privacy policy

1. what we collect

we try to collect as little as possible. depending on how you use ember, that can include:

• what you tell ember: the voice notes you record and the text ember generates from them, including the tasks and steps you work on.
• account details, if you create an account: an identifier from Sign in with Apple or Google, or an email address. you can use ember anonymously, without an account.
• subscription status: whether you have an active trial or paid plan. the payment itself is handled by the app stores, not by us.
• basic technical data: app version, device type, and operating system, used to keep ember working and to diagnose crashes.

we do not collect your contacts, your precise location, or your advertising identifier, and ember contains no third-party advertising or tracking software.

2. voice data

voice notes are the heart of ember, so we treat them with care.

when you record a note, the audio is sent to our backend and to a speech-to-text service so it can be turned into text. ember then uses that text to suggest a single next step. we do not use your voice notes to build advertising profiles, and we do not sell them.

you stay in control. you can delete any note from within the app, and deleting your account removes your notes on the schedule described in data retention below.

3. how we use your data

we use the data above only to:

• run the core feature: turn what you say into one small, doable step.
• keep your plan and progress in sync across your devices, if you have an account.
• provide support when you contact us.
• keep ember stable and secure, and understand crashes so we can fix them.
• meet our legal, accounting, and tax obligations around your subscription.

where the law requires a legal basis, for example under the GDPR, we rely on performing our contract with you, your consent for optional features, and our legitimate interest in keeping ember safe and working. you can withdraw consent at any time.

4. storage and backend

ember's backend and database are hosted with our infrastructure provider, Supabase, in East US (North Virginia, us-east-1). data is encrypted in transit, and access is limited to the small number of people who need it to operate the service.

we do not run our own advertising or analytics servers, and we do not build a marketing profile of you.

5. third parties

we share data only with the service providers we need to run ember, and only for that purpose:

• Apple and Google: to process your subscription and, if you use Sign in with Apple or Google, to confirm your identity.
• our cloud hosting and database provider: to store your account and task data.
• a speech-to-text provider: to convert your voice notes into text.
• error and crash reporting tools: to help us find and fix problems.

these providers act on our instructions under contract. we do not sell your personal information to anyone, and we do not share it for cross-context behavioural advertising.

6. international transfers

ember is used around the world, so your data may be processed in countries other than your own, including East US (North Virginia, us-east-1) and the countries where our providers operate. where we transfer personal data out of the United Kingdom or the European Economic Area, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses.

7. data retention

we keep your data only as long as we need it. while your account is active, we keep your notes, tasks, and account details so ember works for you. when you delete a note it is removed promptly, and when you delete your account we delete or anonymise your personal data within 30 days, except where we must keep limited records for legal, tax, or fraud-prevention reasons.

8. your rights: GDPR and CCPA

depending on where you live, you have rights over your personal data. these can include the right to:

• access the personal data we hold about you.
• correct data that is wrong or incomplete.
• delete your data.
• restrict or object to how we process it.
• receive your data in a portable format.
• withdraw consent you have given.

to exercise any of these, contact us using the details below, and we will respond within the time your local law requires.

if you are in the UK or the EEA

you can also lodge a complaint with your local data protection authority.

if you are a California resident

you have the right to know what personal information we collect and to request its deletion, and the right not to be discriminated against for exercising your rights. we do not sell or share your personal information as those terms are defined by California law.

9. children

ember is not directed at children. you must be at least 16 to use it, and we do not knowingly collect personal data from anyone under that age. if you believe a child has provided us with personal data, contact us and we will delete it.

10. changes to this policy

we may update this policy as ember changes, or as the law requires. when we make a material change we will update the date at the top of this page and, where appropriate, let you know in the app. the current version always lives at this address.

11. contact

if you have a question about this policy, or want to exercise your rights, contact:

Szymon Blumczyński IT Solutions, NIP 9721341865.
by email: hello@embersteps.com.
a postal address is available on request.