Skip to content
Penjo App TRY PENJO FREE

Privacy Policy

Effective Date: 13.10.2026

Penjo requests system permissions only when you use a feature that needs them:

  • Calendar: to show your Apple Calendar events on a day sheet, or to add and edit events.
  • Reminders: to show your Apple Reminders on a day sheet and in the week and month views, or to add, complete and edit reminders.
  • Location: to add or edit a calendar event with a location, or to add and edit a map card.
  • Contacts: to show the participants of an Apple Calendar event you opened.
  • Photos: to insert images into a day sheet from your Photos library.
  • Camera: to take a photo for a day sheet.
  • Files (disk access): to export a PDF to a folder you select.
  • Face ID / Touch ID: to unlock the app or a protected journal. Authentication is performed by the system; Penjo only receives the result and never sees biometric data.

If you don't use these features, Penjo does not access the corresponding information. When you do, that information is used only for the current session and stored locally in the application's folder. Penjo does not transmit it off your device.

Diagnostics Information

If you opt in to sharing diagnostics information, we collect crash reports to fix issues and improve app performance. The crash information is not associated with any identity.

Anonymous Analytics

Penjo, starting from version 2.9.10 (except the visionOS app), may collect non-personal usage data to improve the experience, detect glitches, and develop new features. You can opt out at any time from the main settings window. Penjo uses Google Firebase Analytics to record the following kinds of events:

  • Screen views and app state: screen view counts together with the window layout at that moment (portrait, landscape, or a split-screen variant), layout changes while a page is open, status when a journal is called from a widget, bookmarking a sheet and filtering the sheet list by bookmark (only the bookmark color), whether the user has purchased a version, and a review request being shown, the answer, how it was given (a button, closing it, or leaving the app) and whether to a free, trial or paying user.
  • First session: for a new install, which kind of content is added first (drawing, text, image, shape, map card, or a journaling suggestion) and how long after the first launch, in coarse buckets (under 30 seconds up to over 10 minutes); whether drawing is done with Apple Pencil or a finger, recorded at most once every five minutes; whether the first launch opened today's page.
  • Purchase funnel: the paywall being shown and the feature that triggered it, the plan tapped, a completed purchase, a purchase that did not complete (only whether it was cancelled, left pending or failed, never why), and a free trial converting to a subscription. Only the plan name is recorded; payment is handled entirely by Apple.
  • Authorization and sync: enabling iCloud, global authorization, journal-based authorization.
  • Navigation and interaction: long press for navigation, back-and-forth button, swipe navigation, context menu, selection, switching to a custom tool picker, copy/move sheets, setting the default font, changing the font of the events and reminders boxes, copying handwriting as text (without the text), switching a journal between day and list mode, tapping the "On This Day" button (without which day or sheet was opened), opening the events drawer on a day page and pinning it open, and turning "Show Overdue Reminders" on or off.
  • Content events (without content): adding journals (without names, but with the cover color, paper color and paper type chosen, how many journals exist, and whether it is the starter journal or one you created), changing a journal's cover, paper type or paper color (the new and the previous choice, and how many notes the journal has, in ranges), shapes, text boxes (without content), images (without content), map cards (without location), text box added normally or via double-click, drag-and-drop of text or images (without details), the type of image generation chosen (drawing, text, image, or from the dialog), an image effect being performed, opening a URL (without the URL), content added via the Apple Journaling Suggestions Picker (without content info), and adding a new multi-sheet or using the multi-sheet switcher.
  • Calendar and reminders: a new event being created (without event details), an event list added to a day sheet (without event details), a reminder list added to a day sheet (without reminder details), a new reminder being created (without reminder details), setting reminders (without configurations).
  • Export and purchase clicks: clicks on Export to PDF buttons (with the layout options chosen: journal name, date, page numbers, background) and on purchase buttons.
  • Housekeeping: when Penjo discards a page it considers empty, the reason, whether it happened on leaving the page or on going to the background, and the page's age in coarse buckets. Never the page itself.
  • Housekeeping actions: deleting a journal (with its cover, paper type and paper color, and how many notes it had, in ranges), archiving or restoring a journal, searching your notes (only whether results were found, never the search text), closing the upgrade screen, whether a calendar, reminders or location permission request was granted, and the type of an iCloud sync error (never its content).
  • Daily usage snapshot: once a day, a summary: how many journals you keep and of which kind (day or list), how many notes and over how many days, how many pages your longest note has, the cover, paper type and paper color of the journal with the most notes, whether iCloud Sync is switched on and whether it is actually syncing, and whether app protection, the calendar and reminders integrations and the widget are in use. Counts are grouped into ranges. Never any content, names or dates.
  • Time zone check: whether the time zone your journal days are kept in differs from the device's current time zone, recorded as the difference in hours. No time zone names or places are recorded.
  • Import / export: importing or exporting a .penjo file, and whether one or multiple notes were involved.
  • Non-identifying device metadata: OS version, device model, language, and non-granular location.

Penjo has disabled the advertising identifier (IDFA), so these events cannot be linked to your advertising profile or any identity we control. We do not receive demographic information such as age, gender, or precise location.

Firebase Analytics is governed by Google's Privacy Policy.

Apple Ads Attribution

Once per install, Penjo asks Apple's Ads Attribution service whether the install followed a tap on a Penjo ad in the App Store. Apple answers with campaign, ad group and keyword identifiers, the conversion type and the country of the ad, or with nothing for an organic install. This uses Apple's AdServices framework: it shows no tracking prompt, uses no advertising identifier, and identifies the ad, not you. The lookup is a single request to Apple; its answer is recorded with the anonymous analytics above only while analytics is enabled. Apple's handling of this service is governed by Apple's Privacy Policy.

iCloud Sync

As an optional feature, the user may sync their journals and related data to their private iCloud. Independently of that setting, a few small settings are kept in your private iCloud key-value storage so that your devices agree on them: your analytics choice, the iCloud Sync flags, and the time zone your journal days are kept in. These are visible only to your own devices and to Apple, never to us. iCloud is governed by Apple's Terms of Use and Privacy Policy.

Text Recognition

Starting with version 3.0, Penjo has an on-device text recognition feature. Text recognition processing is performed completely on the user's device and no data is transferred to any external server or device for processing.

Apple Intelligence

Penjo integrates Apple Intelligence tools, specifically Writing Tools and Image Playground, available on supported devices and in supported regions. Users can activate and use Writing Tools within text boxes, or generate images in their journals using drawings, images, or text inputs.

All data processed by Writing Tools and Image Playground is handled on the user's device whenever possible. In cases requiring more comprehensive processing, the data is securely transmitted to Apple's Private Cloud Compute servers for further processing. This process is managed entirely by Apple, and all data handling is subject to Apple's privacy policies. For more details on how Apple processes data, please refer to Apple's Privacy Policy.

Penjo does not collect the content of your journals. Your handwriting, text, drawings, images, map cards, locations, and calendar references stay on your device, plus your private iCloud if you enable iCloud Sync. We do not store, transmit, or sell journal content. The anonymous analytics described above record only that an action happened, never what you wrote, drew, or inserted. For iCloud Sync, Apple Intelligence, and Firebase Analytics, the third-party policies linked above apply.

Further Information

For further information contact info@penjoapp.com