Privacy Policy
Ember — desktop, iOS, web, and the sync and planning service behind them.
The short version. The desktop and iOS apps work completely offline and an account is optional. If you never sign in, nothing you write ever leaves your device and this policy has almost nothing to tell you.
If you do sign in, your notes, tasks and sessions are stored on our server so your devices agree with each other. They are not read by a person, not analysed for advertising, not sold, and not shared — with one exception you control: when you ask the planner, the coach or a chat feature for something, the records it needs are sent to Anthropic's AI model to produce the answer. That is the only time your content goes to anyone. There is no advertising, no analytics and no tracking of any kind in this software.
Who is responsible
Ember is operated by its developer, who is the data controller for everything described here and can be reached at hello@getember.space for any question or request in this policy. This policy covers the Ember desktop app, the iOS app, the web app, the sync and planning service behind them, and the courses served under the same domain. Our Terms of Service are the agreement this policy belongs to.
What is stored, and why
Only if you create an account
| What | Why |
|---|---|
| Your email address | It identifies your account and is the only way to sign in or recover it. |
| Your password, hashed | Stored as an Argon2id hash. The password itself is never written to disk or logs and cannot be recovered from the hash. |
| A sign-in code, briefly | While you sign up or reset a password, a six-digit code is held for fifteen minutes so the one you type can be checked, then discarded. |
| Your timezone | A focus session must land on the correct local day, and a plan must know when your day starts. |
| A display name | Optional. Blank unless you set it. |
| App settings | Session length and similar preferences, so they follow you between devices. |
| Session tokens | A random opaque string proving your device is signed in. Valid for 90 days and revocable at any time. |
| Which Terms you accepted, and when | So we can show you the terms again only when they actually change, and so there is a record that you agreed. |
| How many planner runs you have used | Each run costs money; the trial quota is counted here. |
Your content, if you sign in
The point of an account is that the same data appears on your laptop, your phone and the web, so the records the apps create are stored on the server:
- Threads — titles, notes, steps, status, and any link you attach
- Daily pages — your Now line, to-dos, blockers, wins and parked thoughts
- Focus and mindful sessions — start and end times, how long you focused, pauses, and the distractions you chose to log
- Goals, backlog and standing commitments — what you set out to do this week, what fell off, and what recurs
- Plans, day runs and coach notes — the schedules the planner drafted, what you did with them, and the summaries the coach wrote
- Course progress — which course is active and how far along you are, if courses are enabled for your account
This is the content you typed or asked for. It is stored so it can be sent back to your own devices, and so the planner can read it when you ask it to. Nothing else reads it.
Server logs
The server records that a request happened — the time, the path, the response status, and the network address it came from — which is what makes it possible to notice an outage or an attack. The logger is explicitly configured to redact authorization headers, cookies and request bodies, so the contents of your records never reach a log file. A thread title is personal, and it is not written down anywhere except the database row it belongs to. Logs are kept for a short rolling period and then overwritten.
A note on health
Ember is built for people who work the way people with ADHD often do. We never ask whether you have a diagnosis, and we infer nothing about your health from your use of the app. But you may choose to write about your health in your notes, and the fact that you use an app aimed at ADHD could itself be read as saying something about you. Where the law treats such information as sensitive — the GDPR's special categories, or a consumer health data law such as Washington's — we rely on the explicit consent you give when you create an account and accept the Terms, and we handle everything in your account with the care that category demands: stored only to sync it back to you, sent only to the model you asked, and erased on request. You can withdraw that consent at any time by deleting the account.
What is never collected
- No advertising identifiers, and no advertising
- No analytics or telemetry — there is no third-party SDK in the apps at all
- No location, contacts, photos, calendar, health-app or microphone data
- No behavioural profiling, and nothing is inferred about you from your content
- No tracking across apps or websites, so the iOS app never shows the tracking permission prompt
- No card numbers — if we ever charge, the payment provider holds those and we do not see them
Who it is shared with
Your data is not sold, rented, licensed or handed to anyone for their own purposes. There are no analytics processors, no advertising networks and no data brokers. These are the only parties that process it, each on our instructions and for the single purpose named:
| Who | What they receive | Why |
|---|---|---|
| Anthropic, PBC (the Claude API) | The records a request needs, only when you make one: your goals, thread titles and steps, the to-dos, blockers and log for the days in question, recent focus history, the backlog, standing commitments, the current plan, the active course, your timezone, and whatever you type into a chat feature. Never your email, password or account identity. | To draft a plan, rescue a week, write a coach summary, or answer in the goal and day chats. Under Anthropic's commercial API terms this data is not used to train their models; they may retain it for a limited period for abuse monitoring under their policy, then delete it. |
| Amazon Web Services (hosting, and Simple Email Service) | Everything above sits on a server AWS rents to us in the United States. The email service receives only your address and the six-digit code it delivers. | To run the service and to deliver sign-in and reset codes. AWS does not process the contents beyond keeping the machine running and the mail moving. |
| Apple | Whatever Apple's own App Store and iOS collect under Apple's policies. We receive nothing from Apple about you. | Distribution of the iOS app and, if we ever sell something in it, in-app purchases. |
If we add a payment provider, it will be added to this table before the first charge. Data would only ever be disclosed beyond this table if legally compelled by a valid order, and we would tell you unless the law forbids it.
