EMBR Story Studio™: Privacy Policy

1. Who we are

EMBR Story Studio ("EMBR") is operated by Oak & Ember Creative LLC, a Texas limited liability company ("we", "us"). We are responsible for the personal information described here. Questions and requests: support@embrstorystudio.com · 5900 Balcones Drive, Suite 100, Austin, TX 78731 (registered agent).

EMBR is a private, subscription service for families to record their history together. It is not a social network: what you add is visible only to the members of the families you share it with. (There are two exceptions: the Demo Family, a family we own and show as an example, and a listening link that a family member chooses to share, §4.)

What we do not do. We do not sell personal information. We do not show ads or share information with advertisers. We do not use advertising cookies. We use Google Analytics only if you allow it (§2.3). We do not use facial recognition. EMBR does not identify people in photos (§2.1). We never use your stories, photos or recordings to train AI models, ours or anyone else's. If we add AI features in the future, they may process a family's content only to provide that feature to that family; we will update this policy and name any AI provider (§5) before such a feature launches, and that provider must be contractually barred from training on EMBR data.

2. What we collect

2.1 Information you give us

• Account: your name, email address, and password (the password is handled by Google's Firebase Authentication; we never see it in plain text). If you sign in with Google, we receive your name, email address, and Google account identifier from Google. We also record whether your email address is confirmed (§8), and which version of the Terms and this policy you accepted and when (by our server's clock).
• Account photo: if you add one. It is cropped and re-saved in your browser before upload, so hidden details in the original file (such as where it was taken) never leave your device. It is stored outside every family and any signed-in EMBR user can view it (for example next to your name).
• Family membership: which families you belong to, your role in each (Owner, Contributor, Viewer), and which person record in each family is "you".
• Your content: stories, memories, life events, perspectives, reflections, comments and reactions, drafts, books, and records about people, homes, pets, vehicles, places, heirlooms and recipes. Notes on a person's record are part of the family's content, visible to the family.
• Photos and files: the photos and PDF files you upload. We keep the original file, alongside smaller copies we make for display. For a PDF, our server makes a picture of its first page for display, and pictures of the pages you choose to show or print in a book. The PDF is kept exactly as you uploaded it, including any details saved inside it (such as an author name or the program that made it). An original photo can contain embedded camera data ("EXIF"), which may include the date and time it was taken, the camera model, and, if your phone or camera recorded it, the GPS location where it was taken. EMBR reads the date (to place the photo on the timeline) and the orientation. Location: shortly after a photo is uploaded, our server reads its GPS location if it has one, saves it on the photo's record inside your family (visible only to your family members, like the rest of your family's content), and rewrites the stored original without the location; the picture, the date and the camera details stay as they were. The smaller display copies never contain it. Nothing in EMBR uses the saved location yet; it is kept so EMBR can later suggest where a photo was taken. Any member of the family can open the original file.
• Photo focus point: EMBR picks the spot a photo is centered on when it is cropped for a card, a cover or a profile picture. When a photo is added, our own server looks for a face in it, in the same step that makes the smaller copies, and no outside service sees the photo for this. For each photo we keep: the focus point, two numbers that say where to center the crop; the automatic suggestion, two more numbers kept beside it so a spot set by hand can be reset to it; whether the automatic step found a face (yes or no, nothing more); and, for a spot set by hand, who set it and when. We do not keep a face outline, a count of faces, measurements of a face, a template, or anything about who is in the photo, and EMBR does not recognize or name anyone. The spot can be changed by hand by anyone who can edit the photo, and a spot set by hand is never replaced by the automatic one. We can turn the automatic step off for everyone at once, and then EMBR centers each photo on a standard spot until someone sets one.
• Audio: voice narrations you record for stories: the recording, how long it is, who recorded it and when, and a small set of loudness values used to draw the player (it holds no words). We do not transcribe recordings.
• Listening links: when a family member shares a narration by link or turns on narration QR codes in a book, we keep a random link code tied to that story, whether the link is on or off, and who made it and when (§4). If the person who recorded a story deletes their account and chooses to keep their shared links playing, we also note that choice on the link. When you ask to delete your account, your answer to that question is kept with your request.
• Invitations: when you invite someone, the email address you enter and the role you chose. We send that person an email on your behalf.
• Billing (Owners only): your plan, billing interval, and add-ons. Payment card details and your billing address go directly to Stripe; we store only a Stripe customer identifier and the state of your subscription. We use the country of your billing address to keep paid plans to the U.S.
• Support: what you send us when you email support.
• Waitlist: if you join the waitlist on our home page: your first name, your email address, the consent line you agreed to, and when you joined, confirmed, were invited or unsubscribed. After you confirm your email, your first name and email address are also added to our email list at Kit (§5).
• Feedback: when you use Share feedback in the app: the words you type, the choice you pick (something is broken, an idea, something else), the page you were on (its address without anything after a question mark), your browser and the app version, your email address and name, the family you had open (as an internal id, only if you are a member of it), and a screenshot if you attach one. Nothing else from your family's content is sent.
• Preferences: theme, notification choices, and display settings.

