Version 2.0, effective October 9, 2026. Emberknot is on the App Store for iPhone and in closed testing on Android; this page describes what it does today and changes in the same commit as the code.

Who this is about

Emberknot is a private app for exactly two people. This policy covers the iPhone app, the Android app, the Apple Watch app and this website.

Emberknot is run by Dante Corso, trading as Emberknot, a sole proprietor, who decides how your information is used and is responsible for it (the “controller”, in privacy-law terms). Reach us at dantecorso@icloud.com.

Location

Emberknot requests no location permission on either platform, runs no geofences, and does no background location work. The app never asks your phone where it is, so there is nothing to grant and nothing to revoke.

Coordinates exist in one place, and only because you put them there: a pin on the Atlas. That is a place you chose, not a position we read, and it is described in full under About the Atlas below.

A check-in is a word you press — “home”, “landed”, “on my way” — optionally with the name of one of your saved places. You choose it, you send it, and what is stored is that word and that name. Where you actually were when you pressed it is not something Emberknot can know, and the server rejects a check-in that tries to carry a coordinate.

What is stored

Your account: your display name, the identifier and (if you allow it) the email address your Apple or Google sign-in provides, and the pairing you are part of.
A record that you accepted the terms — which version and when — and that you confirmed you are 18 or over.
Taps: the kind, the time, and anything you attached — an emoji, a short line of text, or a drawing.
Moments: notes, photos, moods and check-ins you chose to add, and reactions and replies to them.
Voice notes: the recording itself, how long it is, and a row of numbers describing its loudness over time — which is what draws the little waveform without downloading the audio.
Open-when letters: what you wrote, how it is sealed, and when it opens — a date, or the label of the place it opens at (such as “Home”), which unlocks when the reader checks in there.
Saved places — the names you give places like home or work — and the arrivals (check-ins) you send at them.
Today's question: your daily answers, and Questions you ask each other with your answers.
Countdowns: the dates, trips and anniversaries you entered.
Games: the board or cups, whose turn it is, and who won.
Date Night: the wheels you made, the ideas on them, and what a spin landed on.
The Atlas: the pins and journeys you added, their labels, the dates you typed, why each one mattered, any photos you attached to a journey, and the coordinate of each pin — see About the Atlas below.
Your block list: the accounts you have blocked.
Reports you file, including a snapshot of what was reported and, for a reported photo or voice note, a copy of the file kept in a server-only evidence store.
Settings: your theme, your notification and Live Activity triggers, your quiet hours.
Device push tokens, so a tap can reach the other phone, and on iPhone the tokens Apple issues to start and update Live Activities. Each device record also stores the app version, which games that version of the app supports and when the device was last used, so a new game is only offered when both of your phones can play it.
Emberknot+ purchase records — see Emberknot+ and payments below.

Drawings are stored as coordinates in a unit square rather than as images. Photos and voice notes are stored as files you uploaded, readable only by the two accounts in your pair while you are paired.

On your device only: widgets, complications and Live Activities read a small cache the app keeps on your phone or watch — your person's name, their latest tap or mood, and (for the photo widget) their newest photo — so they can show something without a network request. It is not sent anywhere, and it is removed when you delete the app.

About the Atlas

The Atlas is the one part of Emberknot that stores a latitude and a longitude, and it is worth being exact about why that is not tracking.

Emberknot never reads your location. It asks for no location permission on either platform — not “while using”, not “approximate”, none. There is no geofence and no background location.

A pin on the Atlas is a place you chose. You type a search, pick a result (or place the pin yourself), and what is stored is that choice: a coordinate rounded to three decimal places — about 100 metres — and a label at the level of a city or neighbourhood. That can be precise enough to identify a specific street, so place pins only where you are comfortable your person seeing them. There is no accuracy, no altitude, no heading, and no record of when you were actually there beyond the dates you entered yourself.

