Your data & privacy
Emberel is a place to keep your thinking, so the data belongs to you — visible, portable, and deletable on your terms.
Export anytime
From Settings → Your data, request an export of the active Emberel records the current export service includes:
- CSV — opens in any spreadsheet, one row per Spark with its tags and dates.
- JSON — structured active item/tag data plus the account's SMS consent-event and retained retry-receipt metadata.
This is not described as a byte-for-byte copy of every internal, provider, attachment, or security record. Generated export payloads become eligible for scheduled cleanup after seven days.
See exactly what it remembers
The facts the assistant uses — people, projects, places, preferences, shorthand — are all listed in Settings → AI & memory. Edit any entry or forget it outright. There's no hidden profile.
Grounded, optional AI
For classification, transcription, image analysis, and Ask, Emberel sends the content needed for that request to Cloudflare Workers AI. Memory-specific answers use the relevant Sparks, calendar, and visible memory supplied by Emberel; general planning or writing may also use model reasoning. You can switch AI capture and chat off and keep using built-in capture rules, reminders, and the lenses.
Cloudflare's current Workers AI data-usage policy says Customer Content is not used to train models made available on Workers AI or improve Cloudflare or third-party services without explicit consent. Emberel attributes that statement to the current provider policy rather than making a timeless promise about every possible AI provider.
How long things are kept
Emberel clears out what it no longer needs through bounded scheduled work:
| Record | Current cleanup boundary |
|---|---|
| Deleted Sparks | Recoverable for 30 days, then eligible for scheduled purge; this is not a guaranteed hard-deletion timestamp. |
| Delivery, AI-activity, and SMS retry-receipt metadata | Eligible for scheduled purge after 90 days. |
| Private inbound-email retry copies | Deleted after accepted capture; failed copies become eligible for the Email Worker’s daily cleanup after 30 days, subject to backlog/provider timing. |
| Expired sign-in security records | Eligible for scheduled cleanup after 30 days; sessions expire at their recorded deadline and are removed by cleanup. |
| Generated export payloads | Eligible for scheduled cleanup after 7 days. |
Security
Sign in with Google or with an email and password. Session tokens are 256-bit opaque values; only their SHA-256 hashes are stored. Cookies are HTTP-only, SameSite=Lax, secure on HTTPS, and expire after 30 days. Session-cookie state changes require same-origin proof. Exact signed-provider routes are the only webhook exceptions, and bearer API/MCP clients use separate authentication rules.
Inbound email and outbound sending use different credentials. Query-string email credentials are rejected. The split credentials are active in production. The legacy shared credential has been removed, with the compatibility flag off.
Delete everything
Settings → Danger zone → Delete account first cancels an active Stripe subscription if one exists; if cancellation cannot be confirmed, deletion aborts before removing data. It then removes user-scoped D1 records in foreign-key-safe order. Stored attachment blobs are deleted on a best-effort basis before their database rows are removed, so the implementation does not make a stronger atomic-blob-erasure claim. Deletion cannot be undone; export first if you want the supported account-data copy.