Yours by default.

Private unless you say otherwise.

Every entry is visible only to you unless you mark it public — per entry, or as a default in Settings.

Public moments never carry an exact location.

If a moment is public, its coordinates are limited to Approximate (~1 km) or Neighborhood (~5 km). The database refuses public-and-exact outright; it isn't just a UI rule.

Coarsened coordinates are coarsened before they're stored.

When you choose Approximate or Neighborhood, the exact point is snapped to a grid at write time. The precise coordinates never reach the database, so they can't leak, be subpoenaed, or be seen by us.

Your log is portable.

Export everything as JSON or Markdown from Settings, anytime.

Deleting a moment deletes it.

Deletes are real deletes, not soft flags. Deleting your account removes your profile and every moment with it.