Your journal is private. We built the architecture to guarantee it.
This Privacy Policy explains how Ember ("we," "us," "our") - a relationship-journaling app for macOS, iOS and iPadOS - collects, uses, and protects your information. Ember is developed and operated by a sole developer with no investors, no advertising partners, and no interest in your personal data.
We designed Ember from the ground up as a local-first, privacy-first application. We cannot read your journal entries, see the people you track, or access your stories. This is not a promise - it is a technical reality.
Everything you write, log, or attach in Ember is your content. This includes:
If you choose to import people from your Contacts, Ember asks for Contacts access and reads the contacts you pick on your device. Ember does not upload your address book anywhere. The people you import become Ember people, stored on your device like any others (and synced through your own iCloud if you have Ember Plus).
Ember sends only local notifications: an optional writing reminder if you turn one on, and a nudge when someone you are tending starts to fade. Ember asks before it turns notifications on. They are scheduled on your device, and no data is sent anywhere to make them work.
If you have Ember Plus, your data syncs across your Apple devices using Apple's CloudKit (CKSyncEngine). Without Plus, each device keeps its own journal. This means:
For details on how Apple protects your iCloud data, see Apple's iCloud data security overview.
We use PostHog, a product analytics platform, to understand how Ember is used at a structural level - which features are adopted, where flows are abandoned, and whether something is broken. This helps us improve the app.
Anonymous usage analytics are on by default. You can turn them off at any time in Settings ▸ Privacy ▸ "Share anonymous usage" (Privacy & Lock on iPhone and iPad). When it is off, Ember sends nothing to PostHog, crash reports included.
Ember has no user account system. There is no sign-up, no login, and no email collection. Analytics are recorded using a random, anonymous device identifier generated by PostHog. We never call PostHog's identify function with any personal information. We do not use advertising identifiers (IDFA), and we do not participate in any cross-app tracking or advertising network.
PostHog processes analytics data on servers in the United States. For PostHog's own privacy practices, see PostHog's Privacy Policy.
Ember allows you to search and embed songs from the Apple Music catalog into journal entries and stories. This feature:
Ember supports optional app locking using Touch ID, Face ID, or your device passcode via Apple's LocalAuthentication framework. This is processed entirely on-device by Apple's Secure Enclave. Ember never receives, stores, or transmits your biometric data - it only receives a boolean success/failure result from the operating system.
Ember allows you to optionally attach a place and weather to journal entries. This is:
Ember asks for location access only while you are using the app. You can remove the place or weather from any entry at any time.
Images, voice recordings, and other media you attach to journal entries or stories are:
Ember subscriptions (monthly, yearly, or lifetime) are processed entirely through Apple's App Store and StoreKit. We:
For purchase-related inquiries, refer to Apple's subscription management.
The following table summarizes how Ember handles each data category, aligned with Apple's App Privacy requirements:
| Data Category | Collected | Linked to You | Used to Track | Purpose |
|---|---|---|---|---|
| Usage Data (feature usage, screen views) |
Yes | No | No | App improvement |
| Diagnostics (crash data, error logs) |
Yes | No | No | Reliability & bug fixes |
| Identifiers (anonymous device ID) |
Yes | No | No | Analytics continuity |
| Purchases (subscription plan type) |
Yes | No | No | Business metrics |
| User Content (journal, people, stories) |
No* | - | - | Stored on-device only |
| Contact Info (names, phone, location) |
No* | - | - | Stored on-device only |
| Location (journal location pins) |
No* | - | - | Stored on-device; coordinates go to Apple only to look up a place or weather |
| Photos & Media | No* | - | - | Stored on-device only |
| Health & Fitness | No | - | - | - |
| Financial Info | No | - | - | - |
| Contacts (address book) | No | - | - | Read on-device only, when you import from Contacts |
| Browsing / Search History | No | - | - | - |
| Sensitive Info | No | - | - | - |
* "No" in the "Collected" column means the data never leaves your device or your personal iCloud account. Apple's App Privacy framework defines "collected" as data transmitted off-device to the developer's servers. Data stored locally and synced via the user's own iCloud does not meet this definition.
Ember integrates with a limited set of third-party services. We do not sell, rent, license, or share your personal data with anyone.
| Service | Purpose | Data Shared |
|---|---|---|
| Apple iCloud (CloudKit) | Device-to-device sync | Your content, with Ember Plus - kept in your private iCloud, encrypted by Apple, never seen by us |
| Apple StoreKit | Subscription management | Handled by Apple - we receive only entitlement status |
| Apple MusicKit | Song search for embeds | Search queries go to Apple's catalog API - not to us |
| Apple WeatherKit | Weather for a journal entry | Coordinates and date, when you ask for weather or have "Add place and weather" turned on - to Apple, not to us |
| Apple Maps (place search and geocoding) | Finding and naming a place | Coordinates or the place you search for, when you add a place or have "Add place and weather" turned on - to Apple, not to us |
| Link previews | Title and image for a link you paste | Ember fetches the page directly from that website, which sees your IP address like any browser visit - nothing goes through us |
| PostHog | Anonymous product analytics | Structural usage events and error codes (see Section 3) |
All user-created content (journal entries, people, stories, interactions, etc.) is stored on your device and remains there until you delete it. Ember provides built-in deletion for all content types.
If you use iCloud sync, deleting content in Ember also deletes it from your iCloud account across all synced devices. You can also manage or delete Ember's iCloud data through your device's Settings → Apple ID → iCloud → Manage Storage.
Anonymous analytics events are retained by PostHog according to their data retention policies. Because these events contain no personal information and are not linked to your identity, they cannot be attributed back to you. If you wish to request deletion of analytics data, contact us and we will facilitate this through PostHog.
Uninstalling Ember removes all locally stored data, including your journal, people, media, and settings. iCloud data persists in your Apple account until you manually remove it or it is automatically purged by Apple's retention policies.
We believe you should always be able to leave. Ember provides full data export in JSON format - the schema is openly documented in the archive format reference. You can also import from Day One, Apple Journal and Diarium. Your data is yours whether or not you are a paying subscriber.
Ember employs the following security measures:
Ember's architecture inherently aligns with GDPR principles:
Ember's local-first, no-account architecture means we hold minimal data about any user in any jurisdiction. If your local privacy law grants you rights regarding data we process, please contact us and we will honor your request.
Ember is rated 4+ on the App Store and is suitable for all ages. We do not knowingly collect personal information from children. Because Ember has no account system and all data remains on-device or in the user's own iCloud, there is no mechanism through which a child's personal data would reach us. If you have concerns, please contact us.
We may update this Privacy Policy from time to time. Material changes will be communicated through a notice within the app or on our website. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Ember after changes constitutes acceptance of the updated policy.
If you have questions, concerns, or requests regarding this Privacy Policy or your data, you can reach us through:
Ember was made by one person. This policy was written with the same care as the app - plainly, honestly, and with respect for the people who trust us with their memories.