Kavanah Journal — Source library
Public documentation snapshot: 2026-09-08
Your child's memories, sealed before they leave your phone
A private family journal that seals your photos on your device, under a key only you hold.
Your child's memories, sealed before they leave your phone
Built for: A parent keeping a day-by-day record of one child — quotes, firsts, letters, ordinary afternoons — who does not want that record sitting readable on somebody else's servers · Co-parents in two households who need one shared timeline with different levels of access, not two half-complete camera rolls · A parent tracking emerging skills and concerns who wants a dated record to bring to a pediatric visit, without a score or a diagnosis attached to their child · A family that needs to hand a doctor, therapist, school specialist, or attorney a specific set of photos and documents — and nothing else
Kavanah Journal exists because of this.
You take the photo because you know you will forget. The exact way she said the word wrong. The stuffed rabbit she carried for eleven months and then never again. The afternoon that felt like nothing at the time and turns out to be the whole year. So you put it somewhere — the camera roll, a baby-book app, a shared album — and you assume it will still be there in fifteen years, readable, yours. Most of the time it is somewhere else entirely. The photos of your child sit in plain form on a company's machines, in storage that company pays for, under keys that company holds. That arrangement is fine right up until it isn't: the free tier shrinks, the subscription lapses and the album locks, the terms change, the company is acquired, the export button produces a file that nothing can open. The single thing you most wanted to keep forever is the thing you have the least control over. And when you want to send four photos of a rash to the pediatrician, the choice is to text them in the clear or hand over access to the whole library. There is a second problem underneath the first. The apps that do keep a real developmental record tend to turn childhood into a scoreboard — percentiles, peer comparison, a red flag on a chart because a nineteen-month-old is not doing what the average nineteen-month-old does. You wanted to notice that she started pointing at things. You did not want a verdict.
Kavanah Journal exists because of this.
The people who make the app cannot read your photos. Not "promise not to" — the key never reaches them, and the storage account is not theirs.
Kavanah Journal exists because of this.
There is a published table of exactly which piece of your data lives where and whether the journal can read it. Most family apps describe their privacy; this one draws the boundary line by line.
Kavanah Journal exists because of this.
Unlocking, restoring, and exporting your own memories can never be paywalled. It is a stated product rule, not a current promotion — and the old operator-hosted vault and its billing endpoints were not left dormant, they were retired outright and now answer with a permanent refusal that points you at your own vault.
Kavanah Journal exists because of this.
Sharing with a doctor produces one sealed package with its own key and its own code, delivered on a different channel from the file. Your provider opens it in a browser with no account and nothing installed.
Kavanah Journal exists because of this.
Developmental observations are kept as a dated history with no score, no percentile, and no peer ranking, because a record helps and a verdict does not.
Kavanah Journal exists because of this.
You can run the entire journal on your own Windows computer or on hardware you control, from a launcher that sets itself up on first start — the hosted address is a convenience, not a requirement, and running it yourself is currently the way to connect your own Google Drive.
Kavanah Journal exists because of this.
The failure cases are documented inside the product, not buried: a forgotten passphrase cannot be recovered, revoking access cannot retract a file someone already downloaded, and expiry is a courtesy in the viewer rather than remote deletion.
How Kavanah Journal works, start to finish.
