Privacy

Last updated 21 August 2026

The short version

Ember exists to keep your letters, so it keeps your letters. It does not sell anything about you, does not run advertising, and does not use your correspondence to train anything.

It is not end-to-end encrypted. Your audio is uploaded to our servers to be transcribed, and the cleanup step sends the transcript to an AI provider. We could read what you write. We don't, and nothing here is set up to, but a promise is not encryption and we would rather say so than imply otherwise.

What is stored

• Your account — name, email address, and the sign-in identifier from Google or Apple.
• Your letters — text, typeface, paper, and delivery history, kept indefinitely because that is the product.
• Your contacts — the names, addresses, and email addresses you enter for the people you write to.
• Recordings — deleted after 30 days unless you keep one with a letter.
• Payment records — amounts, dates, and the last four digits of a card. Card numbers are held by Stripe and never reach us.

Who else sees it

Only the processors that make a letter happen, and only the part each one needs:

• Transcription — the audio, to turn it into text.
• Cleanup — the transcript, to tidy it. Turn this off per letter and the text never leaves our servers.
• Email delivery — the letter and the recipient's address.
• Print and post — the letter, the recipient's address, and your return address, which is printed on the envelope.
• Payments — the amount and your card, handled entirely by Stripe.
• Hosting and storage — everything, encrypted at rest.

Nobody else. We do not sell data, we do not share it for advertising, and we hand it to law enforcement only where we are legally required to.

People you write to

Writing to someone means we hold the address you gave us for them. If they receive a letter by email they can opt out with one tap and we will stop, whatever you do next. Anyone can block a sender and it is enforced before anything is sent.

A letter you post arrives with your return address on the envelope. That is a requirement, not an option — it is how an undeliverable letter comes back to you instead of being destroyed, and it means nobody receives anonymous paper mail through us.

What you can do

• Take it all with you. Settings has an export of everything you have written and received.
• Delete your account. It is hidden immediately and purged after 30 days. Letters already delivered to someone else stay with them — they are their letters too.
• Turn off read receipts, cadence nudges, and notifications, all separately.
• Skip the AI cleanup for any letter, so that text is never sent to a model.

Where it lives

Servers in the United States. Processors may handle data elsewhere. Everything is encrypted in transit and at rest.

Children

Ember is not for under-13s, and we do not knowingly hold their data.

Changes

If this changes in a way that matters, you will be told in the app before it takes effect — not by a quietly updated date at the top of a page.

Asking

Write to hello@ember.example.