Privacy
Ember stores shared memories so you and the people on your mantel can revisit them. This page describes what we collect and how we handle it.
What we store
Account details (email, display name, and any passkey you add), your mantels, plans, photos, short videos, voice notes, written notes, hearths, and a song if you attach one. Sign-in and account-deletion codes are emailed and kept only until they expire. Once you verify your email, your mantel exists and you are signed in.
If you turn on notifications, Ember stores a push subscription for that browser. Media lives in a private bucket; access goes through Ember with short-lived links.
Voice notes
Ember writes a transcript of each voice note on its own servers. You can read it and search for what you said. The audio stays on Ember. It is not sent to another service.
Drawings
When you ask Ember to draw a hearth, Ember sends Google the place names, the writing on those days, and any photos you picked as references, so it can make the page. Notes marked private and anything marked sensitive stay out. Your email and the rest of the mantel stay out. The drawing is stored with that hearth.
Songs
If you attach a Spotify link, Ember looks up the track title and artist from Spotify. Spotify receives the link. They do not receive your memories.
Product analytics
Analytics is optional. When you leave it on, Ember sends product usage data to PostHog: named events such as "signup completed" or "upload failed," performance measurements, and masked interaction signals about which screens and controls you use. Session replay is on whenever analytics is on. On-screen text is masked, and photos, video, audio, maps, and drawing surfaces are blocked. When analytics is off, Ember does not send events or session replays.
We don't send your name, email, photos, videos, voice notes, titles, notes, places, searches, or raw media links. Paths are scrubbed so memory and invite IDs aren't stored. You can turn analytics off at signup or later in Settings.
When Ember purges your account, it asks PostHog to delete your analytics profile and session recordings. Your events stay so we can see where Ember needs work, and after the purge nothing ties them to you. To have your events deleted as well, write to support@embering.us before your account is purged.
Places and maps
When you search for a place, Ember sends that search to Geoapify. When a photo has a location, Ember sends those coordinates too. Geoapify is operated by KEPTAGO LTD in Paphos, Cyprus, and the lookup runs in the EU. They do not receive your account email or memory titles. A saved place keeps the OpenStreetMap credit. Map tiles come from MapTiler.
From Others
From Others lets people add photos and video to one memory without an Ember account, using a link or a short code. They can give a nickname, and Ember remembers that phone while uploads are open, so the same phone can come back and a locked phone stays locked. Contributors are not members and do not see the rest of the mantel. What they add sits on that memory, and anyone who can edit the memory can delete it.
After they add something, Ember may offer a way to start their own mantel. That account is theirs, not a seat on the host mantel.
Ember Frame
Frame plays photos on a screen that has the link. That screen does not sign in. Anyone who can see the screen can see those photos until you end the session. You choose what it draws from, and you can keep a photo or a memory off it.
Sign-in codes, invites, and account notices are delivered by Resend, our email provider. They receive the address the message is going to and the message itself. They do not receive your memories.
Early Supporter
Link, a Stripe service, sells Early Supporter for Ember as the merchant of record. Link takes the payment, works out any tax included in it, and sends your receipts. Ember does not store your payment details, billing email, or billing address. Stripe keeps what you enter at Checkout, like your name and billing address. If you make a Link account, Link keeps your saved details. The time you agreed to the renewal is stored with the subscription at Stripe, not in Ember. What Stripe and Link store is in Stripe's privacy policy.
Ember stores which Ember account is linked to the Stripe customer, and which account pays. It also stores the subscription id, the price id, the subscription status, when the current period ends, whether a cancel is scheduled, when the confirmation email was sent, and when the last yearly reminder was sent.
When the subscription first becomes paid, Ember emails the address on the paying Ember account. The email says what Early Supporter includes for that mantel, that it is $9.99 a month in US dollars including any tax, that it renews every month until you cancel, that the price stays $9.99 while the subscription is active, that Link sells it and handles refund requests, and how to cancel. If that email does not go out, Ember sends it on a later run. About once a year after that email, Ember sends a reminder with those same facts. Link's receipts and renewal emails go to the email given at Checkout.
If you leave while someone else stays, that billing record stays, and Ember updates it when Stripe does, until the mantel or the paying account is deleted. If you are the only person on the mantel, Ember deletes the billing records when it removes the mantel. If you are the last person on a group mantel, Ember deletes those records when it removes the mantel after 30 days.
Deleting your account does not delete those records during the 30 days you can restore it. When Ember then deletes the account, it deletes the customer link and every subscription that account pays, and asks Stripe to delete the customer. Stripe keeps the records it is legally required to keep.
The price, how renewal works, how you agree to it, canceling, refunds, and what leaving does to the subscription are on the Terms.
Encryption and access
Traffic uses HTTPS. Data at rest uses provider-managed encryption. Ember isolates each mantel with authorization checks.
Support access
When you ask Ember for help, support may open a read-only view of your account to reproduce a problem or check settings. They see the app as you see it, with photos and video covered. They cannot add, edit, delete, pair, upload, or export on your behalf.
This does not change your account settings, preferred mantel, sessions, or notifications.
Export
From Settings, members can download a zip of the memories they can currently see on that mantel. A large mantel may come as more than one zip. The zip includes those memories as Markdown and original media files when available, including photos and video added through From Others. It does not include doused memories, private memories, or a full Ember backup. Guests cannot download an export. Contributors are not members and cannot export a mantel, but for 7 days after uploads close they can download what they added themselves.
Douse
Dousing a memory hides it from the timeline for 30 days. You can rekindle it during that window. After 30 days it is permanently removed from Ember, unless you extinguish it sooner.
Delete account
Delete account from Settings after confirming with an email code. Ember marks the account for deletion and signs you out. For 30 days you can sign back in and restore it. After that, Ember purges the account:
- Solo mantel: the mantel and its memories are removed.
- Shared mantel with someone still there: they keep the shared timeline as a read-only archive they can export. Your private memories and notes on that mantel are removed. Shared memories stay.
- Guest seats: your guest access is removed.
- Passkeys and sessions for the account are removed.
- PostHog is asked to delete your analytics profile and session recordings. Your events stay, with nothing tying them to you.
Leave a mantel
Leaving a mantel does not delete your account. You lose access to that mantel, and your private memories and notes there are removed.
- Couple mantel: anyone still there keeps the shared timeline as a read-only archive they can export.
- Group mantel: you choose whether your name stays on shared memories. If nobody is left, Ember removes the mantel after 30 days.
- Solo mantel: Ember removes it right away.
Contact
For privacy or security questions, write to support@embering.us.