SECURITY
What leaves your Mac, and what doesn't
The short version is on the features page. This is the whole of it.
Ember has no analytics, no telemetry and no crash reporter. There is nothing to opt out of, because nothing is gathered. What follows is what that means for you, and what happens to the few things you do hand over.
Syncs when you sign inStays on your Mac
- Palettes you share
- Projects and their files
- Your email address
- Subscription status
- Clipboard history
- Recent picks
- Unshared palettes
- Preferences and shortcuts
Signing in
- Your password is never stored. What we keep is the result of putting it through 200,000 rounds of hashing with a salt that is yours alone, and that cannot be turned back into a password.
- If somebody walked off with the whole database they still could not sign in as you, because what is in it is a hash of your session token rather than the token.
- On your Mac that token sits in the Keychain, not in a preferences file anything can read.
- A wrong password and an email we have never seen give exactly the same answer, so nobody can use the sign-in form to work out whether you have an account.
Sharing with other people
- Every time anything is asked for we check it is yours to see — on every request, not once when you signed in.
- Files are named after a checksum of what is inside them, and knowing the name gets you nowhere on its own. You still have to be allowed to have it.
- Asking for something you are not allowed to see gets the same answer as asking for something that does not exist, so the answer itself never tells anyone what exists.
- Everything is encrypted on the way. Purchases go through the App Store and Ember contains no payment code at all, so we never see a card number.
If your password manager marks something as concealed, Ember does not read it. Not reads it and hides it — does not read it. Found a security issue? security@typofire.com, and we will confirm we have it within two business days. The privacy policy is the full legal account.