Your archive belongs to you.

Local first, by default

You do not need a Thus Far account or network connection to save your first memories. Thus Far stores text, attachments, story connections, and the rest of your archive on your iPhone. The local database is encrypted. Its key stays in the device-bound Keychain instead of beside the archive.

Backup only when you choose it

Backup is off until you turn it on. If you enable it, Thus Far encrypts the archive on your iPhone before sending anything to the backup service. The service receives encrypted content and the limited operational metadata it needs to move and restore that content. It does not receive a readable copy of your memories.

Controls you can understand

• App Lock: add an intentional lock at the entrance to your archive.
• Selective sharing: choose one memorial to share without exposing the archive around it.
• Export: create a portable copy of your archive for safekeeping outside Thus Far.
• Deletion: remove local data and, when applicable, encrypted remote backup data.

Optional AI assistance

On-device meaning search is available where supported, with word search as an offline fallback. Cloud memory matching asks permission for each request. You can review and deselect the excerpts before sending them with your question to Cloudflare Workers AI. Cloud transcription separately asks permission to process the selected recording. Approved text or audio is readable during cloud processing; this is separate from encrypted backup. You review a transcript before saving it.

Thus Far does not store these AI requests or results in a cloud journal, Vectorize index, or diagnostics. Closing cancels remaining work where possible but cannot recall content already sent. Cloudflare processes the request under its Workers AI data policy. Automatic verse detection and word suggestions stay on your device. Cloud scripture suggestions ask you to review and approve the exact sentence before sending it to Cloudflare.

Share one memorial at a time

Thus Far has no follower count, public profile, engagement streak, or advertising feed. When you share, you choose one story. You decide whether to keep a testimony to yourself or send it to someone you trust.

Data the service receives

Unless you choose backup, sharing, or cloud assistance, your journal content stays on your iPhone. When you use an online feature, the service receives the information required to provide it: random account and device identifiers, encrypted records or media, ciphertext sizes and checksums, object versions, request timing, and link expiry or revocation status. The decryption key for a private keepsake stays in the URL fragment and is not sent to the service.

Optional product analytics

Product analytics are off by default. If you turn them on, Cloudflare and PostHog receive allowlisted events such as feature success or failure, broad duration and archive-size buckets, app version, and a keyed installation pseudonym. Diagnostics do not include prayer text, titles, names, photos, recordings, search terms, recovery keys, or precise location. We do not record app screens or sessions. Turning analytics off stops future collection and clears unsent events from your device. It does not delete events already received; contact us about deletion requests.

Plus subscriptions

When you use Plus, Apple handles payment. RevenueCat receives an app-specific customer identifier and purchase history to validate access and report subscription activity. Thus Far uses a separate billing identity, independent of your optional encrypted backup. Its access credential is stored securely on your device. Use Restore purchases with your Apple Account to restore a subscription on another device. We do not send your journal text, recordings, or recovery key to RevenueCat.

Deleting your cloud archive does not cancel an Apple subscription or automatically erase purchase records held by Apple or RevenueCat. Manage or cancel a subscription in your Apple Account settings. Contact us about requests to delete records held by our service providers.

Reminders you control

Daily journaling reminders are scheduled on your device. If you enable occasional reminders when available, our server receives a separate random device identifier, push token, last app visit, language, time zone, preferred hour and reminder dates to avoid overlaps. This is independent of analytics permission and never includes journal content. Apple delivers these notifications. Inactive registrations expire after 30 days.

Turning occasional reminders off deletes the registration when your device reaches the server. If offline, the app shows a pending change and retries when opened. A notification already in delivery may still arrive.

Website analytics

When enabled for this website, Microsoft Clarity loads only after you allow website analytics. It records interactions on the public homepage, not your journal or the app. Advertising storage is denied. Use Analytics preferences in the footer to change your choice. Withdrawing permission reloads the page to stop recording.

Retention and deletion

Local content remains until you delete it or remove the app. You may delete an active remote archive from the app. Cloudflare provider-recovery history may retain encrypted database state for 7 days on a Free plan or 30 days on a Paid plan; the production plan in use determines the applicable window. Incomplete multipart uploads expire automatically after seven days. Private keepsakes expire when you choose and can be revoked sooner.

Service providers and sale of data

Cloudflare provides hosting, encrypted object storage, database infrastructure, optional AI processing, and analytics. Thus Far does not sell your personal information and does not use journal content for advertising or model training.

Questions and requests

For privacy questions, deletion requests, or support, visit the Thus Far support page or email support@thusfar.app. Please do not include private journal content or a recovery key in a support message.