Shadow Work Journal · Ember

Privacy Policy

Effective August 18, 2026 · Previous version: April 13, 2026

The short version

Ember does not collect, store, transmit, or share any of your personal information or journal entries. Everything you write stays on your device. There is no server to hack, no account to breach, and no cloud for us to lose. Purchases are handled entirely by Apple — we never see your name, your payment details, or your Apple Account.

What this policy covers

This policy explains how Shadow Work Journal: Ember (the "app," "Ember," "we," or "our") handles your information when you install and use the app on your iPhone. We wrote this in plain language because we think a privacy policy should be something you can actually read.

If anything here is unclear, please write to us at [email protected] and we'll do our best to explain.

Information we collect

We don't.

Ember is designed as an on-device application. It does not have user accounts, does not require an email address, does not ask for a sign-in, and does not connect to any backend server operated by us. The single exception to its offline behaviour is Apple’s in-app purchase system, described under Purchases below — that connection is between your device and Apple, and it carries no journal content of any kind.

Specifically:

Your journal entries — everything you type into the app — are stored locally on your iPhone in the app's private storage sandbox. They never leave your device.
Your app settings (reminder time, notification preferences, theme) are stored locally on your iPhone.
Your history of kept entries and your record of released (burned) entries are stored locally on your iPhone.
The 370 shadow work prompts are bundled inside the app itself and are read from the app's local resources. No network request is made to fetch them.

Information we do not collect

To make this concrete, here is a non-exhaustive list of things Ember specifically does not do:

Ember does not…

Create or require user accounts
Ask for your email address, phone number, name, or any identifier
Use analytics software (no Firebase, no Mixpanel, no Amplitude, no Apple App Analytics opt-in prompts from us)
Use crash reporting services (no Sentry, no Crashlytics, no Bugsnag)
Show advertisements or use any advertising SDK
Track your location
Access your contacts, photos, microphone, or camera
Use any third-party software development kit (SDK) that transmits data off-device
Send your writing to any AI service, language model, or external API — ever
Sync your data to iCloud, Google Drive, Dropbox, or any other cloud provider
Send your journal entries, prompts, history, or settings over the network — ever, for any reason
Operate a server, endpoint, or API of its own that your device talks to
Receive your name, email, or payment details from Apple when you buy something

If you use a network monitoring tool (such as Little Snitch, Proxyman, or Charles Proxy) to observe the app’s behavior, the only outbound traffic you will see is to Apple’s own App Store and StoreKit endpoints, and only when the unlock screen is shown, a purchase is made, or a purchase is restored. Write an entry, read your history, or burn something with the network monitor running and you will see nothing leave the device.

How your data is stored

Journal entries and app state are persisted on your device using Apple's standard on-device storage mechanisms (SwiftData, which is built on top of Core Data and the iOS file system). This storage is:

Sandboxed to the Ember app — no other app on your device can read it
Protected by the iOS file protection that applies to your device as a whole (your device passcode, Face ID, or Touch ID)
Included in iCloud Backups and encrypted backups to your Mac only if you have those backups enabled in your iOS Settings. This is a system-level feature of iOS that applies to all your apps, not a feature of Ember

If you restore your iPhone from an iCloud or Mac backup, your Ember entries will be restored along with it — because they're part of the device backup, not because Ember uploaded anything to us.

The "burn" feature and permanent deletion

When you choose to burn an entry in Ember, the entry's text is permanently and irreversibly deleted from your device. There is no undo, no trash folder, no archive, and no recovery mechanism. This is a deliberate product decision, not a side effect.

Ember does keep a small metadata record of the event — the date a burn occurred, but not the content — so that your history screen can show how many entries you've released over time. If you want even this record removed, deleting the app removes everything associated with it.

Notifications

If you enable the optional daily reminder, Ember uses Apple's local notification system (UNUserNotificationCenter) to schedule a notification at your chosen time. These notifications are scheduled entirely on your device. No notification service run by us or by Apple's push notification network is used. No data about whether you opened the notification is sent anywhere.

Children's privacy

Ember is rated 9+ on the App Store and is not directed at children under 13. We do not knowingly collect information from anyone, including children — because, as described above, we do not collect information from anyone at all. If you are a parent or guardian and have questions, please write to [email protected].

Your rights

Because we do not have any of your data, there is nothing for us to show you, correct, export, or delete on your behalf. Your data lives on your device and is under your control:

To view your data: open the app
To delete an entry: use the burn feature, or delete it from the history screen
To delete everything: delete the Ember app from your iPhone. All associated data is removed from your device

Your purchase history is the one record that does not live on your device alone — Apple keeps it, because Apple processed the payment. You can review it in the App Store app under your account, and requests about that data go to Apple.

Changes to this policy

If Ember ever adds a feature that changes how data is handled — for example, optional iCloud sync between your own devices — this policy will be updated before that feature ships, and the change will be called out in the app's release notes. Because Ember does not collect contact information, we cannot email you about changes; checking this page is the way to see the current version.

Contact

Questions, concerns, or comments about privacy can be sent to [email protected]. A real human reads every message.