Privacy policy

Ember is operated by Cascade Headache, PLLC. This policy covers Ember and this website. Feature availability varies by app version and account; describing an optional or testing feature here does not enable it or make it available to everyone.

For Washington consumer health data, also read our Consumer Health Data Privacy Notice.

1. Diary and connected health information

Ember stores the information you enter on your device: headache and migraine symptoms, severity, impact, notes, medications, treatments, menstrual-cycle information, questionnaire responses, profile details and provider or pharmacy details. It uses those records to provide tracking, observations and reports.

If you connect Apple Health or Health Connect, Ember imports supported readings you authorize, such as sleep, activity and vital-sign readings, for on-device features. Imported raw Health readings are excluded from Ember backups. Saved personal experiments can contain results derived from those readings and can be included in an encrypted backup.

Back to contents

2. Optional encrypted backup

When you turn on automatic backup, Ember encrypts eligible records on your device and sends the encrypted copy to Google Cloud storage in the United States. The service also handles account-linked identifiers, backup versions, timestamps and security information needed to operate and protect the backup. This metadata is not anonymous.

The backup service does not receive the recovery key needed to read your encrypted records. Recovery material stays in secure storage on your device and, depending on your choice and platform support, may also be kept through iCloud Keychain, Google Block Store, or a recovery code you save yourself. Restoring through Ember requires account access and the applicable recovery material. If the recovery material is lost, we cannot reconstruct it from your account password.

Turning backup off, deleting a backup, deleting your account and uninstalling the app are different actions. Uninstalling does not request remote deletion. Backup settings and the account-deletion process provide the relevant controls; contact us if a deletion fails. Never send us your recovery code.

Back to contents

3. Accounts and purchases

Firebase Authentication, provided by Google, processes your email address or Apple Sign-In identifier and authentication information to provide sign-in and account protection. Diary records are not uploaded to Firebase Authentication as part of sign-in.

Apple or Google and RevenueCat process purchase, receipt, account and entitlement information for optional purchases and access management. We do not receive your full payment-card details. Core tracking remains free. Ember Plus is an optional paid subscription purchased through Apple or Google.

Optional clinic codes

If you choose a clinic code, Ember saves the clinic, offer version and confirmation date with an account reference on Google Cloud. RevenueCat sends purchase-status events so Ember can check offer eligibility. The clinic receives no payment, purchase information or diary data through the code. You choose whether to send each report.

Clinic offers provide eligible accounts with a one-time Plus trial and a discount for the first paid year. Starting a trial does not start a paid subscription. Free tracking and reports remain free.

Deleting your Ember account queues removal of clinic-code associations and eligibility records. A deletion marker lasts 30 days to block delayed events; webhook deduplication records expire after 400 days. Expiry cleanup is asynchronous. Database recovery can retain prior versions for seven days. Clinic HTTP request logs are excluded; application and cloud audit logs follow the service providers’ retention settings. Store subscriptions must be canceled separately.

Back to contents

4. Weather and approximate location

If you use weather features, Ember sends your selected city or approximate coordinates, with the relevant device permission, through Ember’s weather relay to Visual Crossing. Weather requests do not include your diary or medication records. You can choose a city instead of device location and change location permission in device settings.

Back to contents

Optional navigation sharing

In builds that include optional navigation sharing, it starts off. Sharing begins only after you choose Allow sharing in the optional Help improve Ember request or turn it on in Settings → About → Help improve Ember. Choosing No thanks or leaving the request unanswered does not enable collection. You can turn sharing off in Settings at any time without losing access to Ember. Uploads do not display status messages or interrupt diary entry.

Older public builds do not gain this feature from this policy update. Consent and store requirements must be resolved before general distribution.

If enabled, the app sends bounded counts of approved screens opened, navigation buttons tapped and immediately adjacent screen transitions to Ember’s service on Google Cloud. Counts include platform, app version/build and a UTC day. The payload excludes diary contents, selected diary dates, notes, medications, health readings, screenshots, raw touch positions and account identifiers. Use of Ember can itself imply an interest in migraine care.

