Privacy

Who we are

Ember is operated by Digitiz ("we", "us"). We decide what data Ember collects and why, which makes us the data controller for it. You can reach us at [email protected].

2229 Victoria Park Avenue, Scarborough, Ontario, M1R1V8, Canada

What we collect, and why

Your account

When you first open Ember you get a guest account — an anonymous identifier, created on the device, holding no personal information at all. You can use the app this way indefinitely.

If you choose to sign in, you do so with Google or Apple. Ember never sees, handles, or stores a password. From that sign-in we receive and store:

• your email address
• your given name, if the provider supplies one
• the account identifier that provider uses for you

If you sign in with Apple and use Hide My Email, we only ever receive Apple's relay address, never your real one.

Your given name is stored in a table only you can read. Your username and avatar are different: they are readable by other Ember users, because that is how friends find you and how you are drawn on their screen. A username is optional and you choose it; we suggest not using your full name if you would rather not be findable by it.

Your focus activity

This is the substance of the app, and we store it so your progress survives reinstalling or changing phone:

• each focus session — its mode, when it started and ended, how long it ran, and the XP it earned
• a daily total — minutes focused, whether you met your goal, and whether the day counted towards your streak
• your progress — total XP, level, streak, lifetime minutes, session counts, your daily goal, and your badge count
• which badges you have unlocked, and when

What your friends can see. If you add a friend, that friend can read your daily focus record — the minutes and whether the day counted — because that is what a shared streak is. They cannot read your individual sessions, your email, or your given name. Removing a friend ends that access.

Friends

We store your friendships and the friend requests you send and receive, in both directions, so that both sides of a request can see its state.

Your device, for notifications

If you allow notifications, we register a push token for that device, which platform it is, and how far your clock is from UTC. The offset is there so that a notification about a friend's streak arrives in your waking hours rather than at four in the morning. It is an offset in minutes, not a location — it cannot tell us what city you are in, and we do not collect location data of any kind.

Subscriptions

Focus Pro is billed by Apple or Google, never by us. We never see your card, and we are never told your billing address. Our payment processor, RevenueCat, tells us only whether your subscription is currently active and when it runs out. We keep that answer, and a record of the subscription events behind it, so the app knows what you are entitled to.

What stays on your phone

Some of what Ember does never reaches us at all. This is a design decision, not an omission:

• The apps you block. Your selection is stored on the device and is never uploaded. On iPhone, Ember uses Apple's Screen Time (Family Controls) framework, which hands apps an opaque token rather than the app's name — so even locally, Ember cannot read which apps you picked, only enforce them. On Android, Ember reads your installed apps on the device to show you the list, and that list is never transmitted.
• Which app is in front, on Android. Enforcing a block takes two permissions you grant by hand: Usage access, so Ember can tell which app has just come to the front, and Display over other apps, so it can put the block screen in front of one you chose to block. Ember only looks while a focus session is actually running and the screen is on. Each check asks one question — is the app in front one of the ones you blocked — and the answer is thrown away on the spot. No record of what you opened is kept, on the device or anywhere else, and none of it reaches us. Take either permission away and blocking stops working; nothing else in Ember changes.
• Your settings — sound, music, haptics, animations, your daily goal — are stored on the device.
• A local copy of your progress, so the app works offline and opens instantly. It syncs to your account when you are signed in and online.

What we do not collect

Stated plainly, because most apps in this category do the opposite. Ember contains no analytics SDK, no crash reporting SDK, and no advertising SDK. Specifically, we do not collect:

• your location
• your contacts, photos, calendar, microphone or camera
• your browsing history or your activity in any other app
• an advertising identifier — Ember never asks to track you
• behavioural or usage analytics of how you move around the app

We do not sell your personal information, and we do not share it for advertising or cross-context behavioural advertising. We never have.

Who else processes your data

We use a small number of service providers to run Ember. They process data on our instructions and for no purpose of their own.

We also disclose data where the law genuinely requires it — a valid court order, for instance. We will tell you if that happens to your account unless we are legally forbidden from doing so.

Where your data is held

Our providers operate globally, so your data may be stored and processed outside the country you live in, including in the United States and the European Union. Where data leaves the European Economic Area or the United Kingdom, our providers rely on the European Commission's Standard Contractual Clauses.

How long we keep it

• Your account data — for as long as your account exists. Delete the account and it goes.
• Subscription event records — pruned on a rolling schedule once they are no longer needed to work out what you are entitled to.
• One anonymous record of a deletion — for 90 days. It holds a one-way hash of the request, the outcome, and the date. It holds no user id, no email, no name, and none of your data. It exists so a phone that was offline during the deletion can be told truthfully what happened instead of guessing. After 90 days it is deleted too. This is described in full on the Support page.

Deleting your account

You can delete your Ember account yourself, from inside the app, in four taps — Settings → Account → Delete account → confirm. It is permanent and it is not a request queue: deletion begins immediately.

If you have already uninstalled the app, or cannot sign in, email [email protected] from the account's own address. The full procedure, what is removed, and what survives is on the Support page.

Deleting your account does not cancel your subscription. Apple and Google own that billing relationship and we cannot cancel it for you. Cancel it in your store settings, or it keeps renewing.

Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it. Email [email protected] from the address on your account and we will answer within 30 days.

If you are in the European Economic Area or the UK, the GDPR gives you the rights of access, rectification, erasure, restriction, portability, and objection. Our legal bases are: performing our contract with you (your account, your progress, your subscription); your consent (notifications, which you can withdraw in your phone's settings at any time); and our legitimate interests in keeping the service secure and working. You may complain to your national data protection authority.

If you are in California, the CCPA gives you the rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We will not discriminate against you for exercising any of these rights.

The categories we have collected in the last twelve months, stated in the CCPA's own terms, are identifiers — your email address, your given name, your username, the account identifier Google or Apple uses for you, and your device's push token; commercial information — whether your subscription is active and the purchase history behind it; and your own activity in Ember — the sessions you finish and the progress they earn. That is the whole list. We collect no sensitive personal information, no location, no biometric data, and we draw no inferences about you. We have not sold or shared any of it, for money or for advertising, ever.

You can have an authorised agent make a request for you, if they can show us in writing that you appointed them. California's Shine the Light law (Civil Code § 1798.83) also lets you ask what personal information we gave third parties for their own direct marketing: the answer is none, because we do not do it.

If you are elsewhere, including Pakistan, the same rights are available to you as a matter of our policy, whether or not your local law currently compels them.

Children

Ember is not intended for children under 13, and we do not knowingly collect data from them. In parts of the European Economic Area the minimum age for consenting to online services on your own is 16; where that applies to you, that is the age for Ember too. If you believe a child has given us their data, email [email protected] and we will delete it.

Security

All traffic between Ember and our servers is encrypted in transit with TLS. Access to your account's rows in our database is enforced by the database itself, per row, rather than by the app asking nicely — another signed-in user cannot read your data by changing a request.

The local copy of your progress on your own phone is not separately encrypted by Ember; it is protected by your device's own storage encryption and your lock screen. No system is perfectly secure, and we will not pretend otherwise.

Changes to this policy

If we change this policy we will update the date at the top. If a change materially affects what we collect or who we share it with, we will tell you in the app before it takes effect.

Contact

[email protected]. A person reads it.