Privacy Policy

Your account

The app makes an account on your first open so your habits have somewhere to live, before you have typed anything at all. That account holds a generated identity and, if you give one, an email address and a name you choose. Passwords are stored hashed and we cannot read them.

An email address is what makes the account recoverable. Without one, the account lives on that device and is gone with it.

What you write in the app

Habits, tasks, tags, shopping items, ritual steps, Deep Focus sittings, meditation lengths, and the day by day record of what you finished. That record is the app: it is what draws the wall, counts a streak and pays a reward.

A friends ember holds the first names you typed into it and the days you reached each of them. Embercraft never reads your contacts, asks for no permission to, and wants no last names, numbers or addresses: the names are words you wrote, exactly like the name of a habit.

It is stored against your account so the same fire shows up when you sign in somewhere else. Nobody reads it but you, except where a paragraph below says otherwise.

Step counts, Apple Health and Health Connect

If you turn the step counter on, the app reads daily step totals: from Apple Health on iPhone, and on Android from Health Connect and from the phone’s own step counter through Google Play services. It asks first, it reads nothing until you allow it, and it reads nothing else from Apple Health or Health Connect: no heart rate, no workouts, no sleep, no weight. Steps are read for one reason: to turn the walking you do into logs for your fire.

Daily totals are stored against your account so a day’s steps can pay their logs once and only once. Health data is never used for advertising or marketing, is never sold, and is never shared with any third party. Turning the permission off in your phone’s settings stops the reading immediately.

Your device

On each open the app notes the platform, the app version, the handset model and the operating system version, and stores them on your account. It is how we know which builds still need to work. It is not an advertising identifier and it is not used to recognise you anywhere else.

Notifications

The bell at the end of a meditation and the chime at the end of a Deep Focus sitting are scheduled by your phone, on your phone. There is no push service behind them, no device token leaves the app, and we cannot see whether one was delivered or opened.

Filing tasks and picking benefits with a classification model

When you add a task without choosing a tag, the app guesses where it belongs. To do that it sends the task’s title, your tag names, and the titles of a few tasks you have already filed, to OpenRouter, which passes them to a classification model. That model answers which of your tags the task belongs under and cannot write text at all. No email address, no account identifier and nothing else from your record goes with them.

Choosing a tag yourself when you write the task means the call is never made. Tasks you have already filed are never re-sent on their own account.

When you tap Pick for me on an ember, or save one with no benefits picked, the app sends that ember’s emoji, name, the line under it, its why and the names of its steps to the same model through OpenRouter. For a tag, on the same tap or when you make one, it sends the tag’s name and the titles of the tasks filed under it. The model answers how well each benefit fits and cannot write text. Nothing else from your record goes with them. Pick the benefits yourself and the call is never made.

Meal photos and the calorie tracker

The calorie tracker is off unless you turn it on. When you photograph a meal, or describe one in words, the app sends that photo or text through OpenRouter to Anthropic, whose model estimates the calories, protein, carbs and fat in it. The photo is shrunk first, and nothing else goes with it: no email address, no account identifier, nothing else from your record. Neither of them uses it to train models.

A small copy of the photo is kept with the meal in your account, so the list can show it; delete the meal and the copy goes with it. Your goal, age, height and weight, if you give them, are kept on your account only to work out your daily numbers, and are never sent to Anthropic.

Daily reflection answers

The daily reflection is an ember you add yourself. When you answer its question, the app sends the question, your answer and up to six of your earlier answers with their questions and dates through OpenRouter to OpenAI, whose model writes the short reply you see and the question you are asked the next day. Nothing else goes with them: no email address, no account identifier, nothing else from your record. Neither of them uses it to train models.

Your answers, the replies and the next question are kept in your account so the card can show them again. Delete the ember, or the account, and they go with it.

