Privacy policy

Your entries, chats, and everything Ember makes from them are stored on your devices, protected by your device's own security.

Some things never leave the device at all: the index that powers search, the audio of recordings you make on your Mac (only their transcripts sync, encrypted), and the Mac app's log of AI requests.

Sync is optional. When it's on, your journal is encrypted on your device before it leaves, using a key made on that device. Our sync server stores only the encrypted copy and can't read it.

The key moves to another device only when you pair them: you scan a QR code and type the 6-digit code the other device shows.

The server does see some facts about your syncing: a random ID for your sync account, your devices' IDs, when you sync, how much you store, and your IP address at the time of each request. It can't see what anything says.

Synced data stays on the server until it's deleted. Deleting an entry removes it from your devices, but older encrypted copies can remain on the server until you ask us to delete your synced data.

AI features are optional and stay off until you agree to them on each device.

When you use one, the text it needs goes straight from your device to OpenRouter, a service that passes requests to AI models. OpenRouter sends it to a provider that has agreed not to keep it: the model's maker, or a cloud host such as Amazon, Google Cloud or Microsoft Azure. It never goes through Ember's servers. Every request asks providers not to train on your data or keep it.

Once you've agreed, some features run in the background without a tap each time: daily cards, the weekly letter, summaries, and on Mac, indexing new entries so you can search them by topic.

Speech-to-text on iPhone always happens on your phone. On Mac it happens on your Mac, unless you turn on cloud transcription. If you do, audio is sent through OpenRouter to OpenAI's Whisper. This is the one path where we can't ask for the audio not to be kept.

If you use your own OpenRouter key instead of an Ember allowance, your own OpenRouter settings also apply.

Each invite code carries a short note from us, usually the name of the person we made it for. When you redeem one, our invite service links the code to your sync account so it can give you your AI allowance. So for invited people, we can tell which sync account is whose. We still can't read anything in it.

The allowance runs on our OpenRouter account, so we can see how much AI each account uses (when, which model, and how much), but not what was sent.

Ember shares usage counts and crash reports so we can make it better. It's on by default, and you see a clear notice about it when you set up the app.

It never includes your journal or your chats. It's tied to a random ID made on your device, not your name. Your IP address is read for a moment to block abuse, then thrown away. Individual events are kept for up to 25 months.

You can turn it off anytime in Settings. “Delete my usage data” in Settings removes what was shared from all your devices. Deleted data can stay in our database's automatic backups for up to 30 days.

See exactly what we collect — every event and every value, built from the same list the apps use.

If you send feedback from the app, we store what you send so we can read it: your message, any screenshots you attach, and your app version and device type. Screenshots can show your journal, so check them before you send.

If you test Ember through TestFlight, feedback and crash reports you send there go to Apple, which shares them with us.

No ads. We don't sell or rent your data. We don't track you across other apps or websites. We never train AI models on your journal.

Cloudflare runs our servers: sync, invites, feedback, and usage counts.

OpenRouter and the AI providers it uses, only when you use AI features. OpenAI, only if you turn on cloud transcription on Mac.

Apple, for the App Store and TestFlight.

These companies may handle data in the United States and other countries.

To run the features you choose, to keep our servers safe from abuse, and, if you leave usage sharing on, to understand how Ember is used so we can improve it. Nothing else.

Usage data: use “Delete my usage data” in Settings.

Everything else we hold (your synced data on our server, your invite record, feedback you sent): email privacy@helloember.co and we’ll delete it. A way to delete your synced data from inside the app is planned.

You can also ask for a copy of what we hold about you, or ask us to correct it. Depending on where you live, you may have the right to complain to your local data protection authority.

Ember isn't made for children under 13, and we don't knowingly collect data from them. If you think a child has used Ember, contact us and we'll delete their data.

If we change this policy, we'll update this page and the date at the top. If a change affects what leaves your device, we'll tell you in the app.

Ember is made by Rishi Ishairzay. Questions or requests: privacy@helloember.co.