digitally on an air gapped system. means no network plugged in, ever again, and wireless antennaes physically disconnected. be that a shitty laptop with 1 GB RAM, or something else, but in that case you at least wouldn't even dare to open a web browser.

of course you would need to obtain an OS installer and the packages of the tools first, but that's it. be sure to verify them though (hashes, signatures when available).

if you use veracrypt, you can have a hidden volume. read upon its risks and always keep them in mind. you can even use that feature along with system disk encryption, for a hidden and a cover OS, but afaik system disk encryption is not officially supported for anything other than windows

Personally, I'm dealing with "the best privacy practice is one you'll actually use" because I used to journal but I don't have the energy any more.

All my journals have been ephemeral so I haven't felt the need for a backup.

You could do the thing where you have an air gapped laptop with an encrypted drive that

1. automatically wipes if you disconnect from power (just don't use it during power outages?)
2. has some sort of dead-man's switch so that it deletes if you don't prevent it every day: this is the failsafe for if someone knows about 1) and raids your house and you don't unplug it in the moment, but it's probably not good enough.

IDK that's a tough threat model.

Maybe the best thing would be to delete your journal after you write it.

Use Gpg to encrypt a message and store it in a keepassXc vault entry

If you can't change your living conditions to about living in fear every single day, try writing and then burning it.

LUKS headerless volume