2.2 Information about other people, including children

Family stories are about other people: relatives living and dead, and often children. Members enter names, dates of birth and death, relationships, places lived, photos, and stories about them. Those people may not have EMBR accounts. We process this information only to provide the Service to the family that entered it, and it is visible only to that family's members.

• Children. EMBR accounts are for adults 18 and older. We do not knowingly collect personal information directly from children. Children may appear only in content adults enter. A parent or guardian can ask us to remove information about their child (§9).
• People who are not users. If you are not an EMBR user and believe a family has entered information about you, contact us (§9). Because we cannot see which family is which without the content, tell us what you can so we can locate it.

2.3 Information collected automatically

• Family activity log: each family keeps a record of what happens in it, with who did it and when: an item added, changed, deleted, restored or removed for good (with its title at the time), comments, sign-ins (at most one line per person per family every 12 hours), members joining, leaving or changing role, and plan events such as a scheduled deletion or a transfer. Drafts are never logged. Who can see it is in §4.
• Last activity: the time someone in the family last signed in, which we use to keep a free Keepsake family active (§7).
• Sign-in session: a cookie named "__session" that keeps you signed in, and a cookie that remembers whether the side menu is open. These are strictly necessary. We use no advertising cookies.
• Usage statistics, only if you allow them: if you choose Allow analytics in the cookie notice, we use Google Analytics 4 (Google LLC) to count page visits and a few steps such as creating an account, publishing a family's first story or making a book PDF. It sets its own cookies (named "_ga"). Page addresses are sent with ids and anything after the "?" removed, and it never receives your stories, photos, names or email address. Google signals, advertising features and user ids are turned off. If you choose No thanks, Google Analytics is never loaded. You can change your choice at any time with Cookie settings in Settings > Account or at the foot of the home page.
• When someone opens a listening link: the listen page has no account and sets no cookies, and it does not use analytics. We see the visitor's IP address and device type when the page loads, and we use the IP address only to limit how fast one device can ask for recordings. For that limit we keep only a scrambled (hashed) form of the IP address and a count, deleted automatically no more than 7 days after the device's last request. Our hosting's general server logs, described just below, also see the request.
• Data stored in your browser: your theme, the family you last had open, your timeline view settings, an unsaved-changes buffer that protects a story you are writing if the page closes, and an offline copy of your family's data so EMBR works without a connection. The offline copy is cleared when you sign out, with a warning first if there are changes that have not synced. On a shared computer, always sign out.
• Waitlist sign-ups: when someone joins the waitlist we keep a scrambled (hashed) form of their IP address for about an hour, only to limit how often one device can sign up.
• Bot protection: EMBR's pages use Google reCAPTCHA Enterprise (through Firebase App Check) to tell real browsers from automated abuse. Google receives technical information about your browser and device for this; it sets no advertising cookies for us.
• Server logs: our hosting and Google Cloud record technical information such as IP address, browser type, times, and errors, for security and troubleshooting. Our own server log lines are written to hold ids and counts, not your content or email address.
• Error reports: we use Sentry to receive reports when something breaks in the app. A report can include the page address, browser and device type, IP address, and the technical error. We have set Sentry to send no content text, no email address, and no session replays.
• Email delivery: our email provider records whether an email was delivered. Open and click tracking are turned off.

3. How we use it

• To run EMBR: create your account, show your family's content to its members, process photos and audio (including removing photo locations from stored files and choosing the focus point for cropping), make book PDFs, play a narration for anyone a family member shared its listening link with, and keep things in sync across devices.
• To send service emails: email confirmation, invitations, account and security messages, billing receipts, data-download notices, and warnings before data is deleted (trial end, lapsed plan, Keepsake inactivity, a family or account deletion, a transfer offer).
• To bill Owners and enforce plan limits (storage, members, families, book PDFs).
• To keep a family activity log, so Owners can see what happens in their family and we can answer support questions such as "where did my photo go".
• To keep EMBR secure, prevent abuse, fix errors, and back up data.
• To answer your support requests, including removal requests.
• To read the feedback you send, fix the problems it reports and improve EMBR.
• To meet legal obligations and enforce our Terms.

Marketing email: we send EMBR news only to people who joined the waitlist and confirmed their email. Every message has an unsubscribe link, and unsubscribing stops the emails at Kit too. We do not send marketing email to account holders today; if we start, it will be opt-in or come with an unsubscribe link in every message.

