Privacy policy
What you log stays on your phone.
Ember is a perimenopause tracker for iPhone. This policy covers the Ember app and this website, including the launch waitlist. It is written to be read, so it is short and uses plain words. If anything is unclear, ask us.
The short version
- Everything you log in the app stays on your phone. There is no account and no Ember server holding your logs.
- Your logs leave your phone only when you export them yourself, as a report or a backup, through the iPhone share sheet.
- The app sends anonymous usage counts and crash reports. Neither ever includes anything you log.
- This website sets no cookies and counts visits anonymously.
- The waitlist is optional. If you give us your email, we use it only to tell you when Ember launches.
- We never sell data and never use it for advertising.
Who we are
Ember is run by Massimo Buonfrate, based in the United Kingdom, who is the data controller for the information described here. You can reach us at info@contactemberapp.com.
In the app
What you log
Your daily check-ins (symptom ratings, sleep, habits, bleeding, HRT taken), your monthly check-ins, your reports and your settings are stored in the app on your phone. None of it is sent to us or anyone else by the app.
Like other apps, Ember’s data is included in your phone’s iCloud backup if you have iCloud Backup turned on. That backup is held by Apple under your Apple account, not by us.
When you export. If you share a report PDF or a backup file, it goes wherever you choose in the share sheet, such as an email to your doctor or your Files app. What happens to it after that depends on where you send it.
Deleting everything. In the app, You › Your data › Delete all data removes everything the app has stored, cancels its reminders, deletes any exported files it still holds, and resets the anonymous usage ID described below.
Anonymous usage counts
To learn which parts of the app people use, the app sends a small number of anonymous events to PostHog, our analytics provider, on its EU servers. Those events are:
- a day’s check-in was saved (and whether it was for today)
- a report was created (and whether it was a preview)
- a trial started, or a subscription began (and which plan)
Each event carries basic technical details: the app and operating system version, device type and manufacturer, language, time zone and screen size. It never includes a symptom, a rating, a date you logged, a note you typed, or anything else you log. It does not include your device’s name.
The events are grouped under a random identifier that is not linked to you, your device or any account, so we can tell whether people come back to the app. Deleting all data in the app starts a new identifier. Your IP address reaches PostHog with each request, as it does with any internet connection, and PostHog is set to discard it, not store it. We do not look up your location and the app never reads your device’s advertising identifier.
PostHog keeps these events for at least a year, and may move older ones into archived storage after that. Because they are not linked to you, we can’t find “your” events to delete them on request. Deleting all data in the app means nothing new is linked to the old identifier.
Crash reports
If the app crashes, it sends a report to Sentry, on its EU servers, so we can fix the problem. A report contains the error, where in the code it happened, and your device model, operating system and app version. Anything that could carry what you log is removed before it is sent, and Sentry is set not to store IP addresses or derive a location.
Subscriptions
Payment is handled entirely by Apple; we never see your card details. When subscriptions launch, we’ll use RevenueCat to check whether yours is active. It will hold an anonymous ID and your purchase history for Ember, and nothing you log. We’ll update this section when it goes live.
On this website
No cookies, and nothing stored on your device. We count visits by sending PostHog an anonymous event when a page loads, when you tap a button on the page, when you tap “I’m interested”, and when you join the waitlist. Each event carries the page address, the website you arrived from (the domain only, such as instagram.com), and the campaign tag in our own links. It uses a random ID that exists only while the page is open, so we can’t recognise you on a later visit. If your browser sends a Global Privacy Control or Do Not Track signal, page views aren’t counted at all; tapping “I’m interested” still is, because being counted is what that button is for.
Our website host, Vercel, receives your IP address to deliver the pages, as every web host does. We don’t use it for anything, and we don’t add analytics or logging of our own on top. The fonts are served from this site, so your browser doesn’t contact Google or anyone else to load them.
The launch waitlist
There are two ways to tell us you’re interested, and only one of them involves any personal data.
- “I’m interested” adds one to an anonymous count. We learn nothing about who you are.
- “Email me when it’s live” is optional. If you give us your email, it goes to MailerLite, our email provider, on EU servers. We don’t send it anything else about you: not your IP address, and not where you came from.
What we use it for: one email when Ember is on the App Store, and possibly one before. Nothing else. We don’t track whether you open these emails or click their links. Your email is never added to our analytics.
Your confirmation: you’ll get an email asking you to confirm. Until you do, we won’t send you anything else. Every email has an unsubscribe link.
How long we keep it: the list exists for the launch. We delete it within 30 days after Ember is available on the App Store.
Legal basis: your consent. You can withdraw it any time by unsubscribing or by emailing us.
Who we share data with
Only these providers, and only for the purposes above. None of them receives anything you log.
| Provider | What for | Where |
|---|---|---|
| PostHog | Anonymous usage counts (app and website) | EU |
| Sentry | Crash reports from the app | EU |
| MailerLite | The optional waitlist email | EU |
| Vercel | Hosting this website | Global, including the US |
| Apple | The App Store, payments and iCloud backup, under Apple’s own privacy policy | Global |
| RevenueCat | Checking your subscription is active | US |
Where a provider handles data outside the UK, it does so under the safeguards UK data protection law requires, such as the UK’s international data transfer agreement or standard contractual clauses.
We never sell data, and we never use it for advertising.
Your rights
Under UK data protection law you can ask to see, correct or delete personal data we hold about you, object to how we use it, or withdraw consent. In practice, the only personal data we could hold about you is a waitlist email address; email us and we’ll deal with it. Everything you log is already in your hands, on your phone.
If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
Not medical advice
Ember organises what you log. It doesn’t diagnose anything or give medical advice. Ember is intended for adults.
Changes to this policy
If what we collect changes, we’ll update this page and the date at the top before the change takes effect.