Where it is stored
The server and database are in the United States (AWS, us-east-1), and data is not moved between regions. Anthropic processes model requests in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, this means your data is transferred outside your region; those transfers rest on the standard contractual clauses in our providers' agreements and, for the content you choose to send to the model, on your having asked for it.
How it is protected
- All traffic uses HTTPS. There is no unencrypted route into the service.
- Passwords are hashed with Argon2id at the parameters its authors recommend for a server.
- Sign-in uses opaque random tokens rather than self-contained ones, specifically so that a session can be revoked the moment a device is lost. Resetting your password signs out every other device.
- The database is not reachable from the public internet; only the API can talk to it.
- Each account can only ever read its own rows. Every query is scoped by user.
- Requests are rate-limited, and sign-in attempts more tightly than everything else.
No system is perfectly secure, and it would be dishonest to claim otherwise. If we learn of a breach affecting your data we will tell you by email without undue delay, and notify any regulator the law requires.
How long it is kept
- While your account exists — your records are kept, because that is the service.
- When you delete a record — it is marked deleted immediately and stops appearing. A marker remains for 90 days so that a device which was offline learns about the deletion instead of restoring the record. After 90 days the row is erased.
- Sign-in codes — fifteen minutes, then discarded.
- Expired sign-in sessions — deleted automatically.
- When you delete your account — everything is erased immediately. See below. Anthropic's copy of any request you made expires under their retention window.
Your control over it
Export everything
In the app: Account → Export everything. You get your entire dataset as one
readable JSON file, sorted and formatted so it is actually inspectable. The same is available
from the API at GET /export. No request, no waiting period.
Delete everything
In the app: Account → Delete my account. This immediately and permanently erases your account, every record attached to it, and every sign-in session, on the server and on the device you are holding. It is not a request, not a soft delete, and not reversible.
Data already synced to another device of yours stays on that device until you delete the app there, because the app is designed to keep working without a network and cannot reach across to erase it.
Correct or access it
Editing your records in the app changes them at the source. Everything held about you is in the export, so an access request is a button rather than an email.
Keep the model out of it
Nothing is sent to Anthropic unless you press a button that asks for a plan, a rescue, a coach note or a chat reply. Do not press it, and nothing goes. Everything else in Ember works without it.
Withdraw entirely
Sign out and keep using the desktop or iOS app offline, or delete the account. Neither reduces what the app does — syncing and the AI features are the only things an account adds.
Legal basis and your rights
Where the GDPR, UK GDPR, PIPEDA or a similar law applies: the basis for storing your content and account details is the performance of the service you asked for — without storing it, there is nothing to sync. The basis for sending content to the model is the same, and it happens only on your request. For anything in your account that counts as health or other sensitive data, the basis is your explicit consent, given at signup and withdrawable by deleting the account. Server logs rest on our legitimate interest in keeping the service secure. There is no processing based on profiling and no automated decision-making with legal or similarly significant effect: a plan is a suggestion you accept or reject.
The rights those laws grant — access, correction, erasure, portability, restriction and objection — are satisfied by the export and delete controls above, which are immediate and require no correspondence. If you would rather make a request in writing, use the contact address; we answer within thirty days. You may also complain to your local data protection authority. Residents of California and other US states with a consumer privacy law have the same rights of access, deletion and portability, and the right not to be discriminated against for using them; we do not sell or share personal information as those laws define it.
Children
Ember is not for children. You must be at least 16 to hold an account, and no account is knowingly created for anyone younger. If you believe someone under 16 has created an account, contact the address above and it will be deleted.
Cookies and local storage
The desktop and iOS apps use no cookies at all — they send a token from the operating system keychain. The web app keeps your session token in the browser's local storage, and the server sets exactly one cookie holding the same token when you sign in, strictly to keep you signed in. The web app also keeps a local copy of your records in the browser so it works offline. There are no analytics, advertising or third-party cookies anywhere in this service.
Changes
If this policy changes in substance, the effective date below changes with it and the previous version stays in the project's public git history, so the change is inspectable rather than announced. Material changes affecting data already collected will be shown in the app before they take effect, alongside the Terms.