Privacy Policy

Embr is designed to protect private communications through end-to-end encryption. When end-to-end encryption is enabled and operating as described, message content is encrypted on the sender's device and can be decrypted only by authorized recipient devices holding the necessary cryptographic keys.

Our servers may process and retain encrypted message data, delivery information, account identifiers, timestamps and other technical metadata needed to operate the service. End-to-end encryption does not necessarily protect all metadata, account information, or information you voluntarily submit to us.

The protection provided by end-to-end encryption depends on the security of your device, account credentials and cryptographic keys. If a recipient captures or exports content outside Embr, we cannot remotely erase that copy.

We will describe any feature that does not support end-to-end encryption separately, and we will not represent that feature as end-to-end encrypted.

• Your account: name, email address, sign in method and role.
• That a message exists, who sent it, when, and which Camp Fire it belongs to.
• Public keys for each member's device, and one encrypted copy of each message's content key per member.
• Answer choices in Burning Questions, game turns, flame progress and reminder settings.
• Reports you choose to submit, including any photo you deliberately attach.

What our servers do not hold: the private half of any member's device key, plaintext message text, or a readable copy of a photo unless you personally submit it in a report.

Photos and videos intended for encrypted conversations are encrypted on the sending device before they are uploaded, so the stored object is unreadable without the conversation key.

When a message is deleted, or a burn-on-open message has been opened by everyone else in the Camp Fire, we delete the message record. That record is the only place the sealed copies of that message's key are kept, so once it is gone nobody, including us, can decrypt the associated encrypted object again, and access to the conversation is revoked.

Messages do not expire on a timer. A message stays until it is deleted, burned, or its author leaves the Camp Fire. The encrypted storage object itself may remain in storage until it is cleared, and encrypted copies may remain in backups according to our retention schedule. We do not claim that deleting a message erases every copy of that object everywhere at once.

Deletion from Embr cannot guarantee deletion of copies a recipient captured or stored outside the app.

End-to-end encryption limits our ability to inspect private message content proactively. A user may choose to submit content or relevant information when reporting abuse or requesting removal of an intimate image. Nothing in your chat is readable to us unless you send it to us yourself.

We use submitted information only as reasonably necessary to assess the report, enforce our policies, meet legal obligations and protect users. Access is limited to the safety review role and retention is limited to what is reasonably necessary.

We may remove reported content from our systems when we can identify and locate it, including encrypted copies associated with the reported content. We will make reasonable efforts to meet applicable legal removal obligations. We will not claim that we can automatically inspect, identify or remove every copy of an encrypted image unless our technical systems support that capability.

Read the Intimate Image Removal Policy for how requests are handled and tracked.

Your private key is created on your device and never leaves it. That is what keeps us out of your conversations, and it has a direct cost:

• If you lose or reset a device, or clear your browser storage, older messages in that Camp Fire can no longer be opened by you. There is no server side recovery of past message content.
• A new message keeps working once you open Fireside on the new device, because a fresh key is published for your partner to encrypt to.
• Your invite password is only used to prove the right person is joining. It is never used as an encryption key and cannot unlock message content.
• When one member is removed from a Camp Fire, their access to the chat ends and any content they sent is removed. They cannot read messages sent after they leave.

How long we keep each type of data, and which periods are still provisional targets rather than verified platform behaviour, is set out in the Data Retention Schedule.

To ask for removal of an intimate image you do not need an account: use the public removal request form and you will be given a case reference. If you have an account, reporting from inside Fireside does the same thing and attaches only the one photo you choose.

A monitored safety inbox and business mailing address will be published here before launch.