Place search. When you search for a place, the text you typed is sent to Emberknot's server, which looks it up with OpenStreetMap Nominatim (run by the OpenStreetMap Foundation) and Komoot Photon. To rank results, the search may include the middle of the pins already on your Atlas. Neither service receives your IP address, your account id or anything else that identifies you — they see one server asking about a place name.

About the microphone

Emberknot records only while you are holding the record screen with a recording in progress. There is no background listening, no wake word, and no ambient capture — the microphone permission is asked for the first time you tap record, and never at launch.

Voice notes are never transcribed. There is no speech-to-text, no keywords, no search index, and no field in our database that could hold any of those. That is not a policy we could change quietly: the server refuses a request that carries a transcript at all, and the test that enforces it names the field so that removing the guard breaks the build.

What is never stored

Any location read from your phone — there is no permission, no geofence and no background location. The only coordinates we hold are the Atlas pins you chose yourself; see About the Atlas above.
Your contacts, your calendar, or your photo library.
Any audio you did not deliberately record and send. See About the microphone above.
A transcript of anything you said.
Advertising identifiers (IDFA, GAID) — Emberknot does not carry an ad SDK.
Third-party analytics or attribution SDKs.
Anything sold, rented, or shared with a data broker. There is no such arrangement and there will not be one.

The waiting list

Emberknot is on the App Store for iPhone, but not yet on Google Play, and this website offers a waiting list for Android. It is the only part of the site that asks you for anything, and you have to type into it — there is no tracking on any page.

If you join it, we store:

Your email address. Required — it is the whole point, and the only way we can tell you the app is ready for your phone.
A first name, if you give one. Optional, and only so the email can open with it.
Which phone the list is for. The form now only signs people up for Android, so new entries are recorded as Android; entries from before the iPhone launch keep whatever was chosen then, if anything.
The date, and the sentence you agreed to when you pressed the button — so what you consented to is a matter of record rather than of memory.

To stop the form being abused, the server keeps a one-way hash of your IP address for up to two days to rate-limit sign-ups, and then deletes it. It is not stored with your entry. We do not store your browser or anything else that would identify the device you typed on. Your address is not sold, rented, shared or used to build a profile, and it is not connected to an Emberknot account — joining the waiting list does not create one.

You will get one email, when there is something to install on your phone. If that never happens, you never hear from us. To come off the list at any time, email dantecorso@icloud.com and the entry is deleted — no account and no confirmation link required. It is based on your consent, which pressing the button gives and that email withdraws.

Each entry is kept until Emberknot is out for the phone it is waiting for, and for no more than 90 days afterwards, then deleted. If Android is abandoned before it launches, the list is deleted then instead.

Who processes it

Emberknot runs on Google Firebase. Naming that matters more than the rest of this page: a policy that says your data is kept safe without saying who is holding it has not told you anything.

Cloud Firestore — your pairing, taps, notes, moods, check-ins, letters, countdowns, games, wheels, Atlas pins and the rest of the list above.
Cloud Storage — photos, voice-note audio and data exports.
Firebase Authentication — your sign-in. With Sign in with Apple or Sign in with Google, that provider confirms who you are and returns an identifier and, if you allow it, a name and an email address. We never see the password for those accounts.
Cloud Functions — almost every write goes through one, which is what lets the server refuse things the app should not be able to do.
Firebase Cloud Messaging, and on iPhone Apple Push Notification service — getting a tap to the other phone. A push carries the minimum needed to show it. Note previews (the words of a note in the notification) are on when you start and can be turned off in Settings; Lock Screen widget previews stay off unless you turn them on.
App Check — proves a request came from the real app rather than a script, using Play Integrity on Android and App Attest on iPhone.
Firebase Hosting — serves this website. Like any web server it receives your IP address and browser details in order to send you the page, and Google keeps standard request logs for a limited time. The site has no account system, sets no cookies and runs no analytics.