Google Cloud/Firebase provides storage, processing and app attestation. Network infrastructure processes IP addresses in transit. This feature does not introduce advertising tracking or session replay. Pending local counts expire within seven days; retry receipts expire after fourteen days and pooled daily totals after ninety days. Expired totals are excluded from dashboard reads while automatic database deletion completes.

Stop sharing in Settings → About → Help improve Ember to stop future collection and clear pending local counts. Sign-out and demo mode also clear pending counts. Permission to share is saved locally for the account that gave it on this phone; a different account does not inherit that permission. A choice to stop sharing keeps it off across accounts on the phone. These choices are excluded from health backups. Already pooled contributions have no individual lookup key and cannot be individually subtracted; applicable requests concerning other processor information can be made through the privacy contact below.

Back to contents

5. Diagnostics, website and support

Ember uses Sentry for error diagnostics to find and fix software problems. Diagnostic information can include error details, code locations, app and device information, device identifiers, interaction breadcrumbs, and technical connection metadata. Older diagnostic records may also contain approximate location inferred from the connection IP address. We apply collection and redaction controls; the fields depend on the installed app version. We do not describe these records as anonymous or use them for advertising.

Our website hosting and other network providers receive technical connection information when you visit or use their services. The website loads fonts from Google Fonts. If you email us directly, our Google Workspace mailbox receives what you include. We use support messages to respond and handle requests. Do not send detailed health records, urgent medical concerns or recovery codes through ordinary support email.

Where available, Get in touch in the app sends the message you write, one optional screenshot you select, and your verified account email through our Google Cloud service and Paubox to our Google Workspace support mailbox. Screenshots may contain health information. Nothing is sent until you press Send message; the diary is not automatically attached. This support message is readable by the services delivering it and our support team; it does not use the recovery-key encryption used for automatic backups. Use it for app feedback, not urgent medical care, and never include a recovery code.

Website contact and clinic setup forms

When you send a website form, your name, email address and message or clinic details pass through our Google Cloud service and Paubox to our Google Workspace mailbox. Clinic requests include the report inbox you supply and your confirmation that the clinic approves it. We use these details to respond and arrange clinic setup. A setup request does not add the clinic automatically or send patient reports. Do not include patient information or recovery codes.

The form service stores request identifiers, keyed fingerprints, submission status and abuse-prevention counters, including a keyed email reference. It does not save the form’s message, name or email address in its metadata bucket. Metadata is scheduled for deletion after 400 days without an update; earlier removal can be requested through the privacy process below. The support-mail retention procedure below also applies to website messages. These forms do not require an Ember account.

Back to contents

6. Recipients and sharing

The services described above include Google Cloud, Firebase, Google Workspace, Paubox, Apple, Google Play, RevenueCat, Sentry, Visual Crossing and our website host, GitHub Pages. They receive information for the functions described here. Google Cloud receives encrypted eligible backup records and backup metadata, and processes website forms and in-app contact messages and optional screenshots for delivery; Firebase receives authentication information; Apple, Google and RevenueCat receive purchase or access-management information; Sentry receives diagnostic information; Visual Crossing receives weather-request location information; Paubox delivers website forms and in-app support messages and optional screenshots; and Google Workspace receives support messages you send. iCloud Keychain or Google Block Store may receive recovery material separately from the Google Cloud backup ciphertext.

You choose the recipient when you export or share a report or file. A shared PDF or JSON export is not protected by Ember’s automatic-backup encryption; its recipient and the sharing service handle it under their own practices. Direct clinic-email delivery is not currently available in the public app.

We do not sell personal or consumer health data or share it for targeted advertising. We may disclose information where required by law or to protect security and legal rights, subject to applicable law. We do not use geofencing around healthcare facilities to identify people seeking care or deliver health-related advertising.

We do not share personal information with other businesses under common ownership or control. Reports you choose to send to your clinician are handled separately.

Back to contents

7. Retention and deletion

Local records remain until you edit, delete, reset or restore them, or your device removes them. Your own exports and recipients’ copies are separate.

