WristScribe Privacy Policy

Version 9 | Updated 6 October 2026

WristScribe: Voice Journal was previously called MemoKeeper. This is the same app and publisher. Version 9 adds optional automatic app-update checks and their connection and local-preference handling. The separate reviewer access introduced in version 8 remains.

Who provides WristScribe

WristScribe is provided by the publisher identified on its Google Play listing. For privacy questions, use the publisher contact on that listing. This policy describes the Android phone and Wear OS watch apps. It also explains where an Android service or another app handles information under its own privacy terms.

Information on your devices

WristScribe keeps journal text, titles, entry identifiers, timestamps, favorites, deletion markers and synchronization state in private app databases. The apps also store appearance and recording-language/output preferences and phone journal-selection preferences and watch recording-queue/synchronization records. The phone stores the version of the User Agreement you accepted. WristScribe does not require a user account and does not include advertising, tracking or analytics SDKs. WristScribe does not upload journals, transcripts or microphone audio to a developer-operated server. Agreement acceptance is stored locally and is not sent to the publisher.

Google Play billing

The WristScribe phone app uses Google's Play Billing Library to request available subscription products, localized prices and eligible offers, open Google's purchase dialog, query the current Play account's purchases and acknowledge completed purchases. Google processes payment and account information under its terms and privacy policy. WristScribe does not request your payment-card details or require a separate account. Purchase objects and tokens are handled in memory for these operations and are not intentionally logged, included in manual backups, or sent to a developer-operated server. No RevenueCat, Firebase, Supabase or subscription backend is added.

The phone stores minimal local access evidence (whether an eligible purchase was last returned, check time, elapsed device time and boot count) and orientation/acceptance preferences. The phone removes obsolete test-build installation-access flags without changing journals or valid Play evidence. The watch no longer includes Play Billing or queries purchases; old local billing/orientation preferences may remain unused after upgrade, and obsolete watch acknowledgement work is canceled. Watch journal and sync data are preserved. Subscription status is checked again on launch/foreground and during acknowledgement recovery. Failed acknowledgements use Android's durable work scheduler; tokens are re-queried instead of saved in work data. Cached access is bounded to 72 hours on the same device boot after a successful Play check. Google Play may itself return cached information. Subscription access is never restored from a journal backup or trusted from a paired-device message. Uninstalling or clearing app data removes local evidence, but does not cancel a Google Play subscription.

A Google Play reviewer may enter a publisher-provided review code on the phone Premium screen to enable review access without a purchase or trial. The entered code is checked locally and is not saved, logged or uploaded. The phone stores a local verifier identifying the enabled reviewer grant separately from Google Play purchase evidence. The grant can be removed on the Premium screen, is excluded from manual/automatic backup and device transfer, and is never sent to the watch. No account, additional permission or developer-operated service is added.

Microphone and transcription

Speech capture on the phone or watch uses the microphone when you start or resume a recording session. You can also create phone entries with the keyboard without microphone access. WristScribe passes speech to the device's Android recognition service and displays the returned text. WristScribe does not write microphone audio to files, keep audio recordings or offer audio playback. For the device-default language it prefers on-device recognition where supported; an explicitly chosen language and the fallback path use the configured system speech service with an offline preference. That request is not a guarantee: the installed service may send audio and related information to its own servers. Processing, retention and network use by that provider follow its settings and privacy terms. English-letter output converts recognized script locally on the recording device to approximate Latin spelling, without a translation service or additional network transfer. Unsupported characters are retained; typed text and existing entries are unchanged. Transcripts are saved when you finish; canceled sessions are not saved to a journal. To help recover an interrupted capture, each app keeps one bounded text draft in private storage excluded from backup. Draft writes are briefly coalesced, so the latest words may still be lost during abrupt termination or storage failure. Recovered text opens paused; recovery does not start the microphone. Finishing or explicitly discarding clears the draft. Drafts older than seven days are rejected and removed when recovery is next checked; this is not a timed secure-erasure guarantee. No audio is stored.

Between your watch and phone

Paired devices exchange text recordings, timestamps, random identifiers, checksums, durable receipts and selected appearance/speech settings through the Wear OS Data Layer. Phone Premium gates receipt of new recordings. No purchase tokens or entitlement flags are sent to the watch. The phone chooses a journal at first receipt; new phone captures remain local. Older whole-journal transfers and phone handoffs are supported for upgrade recovery. Platform services handle Data Layer delivery; WristScribe adds no developer-operated journal server.

Optional reminders and shortcuts

You may enable local journal or backup reminders and choose an hour between 08:00 and 21:00. These are off initially, use Android notification permission, and contain generic prompts rather than journal text. Android may delay or suppress reminders. WristScribe stores your reminder choices, last notification times, completed-capture count and last successful manual-backup time locally. Reminders never create a backup automatically. An optional phone home-screen widget opens voice or typed capture and shows no journal content.

