely in case your browser storage is cleared or you lose your device.
Reporting vulnerabilities and the scope of verification
Report vulnerabilities through GitHub private vulnerability reporting. If private reporting is unavailable, ask the maintainer for a private contact channel without publishing exploitation details. Use synthetic data in reports. Do not send real entries, photos, recovery codes, PINs, encryption keys, or authentication credentials. We do not claim to have completed an independent security audit, and do not separately guarantee response deadlines or a security maintenance schedule.