Ember Privacy Policy
Ember · Effective November 1, 2026 · ppejic89@gmail.com
Profile, pantry, plans, HealthKit records and progress photos stay on your device. No CloudKit, advertising or tracking. HealthKit data and progress photos are never sent to AI.
Only after explicit consent, unresolved food or movement text, a dish description and device language are sent through Cloudflare to OpenAI for understanding. An optional photograph of a meal plate is sent only after a separate explicit photo-consent action. Progress photos and HealthKit data are never sent. Requests use storage disabled. OpenAI may retain abuse-monitoring logs for up to 30 days under its default API terms. Do not include personal information in food text. Nutrition labels use on-device Vision; voice uses on-device Speech whenever available. For unsupported languages, voice audio is sent through Cloudflare to OpenAI only after separate, revocable voice consent. Ember never logs or stores the audio or transcript on its server; temporary device audio is deleted after transcription or cancellation. Transcripts are shown for editing before food understanding. OpenAI is a processor; provider abuse-monitoring retention may apply as described above.
Barcode lookup sends the EAN to Open Food Facts. Installation identifier and IP are used for short-lived rate limiting. We do not log food text. Delete local entries or remove the app to delete local data. Revoke AI and server voice consent separately in the app; revoke Health permissions in Settings.