Keep family memories in a private, encrypted journal

Photos are sealed on your device, with a key only you hold

Each photo is encrypted on your phone or computer with AES-256 authenticated encryption before it goes anywhere — and so are its original file name, its dates, and the rest of its details. The key is protected by a passphrase you choose, with 600,000 rounds of key strengthening in between; it never reaches the journal, is never written to a browser store, and is never logged.

In its default setting the app refuses an ordinary unencrypted photo upload outright, so privacy is the mode it runs in rather than a switch you have to remember to flip. The trade is stated up front: nobody can read your photos without that passphrase, and nobody — including us — can reset it, which is why the app pushes you to record it somewhere safe on day one.

No online storage or cloud backup

The journal and sealed photos remain in local app storage on your device. Kavanah does not upload them to ASL servers or connect them to Google Drive, Dropbox, OneDrive, or DigitalOcean Spaces.

If local app storage is cleared or the device is lost, ASL cannot restore the journal. You can create a portable local export through your device's file picker when you want a copy under your own control.

Hand a doctor exactly what they asked for

Pick the specific photos and documents one visit needs, and the app builds a single sealed package with its own key, its own code, and its own expiry date. Photos, PDFs, and documents can travel together, up to 500 MB and 100 items in one package. The rest of your journal — every other photo, every private note, the whole timeline — is not inside it and cannot be reached from it. Your side keeps a record of the label, recipient, size, checksum, and dates; the journal never holds the package bytes or the code.

Your provider needs no account and installs nothing

The recipient opens an ordinary page in their browser, chooses the file you sent, and types the twenty-character code you gave them separately. Everything is unlocked in their browser; the package and the code are never sent back to us. They can preview images and PDFs and save individual files. No sign-up, no app, no seat license, no friction at the front desk. This page is live and answers today.

A timeline built the way families actually remember

Memories, exact quotes, firsts, school entries, family events, wellness notes, achievements, and hard days, each tied to people, places, and collections you define. Search across all of it. "On this day" surfaces the same date from earlier years, which is how you find out the two-year-old and the five-year-old asked the same question. It reads as a calm chronological record, not a feed.

Development recorded without a grade

Observations across six areas — social and emotional, language and communication, cognitive and learning, fine motor, gross motor, and daily living — where each change of status is kept as its own dated note, linked to the moment that prompted it. Status moves through plain descriptions such as emerging, occasional, and consistent, with room to flag a concern. There is no percentile, no peer ranking, and no diagnosis. You get a history of how a skill emerged, which is what a clinician wants to see and what a scoreboard destroys.

Walk into the pediatric visit prepared

Visit mode gathers what you recorded — reason, concerns, medications, allergies, notes — into a clear printable summary plus the questions you have been collecting since the last appointment, so the thing you meant to ask does not evaporate in the exam room. Growth measurements sit alongside it. The report summarizes what you wrote down; it does not diagnose, screen, or replace the clinician's own assessment.

Everyone in the family gets their own door

A co-parent can edit; a contributor submits memories that wait for your review; a viewer sees the timeline but not the care notes or private entries unless you say so; a temporary guest expires. Permissions are granted one at a time, and the rule is enforced in the code rather than the copy: anyone managing access is refused outright if they try to hand out a permission their own role does not include. Invitations, sessions, and access can be revoked, and the trail of who changed what is kept.

Letters now, delivered later

Write to your child for a birthday, a graduation, or a day you cannot predict. Letters stay outside the ordinary timeline until the archive owner deliberately releases them, so nobody scrolling the journal stumbles into something meant for later. They are part of the same record and the same export as everything else.

Recaps and printable books

Draft a weekly, monthly, yearly, or custom recap from your own entries — the app assembles what you wrote and hands you the pen, rather than generating a story about your family. Memory books are built from a date range, reordered page by page across covers, entries, photos, quotes, milestones and letters, and exported as an ordinary printable file in letter or 8x10 sizes that keeps working long after any app does. You decide before generating whether milestones and private notes are included.

Works when the signal doesn't

Install it to your phone's home screen and write entries with no connection. On Android you can send photos straight from your gallery, Google Photos, Amazon Photos, or a file manager into the sealed vault through the normal share sheet. Nothing about capture depends on being online.

Near-duplicate review for originals held in the journal

Resized, recompressed, and lightly edited copies of the same picture do not match by file checksum, so they pile up invisibly for years. A visual-similarity review groups them so you can see them side by side, and every keep-or-merge decision is yours — nothing is deleted automatically, and your choices are remembered.

One boundary worth stating: this works on originals held in the journal's own media library, which the default privacy-first setting keeps empty because photos go into the sealed vault instead. It is there for archives that predate that setting or for a copy you run in the other mode.

A local export you can use without us

The encrypted file formats are documented and versioned with a written commitment never to redefine a version's meaning. A recovery tool included with the source package unlocks an exported bundle from the command line with no running service and no license check, and it ships with its own self-test.

A full export gives you the written journal as ordinary readable files. You choose when to create that local export and where to keep it; Kavanah does not operate an online copy for you.

English and Spanish throughout

The whole interface — public pages, sign-in, and every screen inside the journal — runs in English or Spanish, chosen from a selector that persists for a year, with the page's language set correctly so assistive technology reads it properly. Your own journal text is never sent to a translation service; it stays exactly as you wrote it. More languages, including right-to-left ones, can be added through the same catalog without rebuilding the app.