Yours to keep

Two questions worth asking of anything you'd trust with a diary: who can read this, and what happens to it when the app is gone?

✦

A journal gets held to a higher standard than most software, and it should. People ask me two things before they'll write anything real in one: who can see this, and what happens when you get bored and move on? Both are fair. Here are the actual answers, not the reassuring marketing version.

There's no account, and no server holding your journal

You don't sign up for Ember. There's no email, no password, no profile, and nothing to log into. When you create a journal, Ember reads and writes files directly to your Mac's hard drive, the exact same way a text editor does.

This isn't a policy I could quietly change later. There is no server that holds your entries, so there is no switch to flip. Your writing never reaches me because there's nowhere for it to arrive. If you turn on iCloud sync, Apple handles the encryption and syncing. Ember stays out of it.

Everything that leaves your device

Ember is offline by default. The only things that ever hit the network are:

• Anonymous Analytics: We use PostHog to see aggregate data (like how many people use a specific feature) to help fix bugs. This is tied to a random device identifier. Your entries, names, and content are strictly blocked from ever leaving your device.
• Map Lookups: If you attach a location to an entry, Apple's native macOS geocoder turns coordinates into city names. This happens through Apple's native APIs, the same as the Photos app.
• iCloud Sync: If you explicitly turn on iCloud Backup, your encrypted files are synced via Apple's servers.

Your journal, without Ember

Many apps trap your writing in proprietary databases. Ember's architecture is completely open. Everything is stored in an open, beautifully documented JSON archive.

That means you can open your journal database in any code editor, search it with standard terminal tools, back it up by copying a single folder, and build your own tools on top of it. You can see the full specification for our data format in the archive format reference. The export already happened, every time you typed.

If I disappear

This is the one people are too polite to ask, so let me answer it plainly. I run Ember. I could stop, by choice, by circumstance, or by getting hit by a bus. A journal you'll still want in twenty years shouldn't depend on my continued attendance.

Because Ember is entirely native to macOS and local-first, it never locks you out because a server check failed. There are no DRM servers to go offline. If the website goes down forever, the app on your Mac keeps working.

And underneath all of it, your journal is just open JSON files. Even in the absolute worst-case scenario where macOS changes so much that the app stops running in 15 years, your database remains entirely readable and parseable by any developer on earth.

Your life archive belongs to you.