Privacy Policy

The Short Version

• em stores your writing as plain Markdown files in folders you choose.
• Those folders sync between your own devices through your own iCloud account — never through servers em operates, because em doesn't operate any.
• Ghost publishing sends data only to the Ghost site you connect, using your own Admin API key, which is stored in Apple's Keychain.
• Location is optional and off until you turn it on for a library. If you do, where you began writing a file is recorded in that file, on your device and in your own iCloud. It never reaches em’s developer, and em never includes it when you copy, use Ask em or Siri, or run a Shortcut.
• Weather is optional and tied to Location, with its own switch for each library. em reads it from Open-Meteo’s public data on Amazon Web Services, directly from your device, with no coordinates or personal data sent. Those servers can still infer the general area, the hour, and your IP address, as with any web request. The result is stored only in your own file and removed from anything you share, the same as location.
• AI features are off by default and begin with Apple's on-device models if enabled. If you connect your own Claude, ChatGPT, or Gemini API key, only files from libraries you specify are sent to the model. Your API key is stored in Apple's Keychain, and the provider bills you according to their usage policy.
• em and its developer never see your writing, your credentials, or your usage. Even better, there is nothing to see — no analytics, no crash reporting unless you choose to share it.
• em keeps a log of its own activity on the device for up to seven days, used only when you compile a bug report. If you choose to send diagnostics with a bug report, the log is redacted of any personal details.
• You can delete all of em's saved files, settings, and on-device logs from the Help tab in em's Settings.

Your Files

Your libraries are folders that live in your iCloud Drive. em reads and writes to them directly. Sync between your Mac, iPad, and iPhone happens through Apple's iCloud with your Apple Account. No copy of your writing is ever transmitted to em's developer or to any server em controls, because that server doesn't exist.

Deleting em from a device does not delete your files — they remain in the original storage directory. em's settings, Version History, and preferences live in em's own iCloud folder, not alongside your writing. See the FAQ to learn what happens to these synced files if you stop using em.

Location is off by default. In a library where you turn it on, em asks your permission through the system, then records where you began writing each new file in that file’s own metadata, so it moves with the file between your devices through your iCloud. em reads your location only while the app is open — it doesn’t track you in the background or watch where you go. Copy, Ask em, Siri, and Shortcuts never include a file’s location, and Share and Print ask you first. If Weather is on for the library, the weather for that hour and place is recorded in the same file, and nowhere else. See Weather.

Ghost Publishing

If you connect a Ghost site, em talks directly to that site's Admin API using a key you generate in your own Ghost site's settings. That key is stored in your Keychain and synced via iCloud. Data only ever flows between your device and the Ghost site you connected — never through em. Ghost connections are read-only by default, and nothing writes to your site until you explicitly enable the feature and then save or publish a draft. There is no background or automatic upload of your drafts.

AI Features

AI features are off by default in em. You can choose to leave it that way or use AI on your terms. There are three tiers of AI models built into em:

1. On-Device. Apple Intelligence's on-device model. Nothing about your writing leaves your device — not to Apple, not to em's developer. Learn more about Apple's on-device Foundation Models.
2. Private Cloud Compute. Two things can use it: an Editorial Review Shortcut using Apple's on-device model, and Siri reading or editing a document directly. Either way, a request that the on-device model can't handle is processed on Apple's Private Cloud Compute infrastructure under Apple's own PCC privacy guarantees. em hands over only the content the request needs — a Shortcut's own permissions govern the rest of what it can do.
3. Remote Models (Claude, ChatGPT, or Gemini). You supply your own API key. When this tier answers a question or reviews a draft, it receives only content from the library or libraries you enable for AI. Requests go directly from your device to the provider you chose, using your key. em never sees your key or the information sent with it.

Search, indexing, and reading your files happen entirely on-device in every configuration, regardless of which AI model you enable.

Billing and control belong to you. External model usage is billed by the provider to your account — em takes no cut and does not act as a middleman. Your API key is stored in your Keychain and syncs via iCloud; only you can see it, and you can revoke it from the provider's console or em's settings at any time. Apple's Private Cloud Compute may have usage limit based on Apple's iCloud service, but the on-device model is always free.

