The Three Column Method

A thought record says what you were afraid of that day and how much you believed it, which makes it more private than most notes. So the app is built on one rule: the program gets only the capabilities it needs, and the limit sits where the program cannot get around it.

No network permission

The app requests two system permissions, USE_BIOMETRIC and USE_FINGERPRINT, both serving only the optional lock; the other two lines in the command's output are the declaration and use of one app-private permission that androidx.core adds on its own, signature-level and granting no capability. android.permission.INTERNET is not in the list. Android enforces the limit: without that permission the app's own code cannot open a socket, no library it links can, and neither can a library added later. Check it on the APK below:

aapt dump permissions The-Three-Column-Method-v1.7.2.apk

The data stays in the app's own storage

Records live in a Room (SQLite) database in the app's private directory. There is no account, no sync, no analytics SDK, no crash reporter. Data leaves the app in exactly two ways, both started by you: as a JSON file you export, or as a single record sent through the system share sheet.

Earlier versions had one exception: Android's backup rules covered the database, so with the system's own backup enabled, a copy of the records reached your Google account. That path belongs to the system backup rather than to code in the app, but the data left the device all the same. 1.6.0 closed it: the app declares android:allowBackup as false and both backup-rule files are deleted, so the system no longer backs this app up. This too can be checked on the APK:

aapt dump xmltree The-Three-Column-Method-v1.7.2.apk AndroidManifest.xml | grep allowBackup

0x0 in the output means false. The only way to recover data now is a file you exported yourself.

The optional app lock

The app lock is optional and unlocks with fingerprint, face or the device password. While the app is locked, its preview in the recent-apps switcher is hidden and screenshots are blocked. Both guard against a record being seen on screen: a phone handed to someone else, or a screenshot taken for another purpose that catches an entry.

AgentGuard applies the same idea to a much larger program: decide what a program may touch, then put the limit somewhere it cannot get around. The design tradeoffs are written up in Designing a notebook that never goes online.