Kavanah Journal is a family journal with a hard line drawn through the middle of it. Written entries — memories, quotes, firsts, letters, school notes, family events, milestone observations, growth measurements, appointment prep — live in the journal so they can be searched, sorted, shared with family members you choose, and turned into recaps and printable books. Photos are treated completely differently. Before a photo goes anywhere, it is encrypted on your own device with AES-256 authenticated encryption, and so are its file name, its dates, and the rest of its details. What the journal holds is a random reference that means nothing without your key. That key is derived from a passphrase you choose and never send anywhere. It is not kept by the journal, not in your browser's cookies, not in a support ticket, and not in a recovery database. Six hundred thousand rounds of key strengthening stand between the passphrase and the encryption key. Nobody at Auto Secure Login can unlock your photos, which is the point — and which is also why nobody can reset a passphrase you lose. The app says so plainly rather than implying a rescue that does not exist. Backup is built the same way and is deliberately not ours to run. Sealed containers are copied from your device straight into a visible folder in your own Google Drive, under file names that are meaningless in a listing — no child's name, no caption, no care label. Auto Secure Login does not host a photo library, does not rent you gigabytes, and cannot read the containers it helped you create. Every backup and every restore is checked with a SHA-256 fingerprint, so a container that was truncated or altered in transit is caught rather than quietly trusted. Being exact about where this stands: that connection is finished and self-tested, and it is switched on for a copy you run yourself, where you supply your own Google project. On the hosted journal the Google authorization it depends on is not configured yet, so sealed photos stay on the device there. Dropbox and OneDrive are built against the same formats and pass their own checks, but both are off. Provider sharing is the feature families use first and remember longest. You unlock the vault, pick exactly the photos and documents that one visit needs, and the app builds a single sealed package with its own separate key and its own separate twenty-character code. The code is not kept by the journal — you read it to the office over the phone or hand it over in person, on a different channel from the file itself. Your provider opens a plain page in an ordinary browser, chooses the file, types the code, and sees only what you selected. They create no account, install nothing, and the package is never sent back to us. Your side keeps a record of what was shared, with whom, and when. Around that core is an actual journal, not a scaffold. A chronological timeline with people, places, and collections. Milestone observations across six developmental areas, where every status change is kept as a dated observation tied to the moment that prompted it, so you can see how a skill emerged over months — with no scoring and no comparison to other children. Growth records and a pediatric visit mode that turns what you noticed into a printable summary and a question list. Letters written now and held outside the timeline until you deliberately release them. Weekly, monthly, and yearly recaps drafted from your own entries. Printable memory books exported as ordinary files that keep working outside the app. Family roles that let a co-parent edit, a contributor submit memories for your review, and a viewer see the timeline without the care notes. Offline capture with a device outbox that retries when the signal returns. And a recovery kit — documented, versioned file formats, a command-line recovery tool that needs no running service and no license check, and a full export — so the archive outlives the app.
Everything in the current release.
Each of these is built and working today. Nothing on this list is a roadmap item.
Photos are sealed on your device, with a key only you hold
Each photo is encrypted on your phone or computer with AES-256 authenticated encryption before it goes anywhere — and so are its original file name, its dates, and the rest of its details. The key is protected by a passphrase you choose, with 600,000 rounds of key strengthening in between; it never reaches the journal, is never written to a browser store, and is never logged. In its default setting the app refuses an ordinary unencrypted photo upload outright, so privacy is the mode it runs in rather than a switch you have to remember to flip. The trade is stated up front: nobody can read your photos without that passphrase, and nobody — including us — can reset it, which is why the app pushes you to record it somewhere safe on day one.
Backup goes into your own Google Drive — and gets verified
Sealed containers are copied from your device into a visible folder inside your own Google Drive, under file names that say nothing about your child, the contents, or any care context. You control the account, the quota, and the delete button; we do not rent you storage, do not pay for it, and cannot read what lands in it. Every backup and every restore verifies a SHA-256 fingerprint over the encrypted bytes, so a truncated or altered file is caught instead of silently trusted. Where this actually stands today: the path is built and self-tested, and it is usable on a copy you run yourself where you supply your own Google project — on the hosted journal the Google authorization is not configured yet, so photos stay sealed on the device there.
Hand a doctor exactly what they asked for
Pick the specific photos and documents one visit needs, and the app builds a single sealed package with its own key, its own code, and its own expiry date. Photos, PDFs, and documents can travel together, up to 500 MB and 100 items in one package. The rest of your journal — every other photo, every private note, the whole timeline — is not inside it and cannot be reached from it. Your side keeps a record of the label, recipient, size, checksum, and dates; the journal never holds the package bytes or the code.
Your provider needs no account and installs nothing
The recipient opens an ordinary page in their browser, chooses the file you sent, and types the twenty-character code you gave them separately. Everything is unlocked in their browser; the package and the code are never sent back to us. They can preview images and PDFs and save individual files. No sign-up, no app, no seat license, no friction at the front desk. This page is live and answers today.
A timeline built the way families actually remember
Memories, exact quotes, firsts, school entries, family events, wellness notes, achievements, and hard days, each tied to people, places, and collections you define. Search across all of it. "On this day" surfaces the same date from earlier years, which is how you find out the two-year-old and the five-year-old asked the same question. It reads as a calm chronological record, not a feed.
Development recorded without a grade
Observations across six areas — social and emotional, language and communication, cognitive and learning, fine motor, gross motor, and daily living — where each change of status is kept as its own dated note, linked to the moment that prompted it. Status moves through plain descriptions such as emerging, occasional, and consistent, with room to flag a concern. There is no percentile, no peer ranking, and no diagnosis. You get a history of how a skill emerged, which is what a clinician wants to see and what a scoreboard destroys.