Google acts as our processor: it holds the data on our instructions and not for its own purposes. OpenStreetMap Nominatim and Komoot Photon receive only the place-search text described under About the Atlas, as service providers answering a lookup for us.

Two more, on the Apple and Google side: Sign in with Apple or Sign in with Google confirm who you are, and the App Store or Google Play handle the payment if you subscribe. Apple and Google are independent of us for what they collect in those flows, and their own privacy policies govern that. See Emberknot+ and payments below for exactly what reaches us from a purchase.

Emberknot+ and payments

If you subscribe to Emberknot+, the store you installed from takes the payment — Google Play on Android, Apple on iPhone and Apple Watch. Emberknot never sees your card, your billing address, or anything else you type into their payment sheet.

What we do hold is the minimum needed to know that the subscription is real and still running:

A reference to the purchase — a purchase token from Google, or a transaction id from Apple. Both are opaque identifiers rather than payment details. Our server sends it back to whichever store issued it and asks whether the subscription is active; that answer — active or not, and the date the paid period ends — is what unlocks the paid features.
Which of you bought it, and the purchase history the stores report — renewals, cancellations, refunds and chargebacks.

Paid access belongs to your shared space. If you disconnect, the partner who did not buy it loses Emberknot+ immediately, and the buyer's subscription keeps renewing until they cancel it in the store. A refund or chargeback removes Emberknot+ for both of you. To cancel on Android, use Play Store → Payments and subscriptions; on iPhone, use Settings → your name → Subscriptions.

Deleting your Emberknot account does not cancel a subscription, because we cannot cancel it on your behalf — the store holds it, not us. Cancel it there first, or it will keep renewing after your account is gone.

Where it is stored

In Google Cloud data centres in the United States.

How long it is kept

Your thread — as long as your account and your pairing exist. Emberknot does not expire your history; the point of it is that it is still there in ten years.
Anything you delete — gone from the app immediately and from storage shortly after.
After a disconnect — the shared thread is kept, but neither of you can open it any more, and your former partner can no longer open your photos or voice notes. Each of you can still remove your own content by deleting your account. We have not yet set a fixed period after which disconnected threads are deleted; if we do, this page will say so.
Your account — deleted when you ask. See Disconnecting and deleting below.
Data exports — sent to you by email within 30 days, and deleted from our servers 35 days after they are made.
Purchase records — kept after account deletion for as long as tax and accounting law requires.
Backups — roll off on their own schedule within 30 days, and are not readable as a restore of one person's data.
Reports — filing one keeps a snapshot of what you reported, and a copy of any reported photo or voice note, so it still exists if the other person deletes it, for as long as we may need to act on it or the law requires us to keep it.
Waiting-list IP hashes — deleted within two days.

Why we hold it

To provide the service you asked for — you cannot run a private thread for two people without storing the thread; to keep the service secure and act on abuse reports; to meet legal obligations such as tax records and lawful requests; and, for the optional permissions the app asks for — notifications, the camera and the microphone — because you allowed it, which you can withdraw in your phone's settings at any time.

Your rights

Wherever you live you can ask for a copy of your data, ask us to correct it, or ask us to delete it. The app does the first and the third itself, in Settings, without anyone needing to be asked. Depending on where you live, you may also have the right to object to or restrict some processing, and to complain to your data protection regulator.

Your data export includes your profile and settings, your taps, notes, moods, check-ins and letters, your countdowns, saved places, Atlas pins and journeys, the games you started and the Date Night wheels you made, the photo and voice-note files you uploaded yourself, and a summary of your Emberknot+ purchases. We send it to you by email within 30 days, and delete our copy 35 days after it is made.

For anything the app does not do for you, write to dantecorso@icloud.com. We answer within 30 days.

