Privacy policy
What you log stays on your phone.
Ember is a perimenopause tracker for iPhone. This policy covers the Ember app and this website, including the launch waitlist. It is written to be read, so it is short and uses plain words. If anything is unclear, ask us.
The short version
- Everything you log in the app stays on your phone. There is no account and no Ember server holding your logs.
- Your logs leave your phone only when you export them yourself, as a report or a backup, through the iPhone share sheet.
- The app sends anonymous usage counts and crash reports. Neither ever includes anything you log.
- This website sets no cookies and counts visits anonymously.
- The launch waitlist is closed. Emails left on it were used only to tell people Ember had launched, and are being deleted.
- We never sell data and never use it for advertising.
Who we are
Ember is run by Massimo Buonfrate, based in the United Kingdom, who is the data controller for the information described here. You can reach us at info@contactemberapp.com.
In the app
What you log
Your daily check-ins (symptom ratings, sleep, habits, bleeding, HRT taken), your monthly check-ins, your reports and your settings are stored in the app on your phone. None of it is sent to us or anyone else by the app.
Apple Health
If you turn on Apple Health in the app’s settings, Ember reads your sleep and your workouts from the Health app, on your phone, to fill in that day’s check-in. It reads nothing else, never writes to Health, and never sends Health data to us or anyone else. It is not used for advertising or analytics. What you allow is up to you, in the Health app under Sharing › Apps, and you can turn it off there or in Ember at any time.
Like other apps, Ember’s data is included in your phone’s iCloud backup if you have iCloud Backup turned on. That backup is held by Apple under your Apple account, not by us.
When you export. If you share a report PDF or a backup file, it goes wherever you choose in the share sheet, such as an email to your doctor or your Files app. What happens to it after that depends on where you send it.
Deleting everything. In the app, You › Your data › Delete all data removes everything the app has stored, cancels its reminders, deletes any exported files it still holds, and resets the anonymous usage ID described below.
Anonymous usage counts
To learn which parts of the app people use, the app sends a small number of anonymous events to PostHog, our analytics provider, on its EU servers. Those events are:
- which onboarding screen was reached (the screen only, never your answers)
- onboarding was finished, and the subscription screen was shown
- a day’s check-in was saved (and whether it was for today)
- a report was created (and whether it was a preview)
- a trial started, or a subscription began (and which plan)
Each event carries basic technical details: the app and operating system version, device type and manufacturer, language, time zone and screen size. It never includes a symptom, a rating, a date you logged, a note you typed, or anything else you log. It does not include your device’s name.
The events are grouped under a random identifier that is not linked to you, your device or any account, so we can tell whether people come back to the app. Deleting all data in the app starts a new identifier. Your IP address reaches PostHog with each request, as it does with any internet connection, and PostHog is set to discard it, not store it. We do not look up your location and the app never reads your device’s advertising identifier.
PostHog keeps these events for at least a year, and may move older ones into archived storage after that. Because they are not linked to you, we can’t find “your” events to delete them on request. Deleting all data in the app means nothing new is linked to the old identifier.
Feedback you send
If you choose to use Send feedback in the app’s settings, the message you write and the type you pick (an idea, a problem, something you like, or other) are sent to PostHog under the same random identifier. Nothing is sent until you tap Send, and nothing from your logs is attached. There is no name or email with it, so we can’t reply; to get an answer, email us instead. Please leave out anything personal you would rather keep to yourself.
Crash reports
If the app crashes, it sends a report to Sentry, on its EU servers, so we can fix the problem. A report contains the error, where in the code it happened, and your device model, operating system and app version. Anything that could carry what you log is removed before it is sent, and Sentry is set not to store IP addresses or derive a location.
Subscriptions
Payment is handled entirely by Apple; we never see your card details. We use RevenueCat to check whether your subscription, or a lifetime code you’ve redeemed, is active. It holds an anonymous ID and your purchase history for Ember, and nothing you log.
On this website
No cookies, and nothing stored on your device. We count visits by sending PostHog an anonymous event when a page loads, and when you tap through to Ember on the App Store. Each event carries the page address, the website you arrived from (the domain only, such as instagram.com), and the campaign tag in our own links. It uses a random ID that exists only while the page is open, so we can’t recognise you on a later visit. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is counted at all.
Our website host, Vercel, receives your IP address to deliver the pages, as every web host does. We don’t use it for anything, and we don’t add analytics or logging of our own on top. The fonts are served from this site, so your browser doesn’t contact Google or anyone else to load them.
The launch waitlist
Before Ember was on the App Store, you could leave your email with MailerLite, our email provider, on EU servers, to hear when it launched. The waitlist is now closed, and no new emails are collected. We use it only for launch news, without tracking opens or clicks, and we delete the list and everyone on it within 30 days of launch. Your email was never added to our analytics. Until then you can unsubscribe from any of those emails, or email us to be removed.
Who we share data with
Only these providers, and only for the purposes above. None of them receives anything you log.
| Provider | What for | Where |
|---|---|---|
| PostHog | Anonymous usage counts (app and website) | EU |
| Sentry | Crash reports from the app | EU |
| MailerLite | The optional waitlist email | EU |
| Vercel | Hosting this website | Global, including the US |
| Apple | The App Store, payments and iCloud backup, under Apple’s own privacy policy | Global |
| RevenueCat | Checking your subscription or lifetime access is active | US |
Where a provider handles data outside the UK, it does so under the safeguards UK data protection law requires, such as the UK’s international data transfer agreement or standard contractual clauses.
We never sell data, and we never use it for advertising.
Your rights
Under UK data protection law you can ask to see, correct or delete personal data we hold about you, object to how we use it, or withdraw consent. In practice, the only personal data we could hold about you is a waitlist email address; email us and we’ll deal with it. Everything you log is already in your hands, on your phone.
If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
Not medical advice
Ember organises what you log. It doesn’t diagnose anything or give medical advice. Ember is intended for adults.
Changes to this policy
If what we collect changes, we’ll update this page and the date at the top before the change takes effect.