Walk into the pediatric visit prepared
Visit mode gathers what you recorded — reason, concerns, medications, allergies, notes — into a clear printable summary plus the questions you have been collecting since the last appointment, so the thing you meant to ask does not evaporate in the exam room. Growth measurements sit alongside it. The report summarizes what you wrote down; it does not diagnose, screen, or replace the clinician's own assessment.
Everyone in the family gets their own door
A co-parent can edit; a contributor submits memories that wait for your review; a viewer sees the timeline but not the care notes or private entries unless you say so; a temporary guest expires. Permissions are granted one at a time, and the rule is enforced in the code rather than the copy: anyone managing access is refused outright if they try to hand out a permission their own role does not include. Invitations, sessions, and access can be revoked, and the trail of who changed what is kept.
Letters now, delivered later
Write to your child for a birthday, a graduation, or a day you cannot predict. Letters stay outside the ordinary timeline until the archive owner deliberately releases them, so nobody scrolling the journal stumbles into something meant for later. They are part of the same record and the same export as everything else.
Recaps and printable books
Draft a weekly, monthly, yearly, or custom recap from your own entries — the app assembles what you wrote and hands you the pen, rather than generating a story about your family. Memory books are built from a date range, reordered page by page across covers, entries, photos, quotes, milestones and letters, and exported as an ordinary printable file in letter or 8x10 sizes that keeps working long after any app does. You decide before generating whether milestones and private notes are included.
Works when the signal doesn't
Install it to your phone's home screen and write entries with no connection; a device outbox holds them and retries, showing you anything that failed instead of losing it quietly. On Android you can send photos straight from your gallery, Google Photos, Amazon Photos, or a file manager into the sealed vault through the normal share sheet. Nothing about capture depends on being online.
Near-duplicate review for originals held in the journal
Resized, recompressed, and lightly edited copies of the same picture do not match by file checksum, so they pile up invisibly for years. A visual-similarity review groups them so you can see them side by side, and every keep-or-merge decision is yours — nothing is deleted automatically, and your choices are remembered. One boundary worth stating: this works on originals held in the journal's own media library, which the default privacy-first setting keeps empty because photos go into the sealed vault instead. It is there for archives that predate that setting or for a copy you run in the other mode.
A recovery kit you can use without us
The encrypted file formats are documented and versioned with a written commitment never to redefine a version's meaning. A recovery tool included with the source package unlocks a backup or an exported bundle from the command line with no running service and no license check, and it ships with its own self-test. A full export gives you the written journal as ordinary readable files. Data health and backup screens tell you whether the archive is actually recoverable right now rather than in theory. The continuity rule is written into the product: cancelling never deletes your cloud files and never disables decryption.
English and Spanish throughout
The whole interface — public pages, sign-in, and every screen inside the journal — runs in English or Spanish, chosen from a selector that persists for a year, with the page's language set correctly so assistive technology reads it properly. Your own journal text is never sent to a translation service; it stays exactly as you wrote it. More languages, including right-to-left ones, can be added through the same catalog without rebuilding the app.
Numbers we can stand behind.
Every figure below comes from the product's own release record or test suite, not from a marketing estimate.
Surfaces and status.
Status as of 2026-09-02. Checked on 2026-09-02: the home page, sign-in, support page, and the no-account provider viewer at journal.autosecurelogin.com all responded successfully, and the journal's own status check reported the 2.2 line running with its records connected and no failed background work in the previous 24 hours. It is genuinely running and usable, which is why this is not "in development" — and it is short of a general launch for reasons that are checkable rather than rhetorical. The hosted journal is served with a no-index instruction, so it is not offered to search engines. Its status check reports email delivery switched off, so invitations and reminders are not being sent. Its sign-in page renders only the Auto Secure Login button and passkey sign-in — the Google authorization that bring-your-own-cloud backup depends on is not configured there, and the repository's own README still lists providing that production Google client as an outstanding input, so that headline feature cannot be connected on the hosted instance today. The Android client is on Google Play's invite-only internal track, published 2026-08-02; a later native Android client build was recorded on 2026-08-22 with a published checksum, but it is a debug build accepted on an emulator and a Pixel handset, not the build on the store, and the physical-handset checklist for the store build is explicitly still open. The product's own documentation lists independent cryptographic review, penetration testing, and an accessibility review as required before broad public release. Backward-looking evidence that supports early access rather than a lower label: the first full restore rehearsal against real production data passed on 2026-07-31, and the released version passed 131 of 131 automated checks, 16 of 16 cloud-transport checks, and a clean dependency audit on 2026-08-02.
