Privacy Policy — Ember Private Diary

Last updated: 2026-05-15

Ember is a private diary app for iPhone. We built it specifically so we don't have your data.

TL;DR

No accounts. You never sign up.
No servers. All entries live on your iPhone.
No analytics. We don't collect crash reports, usage stats, or anything else.
No ads.
No third-party SDKs.
Optional iCloud sync uses your own iCloud account, end-to-end encrypted with a key Apple cannot read.

What data Ember stores, and where

Data	Where it lives	Encrypted at rest
Diary entry text	Your iPhone (SwiftData)	✅ AES-GCM via Apple CryptoKit
Photos	Your iPhone (SwiftData external storage)	✅ AES-GCM
Mood, location name, tags, weather metadata	Your iPhone (inside encrypted entry blob)	✅ AES-GCM
Entry timestamps	Your iPhone, in clear	Not encrypted — used for sort/filter only
Master encryption key (256-bit AES)	iOS Keychain	Hardware-backed (Secure Enclave wrapping)

The master key is marked synchronizable so it travels through iCloud Keychain to your other Apple devices — Apple cannot see it.

Optional iCloud Sync

If you turn on iCloud Sync: entries are written to your iCloud Private Database (CloudKit). Apple stores the encrypted bytes but cannot decrypt them — the key is only in your Keychain. Same architecture as iMessage, Health, and Notes E2EE.

Optional Weather

Tapping the weather icon sends one HTTPS request to OpenWeatherMap with your current coordinates. We don't store the request, we don't add identifiers. If you never use the weather feature, Ember runs fully offline.

Permissions

Face ID — to unlock the app, on-device only.
Photo Library (user-picked) — only photos you select.
Location (when in use) — only when you tap the location chip.