What are your users journaling about? Do you think it’s possible they could be journaling about things that, in their region, could lead to prosecution? Ostracization? Take your user’s security seriously. You don’t know what they are putting in “just a journal app”

XOR alone isn't encryption. Just use AES and other conventional encryption algorithms.

At least double XOR it, then it's fairly safe and while not quantum safe, it'll keep them wondering.