4. Who can see your information

• Members of your families. Everything you add to a family is visible to its current members, except your drafts, which only you can see (not even the Owner). Photos added to a draft join the family's Media Library at upload and are visible to members from then.
• The family's Owner: the activity log. The Owner can see every line of their family's activity log, so the Owner can see what each member added, changed, deleted or restored, and when each member signed in. Every member can see their own lines, in every family they belong to (including families they have since left).
• The family's Owner: downloads. An Owner's data download includes everything anyone added to the families they own, marked with who added it, but never other members' drafts (§8).
• After you are removed from a family, you lose access immediately; your drafts there are sealed (nobody can read them).
• A new Owner after a transfer. If an Owner transfers a family to another member (Terms §4.1), the new Owner gets the Owner's controls for that family, including its member list, activity log and download, and its billing moves to them. Drafts stay private to their authors.
• Anyone with a listening link a family member shared. The link plays one narration, with no account, and shows only the story's title, the teller's first name or the name the family calls them (never a last name; "a family member" when neither is known) and the recording: no photos, no story text, no family name and nothing else from the family. Anyone with the link can listen and can save the recording. A narration QR code printed in a book opens the same kind of link, so anyone who holds the book can scan it. A copy someone saved, and a book already printed, cannot be taken back. The story's author or the family's Owner can make its link. A story keeps one listening link and one QR code for as long as it has them. The family's Owner can turn a link off, turn it back on, or replace it with a new one; when a link is replaced, the old link and any printed code show that it was turned off. A link turns off when its story is deleted (a story in Deleted reads as turned off) and when its family is deleted, and it stops playing while its family is read-only (§7). When a narration is removed, the link stops playing until someone in the family records that story again; then the same link and QR code play the new recording, unless the Owner turned the link off. If the person who recorded a story deletes their account, they choose whether the shared links to their recordings keep playing. If they keep them, the links go on playing their recordings and showing their first name or the name the family calls them, as before. If they turn them off, the links stop playing; if someone in the family later records that story again, the same link and QR code play the new recording. A link also stops playing while the person who recorded its narration is no longer a member of the family (unless they kept their links when deleting their account); it plays again if they rejoin or someone in the family records the story again. The family keeps every recording either way.
• Everyone signed in: your account photo (§2.1).
• Everyone signed in: the Demo Family. We show one family that we own as a read-only example to every signed-in user: its records, stories, comments and photos (and the photos' saved locations, if any). Its drafts, activity log, member list and invitations stay closed. Only EMBR staff can choose the Demo Family, and there is at most one.
• EMBR staff. A small number of approved staff can use an internal support panel to run EMBR and help with accounts. They can see account details (name, email, sign-in, plan, storage, and the families an account belongs to), how many items a family holds (counts only, never the stories, photos or other items themselves), activity logs, the titles of a person's content, and the subject lines of emails EMBR sent. They can send an account's sign-in or waitlist emails, lock or unlock sign-in, change a trial or plan, remove content, choose the Demo Family, and start or cancel an account deletion when the person asks. Every staff action, including every look-up, is recorded with the staff member's email and the time; that record is not visible to users.
• EMBR staff: your feedback. Feedback you send is emailed to our support inbox and is readable in the staff support panel described above; a screenshot opens there only through a link that works for 10 minutes. Members of your families never see it.
• Service providers that host and process data for us, listed in §5. They may use it only to provide their service to us.
• Legal and safety. If the law requires it (for example a valid subpoena or court order), to protect the rights, property or safety of users or the public, or to report child sexual abuse material to the National Center for Missing & Exploited Children.
• Business transfer. If Oak & Ember or EMBR is sold or merged, personal information may transfer to the new owner, who must honor this policy or give you notice and a choice.

We do not sell or rent personal information and do not share it for targeted advertising.

5. Subprocessors (service providers)

We will update this list before adding a provider that handles personal information.

