# Privacy

Ember stores shared memories so you and the people on your mantel can revisit them. This page describes what we collect and how we handle it.

## What we store

Account details (email, display name), your mantels, plans, photos, short videos, voice notes, and written notes you choose to keep. Sign-in and account-deletion codes are emailed and kept only until they expire.

If you turn on notifications, Ember stores a push subscription for that browser. Media lives in a private bucket; access goes through Ember with short-lived links.

## Voice notes

Ember writes a transcript of each voice note on its own servers. You can read it and search for what you said. The audio stays on Ember. It is not sent to another service.

## Product analytics

Analytics is optional. When you leave it on, Ember sends product usage data to PostHog: named events such as "signup completed" or "upload failed," performance measurements, and masked interaction signals about which screens and controls you use. Session replay is on whenever analytics is on. On-screen text is masked, and photos, video, audio, maps, and drawing surfaces are blocked. When analytics is off, Ember does not send events or session replays.

We don't send your name, email, photos, videos, voice notes, titles, notes, places, searches, or raw media links. Paths are scrubbed so memory and invite IDs aren't stored. You can turn analytics off at signup or later in Settings. When your account is purged, Ember asks PostHog to remove your record, events, and session recordings.

## Places and maps

When you search for a place, reverse-geocode a photo, or look up nearby spots, Ember sends coordinates or search text to Photon (Komoot’s open geocoder) to resolve place names. Those requests are for maps and place lookup only; Ember does not send your account email or memory titles with them.

## Email

Sign-in codes, invites, and account notices are delivered by Resend, our email provider. They receive the address the message is going to and the message itself. They do not receive your memories.

## Encryption and access

Traffic uses HTTPS. Data at rest uses provider-managed encryption. Ember isolates each mantel with authorization checks.

## Support access

When you ask Ember for help, support may open a read-only view of your account to reproduce a problem or check settings. They see the app as you see it, with photos and video covered. They cannot add, edit, delete, pair, upload, or export on your behalf.

This does not change your account settings, preferred mantel, sessions, or notifications.

## Export

From Settings, members can download a zip of the memories they can currently see on that mantel. A large mantel may come as more than one zip. The zip includes those memories as Markdown and original media files when available. It does not include doused memories, private memories, or a full Ember backup. Guests cannot download an export.

## Douse

Dousing a memory hides it from the timeline for 30 days. You can rekindle it during that window. After 30 days it is permanently removed from Ember, unless you extinguish it sooner.

## Delete account

Delete account from Settings after confirming with an email code. Ember marks the account for deletion and signs you out. For 30 days you can sign back in and restore it. After that, Ember purges the account:

- Solo mantel: the mantel and its memories are removed.
- Shared mantel with someone still there: they keep the shared timeline as a read-only archive they can export. Your private memories and notes on that mantel are removed. Shared memories stay.
- Guest seats: your guest access is removed.
- Passkeys and sessions for the account are removed.
- PostHog is asked to remove your analytics record, events, and session recordings.

## Leave a mantel

Leaving a mantel does not delete your account. You lose access to that mantel, and your private memories and notes there are removed.

- Couple mantel: anyone still there keeps the shared timeline as a read-only archive they can export.
- Group mantel: you choose whether your name stays on shared memories. If nobody is left, Ember removes the mantel after 30 days.
- Solo mantel: Ember removes it right away.

## Contact

For privacy or security questions, write to [support@embering.us](mailto:support@embering.us).