Privacy Policy
Last updated October 9, 2026
Who we are
Ember ("we", "us") is an AI follow-up assistant operated at emberapp.org. This policy explains what data we access, why, and the choices you have.
What we access
With your explicit consent we access, and only for the features below: your Google account email address (to identify you and set your send-from address); Gmail messages, read-only, to build your digest, rank who needs a reply, extract promises, and learn your writing tone; Gmail send, to deliver only the replies you review and approve; Google Calendar events, read-only, for meeting prep and post-meeting follow-ups; Google Meet transcripts and notes in Drive, read-only, to turn them into meetings on a contact's timeline and to show them to AI assistants you choose to connect; and your Google Contacts, read-only, to keep your relationship list in sync. We request the narrowest scope each feature needs, and we never send a message without your explicit action.
Browser extension
The optional Chrome extension saves the LinkedIn person or company you are viewing into your private account only when you click Save, and records online meetings — the meeting tab's audio plus your microphone — only when you start a recording. While you view a LinkedIn profile it can show what Ember already knows about that person: it sends the profile's address (and the company it shows) to Ember, which answers only if the person is already in your contacts. Nothing from that lookup is stored, and you can turn it off in the extension. On meeting sites it checks only the page address, to offer a recording. It can also show a brief of what you already hold on a meeting's attendees, and a notification when a recording is ready. Recorded audio is buffered on your device and sent once over an encrypted connection for transcription. On our servers the audio is held in encrypted storage only until its transcript is ready and is then deleted — or, if processing fails, kept for up to 7 days so you can retry, then deleted; deleting the meeting deletes it at once. Only the transcript and its analysis are kept in your private workspace, where you can edit or delete them. Where the law requires it, you are responsible for telling participants that a meeting is being recorded.
Meeting imports (integrations)
You can connect recording tools you already use — a notetaker, a hardware recorder, a meeting platform, or a webhook from your own automation — and route their meeting transcripts into Ember. We process imported transcripts exactly like meetings recorded in Ember: the transcript and its analysis are stored in your private workspace, folded into the contacts who were there, and you can edit or delete them at any time. Imported audio, where a source provides it, exists in memory only for one transcription call and is never stored. Disconnecting a source stops new imports immediately and keeps what was already imported. Because these meetings were recorded outside Ember, you are responsible for having obtained any consent the law required when the original recording was made.
How we use it
We use this data only to provide the product: ranking who needs a reply, drafting messages in your voice, tracking promises, and enriching your contacts. To generate drafts and summaries we send the minimum necessary content to our AI processors (Anthropic Claude and Google Gemini). We do not use your data to train models and we do not sell it.
AI assistants you connect
If you connect an AI assistant (such as Claude or ChatGPT) to Ember through our MCP connector, that assistant can read your follow-ups, promises, contacts and meetings — including what Ember drew from your Gmail and Google Contacts, and the full transcripts of your recorded and imported meetings, among them Google Meet transcripts and notes read from your Drive — and can act on them only within the permissions you grant on the connect screen. The assistant provider's own terms govern what it does with that data. You can revoke a connection at any time in Settings.
Google API Limited Use
Ember's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide and improve user-facing features, is not transferred to others except as needed to provide the service, at your direction (for example to an AI assistant you connect through MCP), or as required by law, and is not used for advertising. We do not allow humans to read your Google user data unless we first obtain your affirmative agreement to view specific messages, files, or other data; it is necessary for security purposes (such as investigating abuse); it is required to comply with applicable law; or the data has been aggregated and anonymized for internal operations.
Subprocessors
We rely on: Google Cloud / Firebase (hosting, auth, storage), Anthropic and Google (AI processing), and Stripe (billing). Each processes data only to provide their part of the service.
Analytics & cookies
We use Google Analytics to understand how the site and app are navigated so we can improve them. It runs only after you accept in the cookie banner — decline and no analytics cookies are set and nothing is sent. When enabled, Google Analytics sets cookies and receives page-view events; we send only the first segment of each page's path (for example "contacts", never a specific contact) and never message content, names, or email addresses. To change your choice, clear this site's cookies and the banner returns. This is separate from the product itself, which never sends your Google user data to analytics or advertising providers (see Google API Limited Use above).
Data protection & security
We protect your data — including sensitive Gmail, Calendar, Google Meet, and Contacts content — with layered safeguards. In transit, all data is encrypted with TLS (HTTPS). At rest, data is stored in Google Cloud (Firestore), which encrypts all stored content; in addition, your OAuth refresh tokens and any mailbox credentials are individually encrypted with a dedicated Google Cloud KMS key before they are written. Access is isolated per user and enforced by server-side security rules, so one account can never read another's data. We apply least privilege: the app requests only the minimum Google scope each feature needs, and no Ember employee can read your Google user data unless you have given affirmative consent to view specific items, it is required for security or to comply with law, or the data has been aggregated and anonymized for internal operations. Secrets and encryption keys are held in Google Cloud Secret Manager and KMS, never in source code.
Retention & deletion
You can export or permanently delete your account at any time from Settings → Billing. Deleting your account revokes our Google access, cancels any subscription, and purges your data.
Your rights
You may access, export, correct, or delete your data, and revoke Google access from your Google account permissions at any time.
Contact
Questions? hello@emberapp.org.