Open the settings of almost any journaling or mood-tracking app and you’ll find a toggle near the top: Sync. Flip it on and a small spinner turns, and from then on everything you write has somewhere to be besides the phone in your hand. That toggle is usually described as a convenience — your entries, on all your devices — and it is one. It’s also the moment the app stops being a notebook and becomes a client for a database you don’t own.
We build Orbit, a private mood journal, and it doesn’t have that toggle. Not because we ran out of time to add it, and not as a feature we’ll get to later. The absence is the design. When you log a mood in Orbit — one of eight, an intensity from one to five, a scrap of context about where you were and how long since you’d eaten — the entry is written to your device and that is the entire trip it takes. There is no account to create, no server it reports to, no analytics pipeline counting your bad Tuesdays. The most private thing the app holds has, quite literally, nowhere to send itself.
A sync button is a copy machine you can’t see the output of. Somewhere your feelings become a row, and the row outlives the reason you wrote it.
The journey you never asked for
It’s worth being concrete about what “sync” actually does, because the word makes it sound weightless. You tap Log. Before the animation finishes, a copy of that entry leaves the phone: up the radio, across a carrier’s network, into a load balancer, past a queue, into a primary database and its replicas, and — if the app is a normal modern app — also into a backup bucket, an analytics event, maybe a “to improve our models” pile that no one will ever delete. Your one small note about a low afternoon is now in six places, in five of which you have no standing to ask that it be removed.
None of that is malicious. It’s just the default shape of software that has a server, and once there’s a server there’s a copy, and once there’s a copy the entry has outlived your control over it. The privacy policy can be immaculate and the journey still happened. You are trusting not a promise but a system — several companies, several machines, and every future decision any of them makes about the data they’re now holding on your behalf.
For a to-do list that might be a fair trade. For a record of how you felt, hour by hour, it’s a strange thing to have agreed to without noticing. Orbit’s answer is to not have the server at all, so there’s no copy, so there’s nothing to trust. The journal is stored on your device; that’s the whole sentence.
What we gave up to say that
We try to be honest about costs on this site, and this decision has a real one, so here it is plainly: with no sync, your iPhone and your Mac keep separate journals. Log a mood on your phone at lunch and it will not appear on your laptop that evening. If you want your entries in both places, you move them yourself — Orbit exports the whole journal as JSON or CSV and imports an Orbit export back — but that’s a thing you do, not a thing that happens.
By the reflex of most app design, that’s a missing feature. Sync is table stakes; an app that doesn’t do it looks unfinished. We looked at it the other way. The only way to make two devices agree is to put a copy somewhere they can both reach, and that somewhere is exactly the server we didn’t want your moods living on. You cannot have “my feelings sync silently across my devices” and “my feelings never leave my devices” at the same time. We picked the second, and the manual export is the price of the first not existing.
We didn’t fail to build sync. We declined to build the server that sync requires, and kept the export so your data is still yours to move.
Local isn’t a lesser version of the cloud
There’s a habit of thinking of on-device storage as the budget option — what you ship before you can afford “real” infrastructure. We think that’s backwards for a journal. The phone in your pocket is a more private place to keep a diary than any datacenter, for the simple reason that it’s yours and it’s one place. Nothing about keeping the journal local is a compromise on capability: Orbit still charts your entries across the day and the week, still lets each mood keep its own row so a busy Tuesday and a quiet Sunday don’t collapse into an average, still holds the cheap context that makes an old entry legible. It does all of that without a single byte having to leave the device to make it work.
The one place data can cross the boundary, we made you the one who decides. Optional location access can label a place and attach the local weather; turning it on is a choice you make, with the trade spelled out, and logging works completely without it. Your device backups may include the journal, because that’s your backup of your device — but there’s no Orbit cloud underneath quietly keeping its own copy for reasons of its own.
The button-shaped hole
If you go looking in Orbit’s settings for the sync toggle, you’ll find a hole where it would be. We think that hole is the most honest thing in the app. It’s the difference between we promise not to look and there’s nothing here to look at — and only one of those survives a change of ownership, a breach, or a subpoena.
This is the same instinct that runs through everything we make: we only build what we run, we keep it small, and we’d rather ship a product that can’t do a thing than one that quietly does it to you. A mood journal is about as personal as a file gets. The kindest engineering we could do for it was to give the entries you write nowhere to go — and then hand you the export, so the only copies that ever exist are the ones you made on purpose.