I don't want my employees or myself to see the user's data in the backend. Considering it's just a journal app, is it enough to use XOR encryption in the client, or do I need to use something else?