Worth more together.
Products on this platform share one sign-in, one support queue, and one engineering standard. These pair naturally with Kavanah Journal.
ASL Vault
Kavanah deliberately cannot reset a forgotten vault passphrase. ASL Vault is a sealed store built for exactly that kind of secret — the one thing you must not lose and must not leave in a notes app.
ASL Doctor Search
Free, no-account lookup of the official U.S. provider record. Handy when you are assembling a sealed package for a specialist you were just referred to and need their real practice details.
WIC Companion
Same household, different everyday problem — a privacy-first tool for families using WIC benefits, built by the same team under the same rule about never selling family data.
Recent progress.
This product ships often. The most recent verified changes, newest first.
Recent progress.
2026-08-02 Version 2.2 was deployed to the live journal and the Android client was signed with its own dedicated upload key and published to Google Play's invite-only internal track. That release was hand-tested by actually clicking through the app in Spanish rather than trusting the build output, which caught two real interface defects — an English caption stranded on the Spanish home page, and an overlapping logo and label on the sign-in screen at phone width — both fixed with regression checks so they cannot come back. The release passed 131 of 131 automated checks across 29 files, 16 of 16 cloud-transport checks, 11 of 11 data-structure upgrades validated, 405 source files validated clean, and zero known vulnerabilities in shipped dependencies.
Recent progress.
2026-08-05 Closed a file-handling gap that could corrupt a deployment, so a release now lands byte-for-byte as intended.
Recent progress.
2026-08-22 Recorded the next native Android client build with a published checksum and documented acceptance: an isolated launch on an emulator, plus a separate sign-in journey on both an emulator and a real Pixel handset, with the temporary test credentials revoked afterwards. That build is a debug artifact held as a store candidate; the build on Google Play is still the.
Recent progress.
2026-09-02 Live check: the home page, sign-in, support page, and the no-account provider viewer all responded, with the journal reporting itself healthy, records connected, and no failed background work in the previous 24 hours.
Recent progress.
Pricing for Kavanah Journal is quoted after a short conversation about your situation, because the right scope differs from one team to the next. There is no charge for that conversation.
What does it cost, and what happens if I stop paying?
The journal is free to use today and no price is published. Whatever paid tier eventually arrives will cover automation and family administration, never storage capacity — and unlocking, local recovery, manual encrypted backup, the no-account viewer, and full export are written into the product as permanently free. If you stopped paying tomorrow, nothing in your cloud account would be deleted and nothing would stop decrypting. That rule exists so a subscription can never become a ransom.
I already keep everything in a photo app. Why move?
You probably shouldn't move everything — keep the camera roll. Kavanah is for the part you want to still have in fifteen years and do not want readable on someone else's machines: the written record, the observations, the letters, and the photos that matter most. The practical difference shows up twice — when you need to send four specific photos to a doctor without handing over the library, and on the day a service changes its terms.
How do I get what I already have into it?
Photo by photo, deliberately — and that is a design choice, not a missing feature. On Android, share images into the journal from your gallery, Google Photos, Amazon Photos, or a file manager the same way you share to anything else; they land sealed. On a computer you select files from the device and they are encrypted before they are stored. In the privacy-first setting the app runs in by default there is no bulk import of a plaintext library and no server-side pull from a photo service — those paths are refused outright, because accepting them would mean handling your photos in the clear. Written entries are typed as you go. There is no minimum you have to load first: one entry a week is a real archive after a year.
How do I actually know my photos are safe?
Two things you can check yourself. Your photos are encrypted with AES-256 authenticated encryption before they leave your device, and your passphrase — protected by 600,000 rounds of key strengthening — never travels to us, so there is no copy of your key on our side to steal. Backed-up files are verified with a SHA-256 fingerprint on the way out and on the way back, and you can re-verify the whole archive on demand. What we will not claim: independent cryptographic review and penetration testing are scheduled and not yet done, and we will not call our own testing an outside audit.
Is it finished, or am I signing up for something half-built?
