How to make every user see only their own data?

So my app is mostly done. For example's sake, let's say its a Journal app. A user should be able to log in and see their journals.

I have the 'user' collection.

I have a 'journals' collection which has an 'entries' subcollection.

Everything works great except when i test login with different users, they all see the same thing! hah. I must have missed something fundamental. I can imaging a user tagging every new journal document creation with their 'uid', but wouldn't that mean i'm to simply filter data based on uid? Is that secure? Is it efficient if i have a lot of users?

What's the right way to associate database data with a user and only that user?

Thanks!