Automatic backup keeps up to ten verified versions, with cleanup of older versions; failed cleanup can temporarily retain additional versions. There is no automatic deletion solely because Plus access expires. Successful remote-backup deletion removes stored encrypted versions. Minimal revocation markers may remain to prevent previously enrolled devices from recreating a deleted backup. Account deletion also removes the authentication account through the app’s deletion process.

Account information is retained while the account is active. Support, security, diagnostic and purchase records have separate purposes and retention requirements. We retain them only as needed for those purposes, applicable legal obligations and documented exceptions.

Using the in-app account-deletion control removes the authentication account and local Ember records after the supported backup-deletion step succeeds. New account deletions automatically queue a request to delete the associated RevenueCat customer record. Processing runs hourly; linked-account conflicts or service failures can delay deletion and require review. This does not cancel store subscriptions or delete store transaction records, Sentry diagnostic records, or support email and contact-delivery metadata. For a request about those other records, use the privacy-request process below; we will explain the records involved, any retention exception, and the outcome. Copies retained by Apple, Google, RevenueCat, Sentry, Google Workspace, Paubox, Visual Crossing or another recipient follow that recipient’s applicable process and retention rules.

For in-app contact, our service stores request identifiers, payload fingerprints, submission status and abuse-prevention counters under a hashed account reference, not the message body, email address or screenshot. Contact metadata is scheduled for deletion after 400 days without an update, or handled earlier through a verified privacy request. A minimal deletion marker may remain to prevent an in-flight request from recreating erased metadata. Our support-mail procedure calls for deleting messages within 90 days after resolution unless a documented legal or security hold applies. Paubox, mailbox and backup copies require their own deletion handling; we do not promise immediate erasure of every vendor copy.

See Delete your Ember account for in-app and email options. Deleting an account does not cancel a store subscription; cancel through Apple or Google separately.

The deletion queue contains an account identifier and processing timestamps, not diary content. Completed request records are removed after 30 days; unresolved requests remain available for follow-up.

Back to contents

8. Your choices and privacy requests

You control what you enter, connected-health permissions, weather choices, automatic backup, exports and sharing. You can edit or delete local records and use export tools. Turning a feature off stops its future use but may not erase previously stored information.

For access, correction, deletion, portability, consent withdrawal, restriction or objection requests where applicable, email hello@cascadeheadache.com. Cascade Headache, PLLC handles these requests. Tell us what you want to do and the account email; do not include your diary or recovery code. We may need proportionate verification of account ownership. You do not need to create a new account to make a request.

We respond within the deadlines that apply to your request and explain any lawful extension or exception. To appeal a refusal, reply with “Privacy request appeal” in the subject; we will reconsider and explain the outcome and available complaint route. You may also contact your applicable privacy regulator. See the Washington notice for its specific rights and appeal process.

Back to contents

9. International use

Cascade Headache, PLLC operates in the United States. Networked services may process information in the United States or other countries where providers operate. These countries may have different privacy laws. We assess applicable transfer safeguards and contractual requirements for those services. Local device processing or encryption does not, by itself, remove privacy rights or make every jurisdiction’s law inapplicable.

Back to contents

10. Security and clinical care

Safeguards include device storage controls, account authentication, encrypted automatic-backup content and service access controls. No system can guarantee complete security. Protect your device, account and recovery material.

Ember is a consumer tracking app. Using it does not create a clinician-patient relationship. Cascade also provides clinical care, but it does not retrieve your Ember diary for clinical care; clinicians receive reports you choose to share. A clinician’s handling of a received report is subject to that clinician’s practices and applicable duties. We make no HIPAA-certification claim or blanket legal exemption based on local storage or encryption.

Back to contents

11. Age audience

Ember’s current terms specify a minimum age of 17. If you believe a child has provided information through Ember, contact us so we can assess and address it. Local deletion alone does not remove information already sent to a network service.

Back to contents

12. Policy changes and contact

We update this policy when practices change and identify the update date. We provide additional notice and obtain affirmative consent where required before a new collection, sharing or use. Continued use alone does not replace a legally required consent.

Operator: Cascade Headache, PLLC
4405 7th Ave SE
STE 200, PMB 2872
Lacey, WA 98503
Privacy contact: hello@cascadeheadache.com

Back to contents