It is running and usable, and it is honestly early access rather than a general launch. The journal is live at its own address with a published version, a restore rehearsal against real data that passed on 2026-07-31, and 131 of 131 automated checks passing on the released version. The parts that are not finished are named plainly rather than implied: on the hosted address the Google authorization that bring-your-own-cloud backup needs is not configured yet, email delivery is off, Dropbox and OneDrive are built but not turned on, large video is not promised, and the Android app is still invite-only. Everything the journal claims to do today, it does.
Where do my sealed photos actually sit, and can I lose them?
They sit in your device's own app storage, encrypted, and — once you connect your Google Drive on a copy you run yourself — as encrypted copies in a folder inside that account. The honest risk is that browser storage can be cleared by the browser even when the app asks it not to be. That is exactly why the product nags you for two independent copies: a cloud backup you own, and an exported recovery bundle you keep somewhere else. Follow that and a wiped browser costs you nothing.
What if I lose my phone?
Revoke that device's session from the security screen and it can no longer reach the journal. Your written entries are held by the journal and come back the moment you sign in elsewhere. Sealed photos are restored from your backup or from an exported recovery bundle by entering the same passphrase on the new device. This is exactly the drill the product asks you to rehearse before you clear an old device — recover on the new one first, then wipe the old one.
Is sharing with my doctor a secure medical portal?
No, and we will not describe it as one. It is consumer-controlled encrypted file delivery: you seal a specific set of photos and documents, your provider opens them in a browser with a code you gave them separately, and nothing connects to their chart system. It is a much better answer than texting a photo, and it is not a replacement for your clinic's own portal. Kavanah makes no claim to HIPAA certification or a business-associate relationship.
What happens to my journal if Auto Secure Login stops running Kavanah?
You keep it. The encrypted file formats are documented and versioned, with a written commitment never to redefine what a version means. A recovery tool that comes with the source package unlocks a backup from the command line with no running service and no license check, and a full export gives you the written journal as ordinary readable files. Your backup lives in a cloud account we do not control and cannot delete. If you want the strongest version of that guarantee, run the whole journal on your own computer.
What should I know before I rely on it?
We would rather you hear this from us than discover it later. As of 2026-09-02:
What should I know before I rely on it?
A forgotten vault passphrase cannot be recovered by anyone, including us. That is the direct cost of us not holding your key, and it is why the app pushes you to record it offline and export a recovery bundle before you rely on it.
What should I know before I rely on it?
On the hosted journal today, the Google authorization that bring-your-own-cloud backup depends on is not configured, so sealed photos stay on your device there. The backup path is built and self-tested end to end and is usable on a copy you run yourself, where you supply your own Google project. The repository lists providing that production Google client as an outstanding input.
What should I know before I rely on it?
Dropbox and OneDrive are built against the same encrypted formats and pass their own checks, but both are switched off by default and have not been exercised against live accounts. Automatic repair between two clouds is deliberately off for the same reason.
What should I know before I rely on it?
Sealed photos live in your browser or app's own device storage, which a browser can clear despite a persistence request. That is precisely why the product tells you to keep a cloud backup and an exported recovery bundle rather than treating the device copy as the archive.
What should I know before I rely on it?
Each sealed file has a size cap of 75 MB by default, and the vault locks itself after 15 minutes of inactivity. Large video is not promised at all — photos, PDFs, and documents are what the vault handles today, and the streaming encryption needed for big video files is still ahead.
What should I know before I rely on it?
In the default privacy-first setting there is no bulk import of an existing plaintext photo library, and server-side import from a photo service is refused outright. Photos come in by selecting them on the device or, on Android, through the share sheet. The bulk-import path exists only in the other, non-privacy-first mode.
What should I know before I rely on it?
The near-duplicate photo review works on originals held in the journal's own media library. Because the default setting keeps photos out of that library and in the sealed vault instead, it will have nothing to show on a new privacy-first archive.
What should I know before I rely on it?
Revoking a provider's access stops future access. It cannot retract a file someone already downloaded, and the expiry date on a package is enforced by the viewer as a courtesy, not as remote deletion.
What should I know before I rely on it?
Kavanah is consumer software for your own family record, and a private way to hand a clinician exactly one set of files. It is not a medical records system, is not connected to your clinic's chart, and makes no claim to a HIPAA certification or a business-associate relationship.
What should I know before I rely on it?
The Android app is currently invite-only on Google Play's internal track. The store listing and its disclosures are still being completed, so current testers see a temporary package label rather than the Kavanah name, and the physical-handset acceptance run for the store build is explicitly still open.
Your child's memories, sealed before they leave your phone
Prefer email? contact@autosecurelogin.com