A journal only works if you can be reckless in it. And you can only be reckless in a room you are sure of. Most platforms answer the ownership question with a terms-of-service page. We think the answer has to live in the architecture, where a lawyer cannot amend it.
Start with what ownership of your own words would actually mean, if the word meant anything. Three things. Nobody else profits from them. You can take them with you. And nobody can quietly change them, not the platform, not a future version of the product, not even a future version of you with a story to protect. Most journaling apps clear the first bar in their marketing and none of the other two in their design. Here is how LUX clears all three, structurally, today.
The plain sentence, quotable as it stands: your answers, your entries, and the things you ask the Room are never shared and never sold, and there is no advertiser-facing profile of you anywhere in this architecture.
Notice what that last clause rules out. It is not "we do not currently sell data," which is a policy, and policies change when companies do. It is that the object an advertiser would buy, the profile, does not exist to be sold. You cannot sell a thing you never built. A journal is the one place you say what you would say nowhere else. Building an ad profile out of that would be a betrayal of the entire premise, so the premise was built without one.
A promise is a sentence in a policy. An architecture is a room with no door where the leak would be.
Ownership without portability is a lease. So: the file is yours from the first entry. It compiles into a paste block you can hand to any AI, and full portability is on every tier. Not the paid tier. Every tier, including the free floor.
The paste block matters more than it sounds. Your file is not locked in a proprietary format waiting for an export request. It compiles into plain text you can paste into any AI you choose, today, tomorrow, or the day you decide to leave us. Years of your own dated record, usable anywhere, is the opposite of lock-in. If we ever want to keep you, we have to keep deserving you, because the door is propped open by design.
When you do choose to share something from your file, the sharing is scoped and reversible. A grant carries only what you agreed to share and never carries what you wrote. Your writing stays in your file. The grant is a narrow statement, not a tunnel into your journal.
And taking it back costs nothing, forever. Revocation is free forever, and every revoked grant is published to a public list any verifier checks first. A permission you cannot afford to withdraw was never really a permission. So withdrawal is free, and it is loud: the revocation goes on a public list, and any verifier checks that list before trusting a grant. You do not have to hope the recipient noticed. The system makes sure they did.
This is the strange one, and the one that makes the record worth anything. Entries are added, never edited and never reordered. There is no write path into the past, for us or for anyone else.
Read that as a security property and it protects you from tampering: no platform incident, no employee, no future acquisition can reach back and change what you wrote. Read it as a mirror property and it protects the record from its most motivated editor, which is you, on the days the past feels unflattering. Memory redecorates constantly. The file does not. That is precisely why the file can prove change when memory can only assert it. The same rule that keeps us out of your past keeps the past honest for you.
These four properties are not a privacy checklist for its own sake. They are what make honesty affordable. Nobody writes the true sentence into a room they suspect is bugged, rented, or editable. The reason people go years without writing the thing that actually needs writing is not a lack of prompts. It is a lack of a room they trust. Ownership, in the structural sense, is what the trust is made of. Once the room is sure, the reckless sentence gets written, and the reckless sentence is the only one worth keeping.
If you want to see what the room does with what you give it, start where everyone starts: six written questions, about eight minutes, one word back. Free, no card, and everything above applies from the first answer you type.