Privacy policy
Last updated October 22, 2026
Sello is built so that we can’t read your private writing. This page explains what we store, what we can see, and the one cookie we use.
The short version
- Private entries, and the photos and videos in them, are encrypted on your phone or in your browser before they reach us. We store ciphertext we can’t open. The key stays on your devices.
- Public posts are public. Anything you publish, and your profile, can be read by anyone and by search engines.
- One cookie, only after you sign in. No ads, no analytics about you, no trackers in the app, no third-party scripts. We only count how many people arrive at Sello from our social media and other sites, to know which links work.
- We don’t sell or share your data.
What we store
| Data | Why | Can we read it? |
|---|---|---|
| Journal name, display name, bio, profile photo, blog style | Your account and public page | Yes, it is public |
| Public posts and their photos and videos | Showing your blog | Yes, it is public |
| Private entries, photos and videos | Syncing your journal between phone and web | No. Only that they exist, when they were saved, their size and whether a file is a photo or video |
| Your phone’s public key and device model | Recognizing your phone when it signs in or approves a browser | Yes (it is not secret) |
| A fingerprint of your backup key, and your journal key locked with it | Letting you recover on a new phone | No. Neither lets us open your journal without the backup key |
| Signed-in sessions: browser name, created and last-used time | Showing you where you’re signed in, letting you revoke them | Yes |
| Messages sent with the contact form, and the email address if you leave one | Answering you and handling concerns about public posts | Yes. Deleted once handled, or when you ask |
| Your email address, your language and where you came from (a short label like “reddit” or “ig”, taken from the link or the site that sent you), if you join the waiting list | Writing to you once when the apps are in the stores, and knowing which places bring people to the list | Yes. Deleted after that email, or when you ask |
| Short-lived server logs (IP address, page requested) | Security and fixing errors | Yes, kept only for a short time |
| Visits to the home page: how many a day, and where from (our Instagram or TikTok, another site, or unknown) | Knowing which links bring people to Sello | Yes. Only the counts: nothing about who visited |
Your face, fingerprint and screen-lock PIN never leave your phone. Your phone checks them; Sello only learns that the check passed.
Dictation. Sello doesn’t keep your voice; it’s processed on the phone. When you dictate in the app, your phone’s on-device speech recognition turns it into text, which goes into your entry like anything you type. The audio isn’t saved, and it isn’t sent to us or to anyone else. On phones without on-device recognition, the app doesn’t offer dictation.
Photos are re-saved on your device before upload, which removes hidden location data (EXIF/GPS). Videos have the location your camera recorded in them removed on your device too, before upload.
Places. You can say where you wrote an entry by picking a town from a list that comes with the app, or by putting a pin on a map drawn on your device. Sello never reads your device’s location (GPS). The place is encrypted with the entry, published or not, so we can’t read it. A published entry shows the place’s name on your blog only if you choose to.
Cookies and local storage
We use one cookie, sello_s, and only after you sign in on the web. It keeps you signed in for up to 14 days or until you sign out. It is HttpOnly, Secure, first-party and strictly necessary for the service you asked for, so we don’t show a cookie banner. Readers of public blogs get no cookies at all.
Following a blog. If you tap the bell on a blog, your browser gives us a push address (a link at your browser's notification service, like Google's or Mozilla's) and the keys to send to it. We keep them for that blog until you tap the bell again or the address stops working, and use them only to send a notification when the blog publishes a new entry. No email, no account, no cookie. The writer doesn't see who follows.
The web app also keeps, in your own browser only: your light/dark preference and language (localStorage), an encrypted copy of your entries so it loads faster, and your journal key as a non-exportable key (IndexedDB) that is erased after 30 idle minutes, when you lock, or when you sign out. It also keeps this browser’s own key pair (non-exportable too), which your phone uses to hand the journal key to this browser and no other; it is erased when you sign out.
Where it lives
Sello is operated from Panamá. Its server is hosted by Oracle Cloud in the United States (Virginia), which stores the data but does not use it; private entries are encrypted before they leave your phone. Traffic reaches the server through Cloudflare, which processes connection data to deliver and protect the site. When a browser asks to open your journal, your phone shows its IP address and rough place (city and country, from Cloudflare) and warns you if it’s far from the phone’s own, and Settings lists where each signed-in browser came from, so you can spot one that isn't yours. Nothing else is shared with third parties unless the law requires it, and even then we can only hand over what we can read (see the table above).
Private links. When you share an entry with a private link, the app encrypts a copy of it (and its photos and videos) with a new key that is only in the link, after the #, a part of the address browsers never send to us. We store that copy and can't read it. Anyone with the link can, until it expires or you turn it off, which deletes the copy.
Text from other apps. Another app, like a chat app, can hand text to Sello for you to save. That text passes through that app and through our server without encryption on its way to a card with a button that opens Sello. Our server only sends it back, at that moment: it doesn’t store it or write it to its logs. Nothing is saved until you review it in Sello and tap Save, and then it’s encrypted on your device like any other entry.
What encryption can’t protect
Your private entries are encrypted on your phone and we can’t read them, not even with access to our server. But encryption only protects what travels and what we store: it can’t protect a compromised device. If your phone or computer has malware, malicious extensions or apps, or if someone else uses them unlocked, they could see what you write. On the web, your browser also runs the code we send each time you open Sello. For the most privacy, write in the app and keep your backup key somewhere safe. Never scan a Sello code someone else sent you.
How long we keep it
Until you delete it. A deleted entry, photo or video goes to a trash for 30 days, where you can restore it from the app; then it is removed from our servers. Server backups also keep deleted data for up to 30 days before it's gone from them too. Delete journal in Settings (on the phone, or on the web after approving on the phone) erases your account and everything in it 7 days later (your blog goes offline at once, and you can cancel in the app until then). The name stays taken for 30 days after. See how to delete your journal, including if you lost your phone.
Your rights
You can see, correct, export or delete your data. Most of it you can manage yourself in the app. For anything else, including requests under Panamá’s Law 81 of 2019 or the GDPR, contact [email protected].
Children
Sello is only for people 18 and older, as declared on Google Play.
Changes
If this policy changes in a way that matters, we’ll say so in the app before it takes effect.
Questions, or a concern about something published on Sello? Contact us.