Privacy comes first

Ember is built so your words stay yours. Here is exactly how we protect them.

Reflections, values, prompts, and memories belong to you. We never sell them or use them for ads.

Everything stays on your device unless you turn on sync or AI. New workspaces start with every toggle off.

Add a passphrase to lock data with keys only your devices hold. If you lose the passphrase, we cannot unlock encrypted entries.

You decide when to enable sync or AI and can switch them off anytime without losing local access.

Each surface follows the same rule: local by default, explicit opt-in whenever something leaves your device.

Reflections, prompts, memories, and values live in local storage for fast, offline writing.
With encryption on, we only store ciphertext. Your passphrase never leaves your devices.

Only the surfaces you toggle (reflections, prompts, memory types, values) sync to Convex for backup across devices.
Turning sync off stops new uploads. Local copies stay on your device.
If encryption is enabled, data is encrypted before leaving your browser.

We only send the text you ask us to process in that moment-never your full workspace.
AI features stay off until you opt in. You can keep everything local and still use Ember fully.
Requests use the AI provider configured for your workspace. We do not use your entries for advertising or reselling.

We rely on privacy-preserving analytics (Plausible) in production to understand aggregate usage-no cross-site tracking or personal content.
Analytics only run when explicitly enabled in our environment configuration; there are no ad networks.

Export or import your archive so you can move between devices without relying on sync.
You can clear local data anytime. Signed-in users can delete synced data from account management.

Use the inbox that fits your question so we can respond faster.

Feedback about this policy or how we handle data.

Report vulnerabilities, abuse, or urgent safety concerns.

Privacy stays our first constraint. If we change how data moves, we will keep it opt-in and document it here.