Privacy Policy

What the app stores

Everything you enter is stored in a private database on your device only:

• Lists & entries: notes, to-dos and projects, reminders, bucket-list items, reading and movie lists, and recipes, including their titles, text, dates, categories and tags.
• Journal: your Log topics and their dated entries.
• People: details you record about people (names, birthdays, how often you want to catch up, notes and gift ideas).
• Tend check-ins: your daily check-in (an energy level, the tags you choose, and an optional note).
• Kindling: the focus and habit goals you set, and your progress against them.
• Photos: images you attach from your gallery, copied into the app’s private storage.
• App settings: your own preferences, such as which notifications you have enabled and what time of day they arrive.

This lives in the app’s private storage area, which Android isolates from other apps. The app never transmits any of it.

Permissions

Ember requests two Android permissions. Neither gives it access to your data:

• Notifications: so reminders, birthday nudges and catch-up nudges can appear. Android asks for this the first time a notification actually becomes relevant rather than on first launch, and you can decline it or revoke it later. Everything else in the app works normally without it.
• Run at startup: so reminders you have already set survive a reboot. Android discards pending alarms when a phone restarts; this lets Ember put back the ones you scheduled. It grants access to nothing else.

Ember does not hold the internet permission. It cannot open a network connection at all, which is what makes “collects no data” a structural fact about the app rather than a promise you have to take on trust.

It also requests no storage permission and no camera permission. Photos are attached through Android’s built-in photo picker, which hands over only the images you select, and the app has no camera feature of any kind.

Notifications

If you turn notifications on, Ember builds them on your device from your own data: a reminder shows that reminder’s title, and a birthday or catch-up nudge shows the person’s name. They are scheduled and delivered entirely on your device; nothing is sent anywhere to produce them, and none of their content passes through any server.

As with any app’s notifications, they can appear on your lock screen. If an entry is sensitive, Android’s per-app notification settings let you hide notification content on the lock screen, or turn Ember’s notifications off entirely (in Android’s Settings, or from Ember’s own Notifications screen).

What the app does not do

• No data collection: nothing you enter is sent off your device by the app.
• No sharing or selling of data: we never see your data, so it cannot be shared or sold.
• No third-party services: no analytics, advertising, crash-reporting or tracking SDKs of any kind.
• No accounts: no sign-up, no login, no cloud service.
• No profiling and no automated decision-making: the app does not build a profile of you or make decisions about you.

When data can leave your device: only when you choose

There are three ways data can leave your device, and you initiate all of them:

• Android device backup. If you have Android backup switched on, Android itself backs up Ember’s database, not your attached photos, to your own Google account, so it can be restored when you set up a new phone. This is a standard Android feature managed by your device and your Google account, not by us; we have no access to it. You can turn it off at any time in your device’s Settings, under Backup.
• Manual export. The Backup screen lets you export a copy of your data as a file and choose where it goes (your own cloud drive, email, or computer) using Android’s share sheet. The destination is entirely your choice, and the export only happens when you tap the button.
• Opening a link. If you tap a web address you have saved in one of your entries, Ember hands it to your browser and the browser loads it. Ember never loads pages itself and passes on nothing but the address you tapped, but that address does leave the app at that point, and whatever site you open is then covered by its own privacy policy.

Data security

Your data lives in Ember’s private app storage, which Android protects from access by other apps. Because the app never transmits data, there is no data in transit to protect. Please use a device lock (PIN, pattern or biometric) so your data stays protected if your phone is lost or stolen, and treat exported backup files with the same care as the data inside them.

Data retention and deletion

• In-app data: your data stays on your device for as long as you keep it. You can archive or delete individual items at any time; deletion is immediate and permanent.
• Uninstalling: uninstalling Ember removes all of the app’s data from your device.
• Backups & exports: device backups live in your own Google account and are governed by your Android backup settings; exported files live wherever you saved them. Deleting those copies is in your control.

Children

Ember is a general-audience app and is not directed at children under 13, or the equivalent minimum age in your jurisdiction. The app collects no data from anyone, including children.

Your rights

Because your data never leaves your device, you are always in direct control of it: you can read, change, export and delete everything from within the app. There is no account to close and no copy of your data held by us to request, correct or erase; we have none.

Changes to this policy

If Ember’s data practices ever change (for example if a future version adds an online feature), this policy will be updated before that change ships, the date above will be revised, and material changes will be called out in the app’s update notes.