6. Data inventory

7. How long we keep data, and deletion

• Deleted items go to Deleted (in Settings) and can be restored for 30 days, then are removed for good by a nightly job with their files, comments and narrations. Items EMBR staff removed are listed there but cannot be restored.
• Ended trial: the family is read-only for 60 days, every member gets warnings at about 30, 7 and 1 days, then the family and all its content are deleted.
• Lapsed paid plan: read-only for 12 months, every member gets warnings at about 30, 7 and 1 days, then the family and all its content are deleted.
• Keepsake (free) inactivity: a Keepsake family where no member has signed in for 2 years is deleted, after warnings to every member at about 30, 7 and 1 days. Any member's sign-in keeps it active.
• Nobody's family is deleted by the nightly job until a final warning has been out for at least 20 hours.
• Family deleted by its Owner: scheduled 30 days ahead; every member is emailed when it is scheduled and again 7 days and 1 day before; the family stays usable until then (nobody new can join); only the Owner can cancel; every member can download their own content in the meantime (§8).
• Removed from a family: your drafts there are sealed. They are included in your data download, deleted when you delete your account, and deleted 12 calendar months after your removal if you are not re-added.
• Account deletion: your account is deleted 30 days after you ask; signing in during that time lets you cancel. Then we cancel any subscription you own (no partial refund), and delete your sign-in, account record, account photo, billing account, your drafts in every family, including sealed ones, your data downloads, your activity log lines in every family, and the feedback you sent with its screenshots. Your memberships are kept only as "removed", marked as a deleted account. What you published stays: stories, memories, comments and photos you published into a family stay in that family, shown with your name as you added it. The same is true if you leave or are removed from a family. You can ask us to remove specific items (§8). If you recorded stories that have shared listening links, you choose when you ask whether those links keep playing your recordings (§4). For each family you own you choose, when you ask, to transfer it to a member or delete it for everyone; a declined transfer, or one not accepted with a paid plan within 30 days, becomes a scheduled deletion with warnings to every member (Terms §4.1, §5.1).
• Listening links: a story keeps one link and QR code. A link turns off when its story is deleted (a story in Deleted reads as turned off) and when its family is deleted. It stops playing while its family is read-only, after its narration is removed, when its narrator deletes their account and turns their links off, and while the person who recorded it is no longer a member of the family (unless they kept their links when deleting their account); when someone in the family records the story again, the same link plays the new recording, unless the Owner turned it off (§4).
• Backups: deleted data may remain in encrypted backups for up to 30 days until they roll over, and is not restored from them except to recover from a disaster.
• We may keep limited records longer where the law requires (for example billing and tax records at Stripe) or to resolve disputes.

8. Your choices and rights

Every user, on any plan, in any state, can:

• See and correct their information in the app.
• Confirm their email address. If you signed up with an email and password, we email you a link. Until you confirm, you cannot invite people, start or change a paid plan, offer or accept a family transfer, ask to delete your account, or download your data. Google sign-in accounts are already confirmed. Cancelling a scheduled account deletion never needs it.
• Download their data from account settings, once a day; we email you when it is ready and the link works for 7 days. It includes your account information, your memberships, all of your drafts in every family (including sealed drafts), every record, story, memory and comment you created in each family you belong to (including items in Deleted not yet removed), the photos you uploaded (with the saved location for each, if it had one) and the narrations on the stories you created, your own activity log lines, and the feedback you sent (with its screenshots). For a family you own, it includes everything anyone added, marked with who added it, and a list of the family's listening links (whether each is on or off, who made it and when, never the links themselves). It never includes other members' drafts or other members' activity lines, and it does not include family audit logs, invitations, emails we sent, or payment details.
• Delete their account from account settings (§7).
• Ask for specific items to be removed from a family after they leave it or delete their account, by emailing support@embrstorystudio.com with the items.
• Delete items (restorable for 30 days).
• Choose notification emails in settings. Service emails that protect your data (deletion warnings, security) cannot be turned off.
• Contact us at support@embrstorystudio.com for anything you cannot do in the app. We will verify the request comes from the account holder and answer within 45 days. You can appeal a decision by replying to our answer; if we still decline, you may contact your state Attorney General.

9. Children and people who are not users

• Accounts are for people 18 and older. If we learn an account belongs to someone younger, we will close it and delete its information.
• EMBR is not directed at children. Content about children is entered by adult family members.
• Removal requests. A parent or guardian, or any person (including non-users) who believes a family has entered information about them, may email support@embrstorystudio.com. We will work with the family's Owner and may remove the information where the law requires it or where it breaks our Terms.

10. Security

Data is encrypted in transit (HTTPS) and at rest by Google Cloud. Access to a family's data is enforced by database security rules tested in our build pipeline: only current members can read a family (the Demo Family is readable by every signed-in user), and only the author can read a draft. Server secrets are held in Google Secret Manager. Staff access goes only through the support panel described in §4, needs a confirmed email on an approved list, and every use of it is recorded. No system is perfectly secure; if a breach affects your information we will notify you and the authorities as the law requires.

11. Where data is processed

EMBR is operated from the United States and data is stored and processed in the United States.

12. United States only

EMBR is offered to people in the United States, and paid plans require a U.S. billing address (we check the billing country ourselves after checkout, and a subscription with a billing address outside the U.S. is cancelled and refunded). It is not directed to people in other countries.

13. Changes to this policy

We will post changes here and update the date above. For a material change we will give at least 30 days' notice by email and in the app before it takes effect.

14. Contact

Oak & Ember Creative LLC · support@embrstorystudio.com · 5900 Balcones Drive, Suite 100, Austin, TX 78731 (registered agent)