Privacy Policy

Last updated: 4 October 2026

Embers ("we", "us") is a self-reflection and journaling companion. It is not therapy, medical advice, diagnosis, or crisis support. This policy explains what we collect, why, how we use AI, how long we keep it, and the rights you have under UK and EU GDPR.

What we collect

• Account data: email and authentication identifiers.
• Reflection data: assessment answers, check-ins, journal entries, plans, and AI-generated reflections.
• Sensitive content: what you write may describe mood, stress, health, work, or relationships. Only write what you're comfortable storing.
• Preferences: reminder settings, notification subscriptions, time zone.
• Technical data: basic device and log information for security and reliability.

How AI processing works

AI features are off until you turn them on in Settings, and you can turn them off at any time. When they are on and you ask for a reflection, plan, insight or transcription, the relevant text or audio is sent over an encrypted connection to a third-party AI provider (Google or OpenAI) via our AI gateway to produce your result. Providers' own terms govern how they handle it; we do not sell your content. With AI off, nothing is sent and you get a standard plan and no automatic reflection.

AI reflections are generated automatically and can be wrong. Nothing the AI says is medical, psychological or clinical advice. If your writing contains language about self-harm, suicide, abuse or being in danger, we won't generate a reflection. We'll show our safety resources instead.

Human access

A very small number of operators may access stored content only when strictly necessary to investigate a serious bug, security incident, or abuse report. All such access is limited to those purposes. We never read journals out of curiosity.

Retention and deletion

• Reflections are kept while your account is active.
• Delete individual journal entries any time from the Journal page.
• Request deletion from Settings. After a 30-day grace period, our deletion process removes your account and the content listed above. If a step fails it is retried, so it can take longer; email us if you need confirmation.
• Copies may remain for a limited time in backups and provider logs until they expire.

Your GDPR rights

You can access, correct, export, restrict, or erase your personal data, and object to processing. Export and deletion are self-serve in Settings; for anything else, emailhello@embers.me. You may also complain to your local data-protection authority (e.g. the UK ICO).

Processors we use

Hosting and database (Supabase), AI gateway (Lovable AI, using Google Gemini and OpenAI), email delivery and payments (Stripe). Embers subscriptions are sold by 55 Digital Limited. Each processor is bound by data-processing terms.

Cookies and optional analytics

Essential cookies keep you signed in. We also use Plausible, which counts visits without cookies. Google Tag Manager is optional and off unless you choose "Accept analytics". If you accept, it loads only on our public homepage, never on sign-in, reflection, journal, plan, checkout or account pages, and advertising features stay off. You can change your choice any time with "Cookie choices" below or at the bottom of the page. Rejecting stops it loading.

Contact

Questions or requests? Email hello@embers.me.