Measuring where installs come from

Embercraft uses AppsFlyer to tell which advert, link or post an install came from, so a small team can stop paying for the ones that do not work. AppsFlyer receives device and network identifiers, your IP address, coarse device information such as the handset model and language, and the identifier of your account, so a report can be matched to an account, never to a name.

It also receives a few in-app events: the install itself, the first run finishing, three embers lit in the first two days, the membership screen being opened, and, once the store has confirmed it, a membership being bought or renewed.

On iPhone this includes Apple’s advertising identifier only if you allow tracking when the system asks; say no and it is not collected, and you can change the answer at any time under Settings, Privacy & Security, Tracking. AppsFlyer processes all of this on our behalf as a data processor, and passes the result, which advert an install came from, to the network that ran the advert, so that network can be paid and can stop showing it to people who already have the app. Their own privacy policy is at appsflyer.com/legal/services-privacy-policy. Nothing you write in the app is sent to them, no Health data is sent to them ever, and if you want what they hold about you erased, write to us and we will have it done.

If an advert on Facebook or Instagram brought you to our website, Meta adds a click identifier to the address you arrive on. When you press a store button there or first open the app you installed from it, and again if you light three embers in your first two days or start a trial or buy a membership, our server tells Meta that the click led to it. It sends the click identifier, the page you landed on, the time, the price of a purchase, and the IP address and browser type of the request. It does not send your account, your name or anything you write in the app, and no script from Meta runs on our website. If no advert brought you, nothing is sent. Meta’s privacy policy is at facebook.com/privacy/policy.

Memberships

Apple and Google take the payment for a membership, and never pass us a card number. Between them and the app sits RevenueCat, which keeps the subscription’s status: it receives the identifier of your account and the receipt Apple or Google issues for a purchase, and it is what our server asks when it decides whether the cap is off for you. Once a purchase is confirmed, RevenueCat also tells AppsFlyer about it, so the sale can be counted against the advert that led to it.

The ideas board and the survey

Anything you post on the ideas and bugs board is public to other players, along with the name on your account. Treat it as writing on a wall. The occasional in-app survey is optional, and skipping it changes nothing about the app.

Hardcore mode is off unless you turn it on. While it is on, and for every run it has ever held, the leaderboard shows other players the name on your account and how many days the run lasted.

The tester program is optional too. If you join, we record which days you opened the app during it, because that is its rule, and keep your answers to its daily questions with your account. Only we read them, and they go when the account does.

Where it is kept, and who else touches it

Your rows live in a PocketBase database hosted on Railway in Amsterdam, in the EU. The app’s server runs on Vercel in Frankfurt. Those two, OpenRouter for filing tasks and picking benefits and, with Anthropic, for reading meal photos and, with OpenAI, for answering daily reflections, AppsFlyer for measuring installs and RevenueCat for memberships are the only processors involved. Meta is told about a click on one of its own adverts, as described under measuring installs, and nothing else. Apple and Google handle every membership payment and never pass us a card number.

We do not sell personal data, and there is no advertising network inside the app.

How long, and how to end it

Your record is kept until you delete it. Settings, then Delete account, removes the account and the rows attached to it. Posts already on the ideas board stay so the threads still make sense, with the name taken off them.

If anything is unclear or you want a copy of what is held, write to filip@poxi.co and a person will answer.

Your rights

Under the GDPR you can ask for a copy of your data, ask for it corrected, ask for it deleted, ask for it in a portable form, or object to a particular use of it. The lawful bases are the contract between us for running the app, your consent for step counts and for tracking, and our legitimate interest in keeping the thing working and knowing which adverts paid off.

If we get it wrong you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the authority where you live.

Children

Embercraft is not made for children under 13, and we do not knowingly keep an account for one. In the EEA, anyone under 16 needs a parent or guardian’s consent. If a child’s account exists, write to us and it will be deleted.

Changes

If this policy changes in a way that matters, the date at the top changes and the app says so before the change takes effect. Small corrections just get the new date.