Why a travel memoir should never touch the cloud

Your photo library is the most intimate map you own. It knows where you slept, who you woke up next to, the morning you watched the sun come up over an unfamiliar city. Most apps that promise to “organise your memories” begin by quietly copying that map to a server you’ll never see.

Sojourn takes the opposite vow.

Policy is a promise. Architecture is a fact.

A privacy policy is a sentence someone wrote and could rewrite tomorrow. It asks for your trust and offers words in return. We wanted something sturdier — a guarantee you don’t have to take on faith.

So Sojourn has no account system, no Sojourn server, and no analytics SDK counting your taps. The memoir is built on your iPhone from photo dates, locations, and on-device image understanding. If an original photo only lives in iCloud, iOS may fetch it when needed; Sojourn still never uploads your library to a server of its own.

The safest data is the data that never leaves the room.

What it actually reads

Each photo already carries two quiet facts: when it was taken and, often, where. Sojourn reads those — and only those — to rebuild your travels. The pixels are understood on-device too: a compact vision model recognises a beach or a night sky right on the chip in your pocket, so search can find “the sea” without anyone else ever seeing it.

• No accounts, ever
• No tracking, no analytics, no third-party SDKs
• Nothing uploaded by Sojourn — iCloud originals remain handled by iOS

The cost, and why it’s worth it

Building this way means we give up the easy things: no cross-device sync from a server, no “we’ll fix it on the backend.” Everything has to be fast and correct on the device itself. That’s harder. It’s also the entire point.

A memoir is a private object. It belongs on your shelf, in your hands — not in a data centre. Sojourn is built so that it can be nowhere else.