Emberling
Effective 3 August 2026
Privacy Policy
Your data exists to run the app for you. We do not sell it, there are no ads and no ad trackers, nothing you write trains a model, and you can delete all of it in one tap.
What we collect
- Account — your email address, or your Apple ID identifier if you use Sign in with Apple. Apple can hide your real email; that works fine with Emberling.
- Your habit data — the habits you keep, their sizes, your completions, your check-ins, and your onboarding answers.
- Companion chats — messages you exchange with your companion, so the conversation has memory.
- Subscription status — whether Emberling Pro is active, as reported by Apple through RevenueCat. We never see your payment details.
- Connected apps — if you choose to connect Gmail, Google Calendar, Todoist or Spotify, we read only what is needed to place your habits around your real day. Every connection is optional and revocable in the app.
- Photos you choose to show — when you finish a habit you can attach a photo. The original never leaves your phone: the app makes a small copy (about 512 pixels wide), and only that copy is stored, in a private area of our backend that only your account can read. Nothing is public, nothing is shared with other people, and there is no feed. Delete one from the shelf, or delete your account, and the copy goes with it.
- Apple Health — if you choose to connect it, Emberling reads today's step count and exercise minutes, read-only. Health data is never used for advertising or marketing, never sold, and never given to data brokers. Today's step count may be included in the context sent to our AI provider (see “How AI is used”) purely so your companion can speak to the day you actually had. Revoke it any time in iOS Settings → Privacy & Security → Health.
Gmail, specifically
The Morning Post reads envelopes only — sender, subject, date and the snippet Google returns — for at most twelve messages from the last day, with promotions and social left out. Every Gmail call the app makes asks for metadata only, so the body of a message never crosses the wire.
Two Gmail operations are wired into the build at all: list messages, and read one message's metadata. Emberling cannot send, reply, archive or delete, because those operations do not exist in the app. Papers are kept for seven days and then deleted.
How AI is used
Onboarding answers, companion chats, the Morning Post's editorial and the monthly letter are processed by Anthropic's Claude models through our own server. Your data is not used to train AI models. We send only what is needed for that one piece of writing.
Photos are a separate, opt-in case. If — and only if — you say yes when first asked, the small copy of a photo you attach is sent to Anthropic for one automated check: is it appropriate, and does it plausibly show the habit. That is what lets your companion say she saw it. The image is not retained by Anthropic, is not used to train models, and the check never runs if you decline or switch it off later in You → Settings → “Let her look at your photos”. Declining keeps the photo on your shelf exactly as before; only the comment and the small bonus are lost.
The parts of the app that decide things — when a habit shrinks, when it is restored, how warm it is, which affirmation arrives — are ordinary code with no model involved, and they run on your device.
Where data lives
On your device first, synced to our backend (Supabase) so your account survives a lost phone. Data is encrypted in transit.
Analytics on this website
This marketing site uses two analytics tools so we can tell whether anyone is finding us: PostHog and Google Analytics. They record page views, which page you arrived from, and whether you tapped the App Store button. IP addresses are anonymised and we do not pass any URL query values to them.
This is the website only. The app itself uses PostHog to count in-app events so we know which features are used; it has never contained an advertising SDK, and nothing you write, photograph, or receive in the app is sent to either tool.
What we never do
- No selling or renting your data. Ever.
- No advertising inside the app, and no advertising SDK in it. The marketing site’s analytics are listed above.
- No reading your data for anything other than running Emberling for you.
Deleting your data
In the app: You → Account → Delete account. That removes your account and your data from our servers. You can also simply ask us.
Children
Emberling is not directed at children under 13, and we do not knowingly collect their data.
Changes
If this policy changes materially we will say so in the app. The effective date above always reflects the current version.
Contact
Questions or requests: support@emberling.app. A human reads every message, usually within a day.