Web search is up to you. You can choose to give a remote model access to the internet via em's model settings. If you do, web search runs under the model's API key through that provider's own search. Web search is off by default.

Maps

When em shows a map, or the name of a place, Apple Maps provides the map tiles and the place name, under Apple’s own privacy terms. em doesn’t store what Apple returns, and em has no location service of its own.

Weather

Weather is optional and tied to Location. In a library where Location is on, em can record the weather for the hour and place where you began writing a file: a condition such as Partly Cloudy, a symbol, and the temperature in your unit. Each library has its own Weather switch under Location, on by default when you turn Location on, and you can turn it off without losing Location. Older files with a location can look up their weather too, back to 1940.

Where it comes from. em reads weather from the public open-data files that Open-Meteo hosts on Amazon Web Services (S3), downloading small byte ranges of them directly from your device. The current hour comes from Deutscher Wetterdienst’s ICON model, and older dates come from Copernicus ERA5. No account, API key, or login is involved, and nothing passes through a server em operates, because em has none.

What those requests can reveal. em sends no coordinates, place names, file contents, or identifiers. But which parts of the public files em asks for correspond to a region of the map, so Amazon’s servers, and Open-Meteo if it keeps access logs, could infer your general area — roughly a strip tens of kilometers tall and about 150 km wide — along with the hour being looked up and your device’s IP address, as with any web request. Weather is a record of the conditions for that hour and place, not a precise reading for your exact spot.

Where it’s stored. The weather is written only into your own file, on one line beside the location, and so into your iCloud if your files sync there. em keeps no copy anywhere else. If you imported a journal that came with its own weather, em never reads, changes, or duplicates weather it didn’t write.

Sharing. Like location, the weather line is removed from anything em sends out — Copy, AI requests, Shortcuts, and Siri — and Share follows the same rule as location. Printed pages and PDFs never include it.

Open-Meteo’s data is licensed under CC BY 4.0. See Acknowledgments for the credit.

What em Doesn't Collect

There is no em account, no sign-up, and no telemetry. em doesn't operate analytics, crash reporting outside of Apple's opt-in model, or usage tracking of any kind — there's no server for that data to reach even if em wanted to collect it. Any crash reports you choose to send go through Apple's standard OS-level mechanism and are governed by Apple's own privacy policy, not em's. em never collects your location. If you turn Location on, it stays in your own files; the only exception is the general-area hint that Weather lookups can give Amazon and Open-Meteo, described under Weather.

Children's Privacy

em collects no personal information from anyone, of any age, because it collects no personal information at all — everything described above stays on your device or moves directly between your device and services you explicitly connect.

Changes to This Policy

If em's architecture changes in a way that affects this policy, this document would be updated first, and the change would be visible in the app before it took effect.

Contact

Questions about this policy can be sent to the developer.

Acknowledgments

Fonts

em uses the following fonts in the app and on this site:

Icons

The icons on this site are from Font Awesome Free, used under its Free License (icons: CC BY 4.0).

Magic Pages

Magic Pages — The developer's preferred Ghost host. This is an affiliate link which may compensate the developer for any paid signups, at no cost or obligation to you.

Markdown

Markdown was created by John Gruber.

Trademarks

• Ghost is a trademark of Ghost Foundation Ltd.
• Apple, Apple Intelligence, Apple Maps, iCloud, Private Cloud Compute, and Siri are trademarks of Apple Inc.
• Anthropic and Claude are trademarks of Anthropic, PBC.
• OpenAI and ChatGPT are trademarks of OpenAI, L.L.C.
• Google and Gemini are trademarks of Google LLC.

em is not affiliated with or endorsed by Amazon, Anthropic, Apple, Ghost, Google, Magic Pages, Open-Meteo, or OpenAI.

All other trademarks are property of their respective owners.

Weather Data

Weather data by Open-Meteo, under CC BY 4.0. Contains modified Copernicus Climate Change Service information (ERA5) and data from Deutscher Wetterdienst (ICON), modified by em.