Draft mode: no backspace, no arrows, no selection. Only forward.
Triple-click the side button to turn on Guided Access, which locks the device to this app. You will only see this once.
The token needs Contents read and write on that one private repository, nothing else. With a passphrase, journal files are encrypted before they leave this device. Use the same passphrase on every device. Site drafts stay plain Markdown.