Legal

Privacy Policy

Last updated 13 July 2026

Ember is private by design. Recovery is sensitive, and we built Ember so your recovery is yours. There is no account and no sign-up, and the information that matters most never leaves your phone. This policy explains exactly what happens with your data.

What stays on your device

Everything that makes up your recovery is stored locally on your iPhone and is never uploaded to us:

Your sober start date, day count, and reset history
Your reasons for stopping and your triggers
Your daily reflections, moods, and notes
Your milestones, and money and time saved
Your app settings and preferences

We cannot see any of this. It is not sent to our servers, and it is not backed by an account.

The craving coach

Ember's in-the-moment coach is one of only two features that use the internet (the other is the optional Global Hearth, below). When you talk to the coach, the messages in that conversation — along with the reasons and triggers you chose during setup, so the reply is relevant to you — are sent over an encrypted connection to Ember's secure server (api.aiappnation.com), which uses a large language model to generate a warm, supportive response and sends it back to your device.

We do not attach your name or an account to these messages (there is no account), we do not sell them, we do not use them for advertising, and we do not use them to train AI models. They are used only to generate your reply in that moment. The conversation is stored on your device, not on our server.

If you are offline, the coach falls back to on-device coping tools (breathing, an urge-surf timer, and your own saved reasons) so a 2am urge is never blocked by a lost signal — and nothing is sent anywhere.

The Global Hearth (optional)

The Global Hearth is an optional, anonymous sense of company — how many people are keeping their flame lit today, and how many others are on the same sober day as you. It is not a feed, a leaderboard, or a friends list: there are no names, no profiles, no ranking, and nothing you post.

When it's on, Ember sends a single anonymous check-in to our server: a random token generated on your device (never your name, your Apple ID, or anything that identifies you) and your current sober-day number. We use these only to show the live, aggregate counts — never to profile you, never for advertising, never sold. You can turn the Global Hearth off at any time in Settings, and then nothing is sent.

Notifications

If you allow them, Ember schedules gentle local notifications (for example, an evening check-in) directly on your device using Apple's notification system. These are created on your phone; we do not run a push server and we do not know if or when you receive them.

Optional iCloud backup

If you turn on backup, your recovery data is stored in your own private iCloud container, managed by Apple and tied to your Apple ID. We have no access to it. You can turn this off at any time.

What we don't do

No third-party advertising or analytics SDKs, and no tracking across apps or websites.
No selling or sharing of your data with data brokers — ever.
No user profiles, no cross-device identity, no location tracking.

Payments

Subscriptions and the lifetime purchase are handled entirely by Apple through the App Store. Ember never sees or stores your payment information.

Deleting your data

Because your data lives on your device, deleting the Ember app removes all of it. There is no account for us to delete. If you used iCloud backup, you can remove it from your iCloud settings.

Children

Ember is not directed to children under 13 and we do not knowingly collect information from them.

Changes

If we update this policy, we'll post the new version here with a new date. Material changes will be reflected in the app.

Contact

Questions about privacy? Email [email protected].