Export, share and manual backup

Choosing Copy entry places the selected text on Android's clipboard. WristScribe marks it as sensitive to suppress content previews on supporting Android versions. Clipboard retention and access by the operating system or another app follow that platform's behavior; copying is not an encrypted export.

Sharing prepares temporary text attachments in the phone's private cache and grants the chosen receiving app access to the selected files. Attachments older than 24 hours are removed when another share is prepared; Android can clear cache earlier. The receiving app controls any copies it keeps.

Exports create text, Markdown or ZIP files at the destination you choose. Manual WristScribe backups include journals and selected preferences, but not device-lock credentials, agreement acceptance or recording-language/output preferences. Backups are checksummed for integrity and are plaintext, not encrypted. Android's file picker may offer local storage or installed providers such as Google Drive. WristScribe does not sign you into Drive or request access to your entire drive. The chosen provider controls its copy and any network transfer. No automatic backup is provided; the apps disable Android automatic app backup and exclude journal databases and files from device transfer.

Restoration reads and validates the file you select, previews it, and merges or replaces phone journals. Before replace, WristScribe writes an emergency backup in private phone storage. It keeps the latest emergency copy until a later replacement overwrites it or app storage is removed. This is not an off-device recovery service. Remove shared, exported and backup files through their destination apps or providers when you no longer want them.

Retention and deletion

The phone retains the journal library in private app storage. The watch keeps at most 20 new unsynced recordings and shows the latest pending recording. When full, it stops capture without overwriting old recordings. Subscription expiry pauses new receipt and does not delete queued recordings. Older unsynced upgrade content is preserved even above the limit. The watch clears recording text only after an exact phone persistence receipt, then removes its retained Data Item with retryable cleanup. Small IDs, hashes, timestamps and receipts remain for idempotency; this is not a secure-erasure guarantee.

Phone recording receipts survive local journal edits, deletion and backup replacement, so a retry does not recreate received content. These internal receipts are not included in manual journal backups. Deleting a journal hides it locally; text and markers can remain in the private database. A newer legacy whole-journal revision may still make an older removed journal visible again. No sync operation deletes exported or backup files. Uninstalling or clearing app storage normally removes private journals, preferences, receipts, cache and emergency backups on that device. Copies retained by recipients or document providers must be managed there separately.

Protection and choices

Android's app sandbox and device protections apply to private storage. WristScribe does not add its own encryption to its databases or backup files, and a checksum is not encryption. You can optionally require your phone's device credential to open journal content and block screenshots and recent-app previews. WristScribe does not receive or store your PIN, pattern, password or biometric data. These options do not protect exported files or prevent privileged access to the device.

You control microphone permission in Android settings. Denying permission prevents speech capture; other supported text and journal features remain available. You choose when to share, export or back up information and which destination receives it.

App update checks

Both apps can automatically retrieve a small public release catalogue from WristScribe's GitHub Pages website over HTTPS, no more than once a day after a successful check while a non-recording screen is open. Failed automatic checks wait at least an hour before another attempt. The request has no journal, transcript, microphone audio, purchase token, reviewer code, device identifier or version query parameters. GitHub receives ordinary connection information, including the network IP address and a generic WristScribe update-check user agent, under the GitHub Privacy Statement linked below. WristScribe adds no analytics or tracking to this endpoint.

The apps store the automatic-check choice, last attempt/success times and bounded public release metadata locally, separately from journal backups. Automatic checks are enabled by default and can be turned off in phone Settings > About & Legal > App updates or watch Connection > Guide and legal > App updates. You can still check manually. Checks never block recording or install an app. An available update opens Google Play only when you choose it; account, region and track eligibility can affect availability. Google Play controls download and installation and its own auto-update setting independently.

Public website

The WristScribe information and policy pages are hosted on GitHub Pages. We add no analytics, advertising, cookies, contact forms or journal uploads to these pages. GitHub receives connection information needed to serve the website and handles it under the GitHub Privacy Statement. Following a Google Play link opens Google's service under its own terms. The website cannot access your app journals.

Policy updates

The current policy is available under phone Settings > About & Legal, the phone subscription screen, and watch Connection > Guide and legal. Version 9 adds the app-update checks above and requires renewed agreement acceptance on the phone. Version 8 added the separate local reviewer-access grant described above. Version 7 made watch capture free, capped its pending queue at 20 without automatic overwrite, moved journal ownership to the phone, and required phone Premium for new sync. It also removed watch billing checks. The private text-draft recovery, durable phone handoff queue, optional local reminders, backup-health information, capture shortcuts and public website described in version 5 remain. The phone asks users who accepted an earlier User Agreement to accept version 9 once. Acceptance remains local and separate from orientation, trial eligibility and purchase entitlement. Future changes to data handling require a policy review and any notice or consent required by applicable law.

For support or privacy questions, use the publisher contact under App support on WristScribe’s Google Play listing.