Privacy

Last updated 2026-08-26

The short version

Ember exists to keep your letters, so it keeps your letters. It does not sell anything about you, does not run advertising, and does not use your correspondence to train anything.

It is not end-to-end encrypted. Your audio is uploaded to our servers to be transcribed, and the cleanup step sends the transcript to an AI provider. We could read what you write. We don't, and nothing here is set up to, but a promise is not encryption and we would rather say so than imply otherwise.

What is stored

• Your account — your name and your email address. Sign-in is a link to that address; there is no password and no third-party login, so there is no other identifier to hold.
• Your letters — text, typeface, paper, and delivery history, kept indefinitely because that is the product.
• Your contacts — the names, addresses, and email addresses you enter for the people you write to.
• Recordings — deleted after 30 days unless you keep one with a letter.
• Payment records — amounts, dates, and the last four digits of a card. Card numbers are held by Stripe and never reach us.

Who else sees it

Only the processors that make a letter happen, and only the part each one needs:

• Transcription — the audio, to turn it into text.
• Cleanup — the transcript, to tidy it. Turn this off per letter and the text never leaves our servers.
• Email delivery — the letter and the recipient's address.
• Print and post — the letter, the recipient's address, and your return address, which is printed on the envelope.
• Payments — the amount and your card, handled entirely by Stripe.
• Hosting and storage — everything, encrypted at rest.

Nobody else. We do not sell data, we do not share it for advertising, and we hand it to law enforcement only where we are legally required to.

People you write to

Writing to someone means we hold the address you gave us for them. If they receive a letter by email they can stop that correspondence with one tap and we will, whatever you do next. An account holder can block a sender, and the block is checked again at the moment of sending — not only when a letter is composed.

A letter you post arrives with your return address on the envelope. That is a requirement, not an option — it is how an undeliverable letter comes back to you instead of being destroyed, and it means nobody receives anonymous paper mail through us.

What you can do

• Take it all with you. Settings has an export of everything you have written and received.
• Delete your account. It is hidden immediately. After 30 days your details, your contacts and their addresses, and your saved card are erased. Letters already delivered to someone else stay in their thread, under a name that no longer identifies you — they are their letters too.
• Turn off read receipts, cadence nudges, and notifications, all separately.
• Skip the AI cleanup for any letter, so that text is never sent to a model.

Where it lives

Servers in the United States. Processors may handle data elsewhere. Everything is encrypted in transit and at rest.

Children

Ember is not for under-13s, and we do not knowingly hold their data.

Changes

If this changes in a way that matters, you will be told in the app before it takes effect — not by a quietly updated date at the top of a page.

Asking

Write to contact@covecorp.xyz.