Proof

Don't take our word for it.

Choosing a journal means handing it years of your life. Before anyone does that, they check a handful of things. These are the checks, and what ThymeLime actually does about each one.

Everything on this page is a description of behaviour that exists in the app today. Where something has a limit, the limit is written down next to it rather than left for you to discover later.

"Can I get my journal back out before I commit to putting it in?"

Yes. Three formats in, and your own entries out.

Import is usually where the evaluation ends. If a journal can't read what you already have, you can't switch to it, however good it looks. ThymeLime reads the three formats people actually arrive with, and writes a portable archive you can take anywhere.

Format	Bring in	Take out
Day One export	Yes	Yes
CSV	Yes	Yes
Markdown	Yes	Yes
Everything, as a single archive	—	Yes (.vault)

The archive is a single self-contained file with a manifest, holding your entries, your media and a copy of the database. It is designed to be readable without us: you do not need ThymeLime, our servers, or our permission to open it.

"If I import and something doesn't come through, will I know?"

Yes, and by name.

The failure people describe about other apps is the silent one: a note that is still there but empty, and no way to tell whether it was always empty. ThymeLime's importers are built to make that impossible.

The count always balancesEvery row in your file is accounted for. If an importer reports 900 entries and 40 skipped, those are 940 of your 940 rows. The arithmetic is an enforced invariant, not a summary.

Unreadable columns are reported by nameIf a column can't be interpreted, the importer tells you which one instead of dropping it. You are the only person who can say whether that column mattered.

Media that the export itself lost is distinguished from media that failedCompetitor exports can report success while omitting photos. The report separates "these photos were never in your file" from "these photos could not be saved", because the two need different responses from you.

"If one entry is bad, do I have to restore everything?"

No. You can pull a single entry out of a backup.

This is the check most journals fail: restore is all-or-nothing, so one bad entry means overwriting everything with a stale copy. ThymeLime opens a backup, lets you search it, and brings back one entry at a time.

Two properties make that safe:

Your backup file is never opened directlyIt is extracted to a scratch area first, and only that copy is read. Browsing a backup cannot alter it, and cannot consume it.

Reading is enforced, not promisedThe backup is opened in read-only mode by the database engine itself (query_only). It is not a matter of the code being careful.

Restores only ever addA recovered entry is written as a new entry. A restore never overwrites or deletes a live one, so the worst case is a duplicate you can remove, not a loss you cannot undo.

"How many copies of my journal exist, and where?"

Up to four, and you control all of them.

1. On your deviceThe app's own database, in private app storage. This is the source of truth and it works with no account and no internet.

2. In a backup file you ownExported on demand to a .vault archive, wherever you choose to put it. Nobody else has a copy unless you make one.

3. Your encryption key, separatelyIf you turn on end-to-end encryption, the key can be backed up on its own, wrapped with a passphrase only you know. It is deliberately kept out of the archive: a backup that carried its own key would protect nothing.

4. Optionally, in syncIf you sign in, entries sync to infrastructure we run, and media goes to object storage. Skip sign-in and this copy does not exist.

"Is my writing ever sent to a model?"

No. There is no model in the app at all.

Not a disabled integration, not an opt-in one, not an "AI features" corner you have to avoid. No model provider is integrated anywhere in ThymeLime, and voice notes are transcribed on your device, where the audio stays.

"No AI" would mean little on its own, so here is the wider answer. Every connection the app can make, and what it carries:

Goes to	Carries	Your writing?
Our sync backend	Your entries and media, only if you sign in	Yes, by design
Weather	Your coordinates and the date	No
Place lookup and map tiles	Coordinates, to put a name on a place	No
Horoscope	Your zodiac sign	No
Last.fm, only if you connect it	Your Last.fm username and the tracks you listened to	No
Product analytics	Screen names, button names, event counts	No

Analytics deserves the closest look, so be precise about it. It records which screens you opened and which buttons you pressed, because that is how you discover a screen is confusing. It does not receive your entries, your photos, or your voice notes. There is no upload of your content to "improve the product", and the analytics row is the only one that watches anything you do inside the app at all.

Sign out, or never sign in, and the first row does not exist either. The rest are either a feature you switched on yourself or an anonymous lookup of a coordinate or a date.

"If I subscribe early, will I be punished for it later?"

The price you start at is the price you keep.

Early users are the reason a product survives long enough to raise its prices. If ThymeLime's subscription price ever changes, existing subscribers keep the price they signed up at, for as long as their subscription stays active. That is a commitment, not a courtesy, and it will not be quietly revised.

What we are not claiming

Proof only means something if the edges are stated too.

Not every format is lossless. A CSV cannot carry what a CSV cannot express. The importers report what they could not read, but reported is not the same as recovered.

Encryption is optional. It is off until you turn it on. Turning it on protects entries going forward and, where applicable, what you choose to re-save. It is not retroactive magic.

If you delete the app without an export, we cannot recover your journal. An offline-first app means we never had a copy to give back. This is the trade that makes the rest of the page true.

Sync requires an account. Offline use does not. If you never sign in, everything except the sync copy above still holds.

How to check any of this yourself

Export your journal and open it with any zip tool. Browse a backup and restore one entry. Turn your phone's network off and keep using the app. None of these require trusting a page, including this one.

Get early access →