California privacy rights

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights. In the last 12 months we have collected these categories of personal information, all for the purposes described on this page:

Identifiers — your name, email address, account id, device push tokens, and (on the website) IP address.
Commercial information — Emberknot+ purchase and subscription records.
Audio and visual information — photos and voice notes you send.
Geolocation you enter yourself — Atlas pins to about 100 metres and place labels you choose. We never collect your device's location.
The content of your messages — taps, notes, letters, answers and everything else you send your person.
Internet activity — web server logs kept by our host, and the waiting-list IP hash described above.

Sources: you; your partner (what they send you); Apple or Google when you sign in; and the App Store or Google Play when you subscribe.

We do not sell or share personal information — not for money, not for cross-context behavioural advertising — and never have. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Sensitive personal information. The contents of your messages and your account sign-in are sensitive personal information under California law. We use them only to provide the service to you and your person — never to infer anything about you — so there is nothing to limit.

Your rights: to know what we collect and how we use it; to get a copy of it; to delete it; to correct it; and to opt out of sale or sharing, and to limit the use of sensitive personal information (neither of which we do). We will not treat you differently for using any of them. To use them, delete your account or export your data in the app, or email dantecorso@icloud.com from the address on your account. We verify a request by confirming it from that address, and you can use an authorised agent if they have your signed permission. We respond within 45 days.

Security

Everything is encrypted in transit and at rest. Almost every write goes through a server function that checks who you are and which pair you are in, so there is no path for a client to write into someone else's thread. The one exception is your device record (its push tokens, app version, supported games and when it was last used), which the app writes directly to your own account record, under database rules that only let you write your own. The rules refuse any read outside your pair as firmly as the write.

Emberknot is not end-to-end encrypted, and saying so plainly beats implying otherwise. Your content is encrypted with keys the provider holds, which means it could in principle be produced under a valid legal order. If that ever changes, this paragraph changes and the change is announced in the app.

Who can see it

Inside the app, your partner and nobody else. Pairing is one-to-one: an account can be connected to exactly one other account at a time. Server rules enforce that on every read and every write, so an authenticated stranger cannot request your thread — not because the app does not show it to them, but because the request is refused.

Outside the app, the providers listed under “Who processes it” handle it to run the service. We look at content only when you or your partner report something, when you ask us for help with your account, or when the law requires it. Emberknot is not end-to-end encrypted, so those limits are rules we keep, not something the technology makes impossible.

Disconnecting and deleting

Disconnect ends the pairing immediately and on both sides. Each of you keeps your own account; neither of you can read the shared thread afterwards, and your former partner can no longer open your photos or voice notes.

Delete your account removes your profile, settings, sign-in and push tokens, and your own content in every pair you were ever in: your taps, notes, letters, answers, photos and voice notes. Your moods and the place names on your check-ins are blanked. Your Atlas journeys, the games you started, the Date Night wheels you made (and your ideas on your partner's wheels, where enough remain for the wheel to work), your invites and data exports are deleted. Purchase records are kept for tax and legal reasons, and reports — including copies of reported content — are kept as described above. There is no thirty-day grace period holding a shadow copy. The full list is on the account deletion page.

Blocking and reporting

Report and block are reachable from the pairing screen without navigating a menu tree. Blocking is unilateral, takes effect at once, and does not tell the other person which of the two of you did it. Every report is reviewed by a person within 24 hours. See Safety.

Children

Emberknot is for adults: you must be 18 or over to use it, it is rated 18+, and it is not directed to children. You confirm you are 18 or over when you create an account. We do not knowingly collect anything from anyone younger, and if we learn that we have, the account and its content are deleted. If you believe a child has an account, write to dantecorso@icloud.com.

Changes

If this ever changes in a way that widens what is collected, the change is announced in the app before it takes effect — not published quietly to a URL nobody re-reads — and the version and date at the top of this page change with it.

Contact

Privacy questions, data requests, abuse, safety, or anything involving another person's conduct: Dante Corso, trading as Emberknot, dantecorso@icloud.com. Report and block are in the app as well, and neither tells the other person you used them.

See how check-ins work

What wedo not collect.