Draft — not yet in effect. Prepared with AI assistance and not reviewed by a lawyer. Highlighted items are still to be confirmed. 草稿，尚未生效。

Ember Privacy Policy / Ember 隐私政策

English

Effective date: [CONFIRM: release date, planned November 13, 2026]
Who we are: Ember is a free fitness and nutrition app operated by [CONFIRM: legal name of the operator (individual or company) and mailing address] ("Ember", "we", "us").
Contact: privacy@waipyy.com — this address also reaches our person in charge of the protection of personal information (Quebec) and our privacy contact for Canada (PIPEDA): [CONFIRM: name or title of that person].

We also publish a separate Consumer Health Data Privacy Policy (for Washington, Nevada and similar laws) at https://ember.waipyy.com/health-privacy.html. If you live in Washington or Nevada, that policy applies to your consumer health data in addition to this one.

1. The short version

• Most of your Ember data (workouts, plans, food log, weight, chats) is stored on your iPhone.
• When you use an AI feature, the data that feature needs is sent through our server to the AI providers named in section 5, including providers based in China (Alibaba, DeepSeek, Z.ai). We ask for your permission first, and you can withdraw it.
• Cloud backup is off unless you turn it on.
• We do not sell your data, show ads, use your data for advertising, or track you across apps.
• You can delete your account in the app (我的 / Me → 账号 / Account → 删除账号 / Delete account).

2. What we collect and why

We do not collect precise location, contacts, browsing history, payment information, advertising identifiers, or your Apple Health data other than body weight. Our servers and providers receive your IP address as part of every internet connection; we do not use it to locate you. Our database keeps no IP address, only the hash described above. [CONFIRM: Vercel request-log retention period, which includes IP addresses and request paths]

3. Data that stays on your iPhone

Ember stores your data in the app's storage on your iPhone. It is removed when you delete the app or delete your account; signing out leaves it on your phone. If cloud backup is off, we have no copy of your health and fitness data on our server, except what you send to AI features or put in feedback (sections 2 and 5). Apple Health data read by Ember is never stored in iCloud by Ember.

4. Cloud backup (off by default)

If you turn on cloud backup (我的 / Me → 云备份 / Cloud backup) and confirm when the app asks, it uploads a copy of your Ember data to our database: profile, weights (including weights read from Apple Health), body measurements, workouts and plans, custom exercises, coach memories (including injuries), exercise guides, food log and AI estimates, coach chats including photos, and your on-phone AI call log.

• We keep the 60 most recent backups per account; older ones are deleted automatically.
• From your latest backup, our server computes your personal records (best weights and reps per exercise).
• You can delete one backup or all of them in the app at any time. Turning backup off lets you delete the copies already on our server.
• Our database provider keeps a short point-in-time recovery history. Deleted data can remain in that history for up to [CONFIRM: Neon point-in-time restore window for the production project, e.g. 1, 7 or 30 days] and is then gone. We use it only to recover from failures.

5. AI features and AI providers

AI features include: coach chat and training plans, workout reviews, exercise guides, meal estimates from photos or text, meal follow-up questions, food edits, and matching your frequent foods to USDA data. Ember does not send anything to an AI provider until you have agreed on the AI data consent screen. Without consent, logging and tracking still work.

How a request travels: your phone → Ember server (Vercel, United States) → Vercel AI Gateway → the AI provider that runs the model. Requests are authenticated with our credentials, not your identity; your name and email are not included. The content can still identify you (for example a photo, or what you write).

What each provider may receive (only for the AI feature you use):

[CONFIRM: whether Vercel AI Gateway sends these requests to the model maker's own service or to other hosting providers (for example US-hosted inference for Qwen, DeepSeek or GLM). If other hosts are used, name them here or pin routing to the makers listed.]

What is sent:

• Coach chat, plans, workout reviews: your messages and photos; profile (sex, age, height); weight trend, target weight and body measurements; goal and experience; coach memories (which can include injuries); recent training and recovery; the last two days of food and your calorie target; more food history if the coach looks it up.
• Meal estimate: your meal photos or description and any answers you give. Each estimate is sent to three models (Qwen, GPT and DeepSeek), and the app uses the middle value.
• Exercise guides: the exercise, and for your own exercises your saved injuries and limitations.
• Apple Health weight is included only if you also turn on the separate "Also send body weight from Apple Health to AI" switch.

Provider retention: AI providers may keep requests for a limited time under their own terms, for example for abuse monitoring. [CONFIRM per provider through Vercel AI Gateway: retention period, whether data is used for training (should be "no"), and whether zero-data-retention routing is enabled.] We do not allow providers to use your data for advertising.

Daily AI limit: each account has a daily AI allowance (currently US$0.20 of AI cost per day, reset at midnight Pacific Time).

Shared AI cap: Ember also caps what all users together can spend on AI in a day. Once that cap is reached, AI features are temporarily unavailable for everyone until spending falls back under it. Non-AI features keep working in both cases.

Withdrawing consent: turn AI data sharing off in 我的 / Me → AI 设置 / AI settings. New AI requests stop at once. Data already sent cannot be recalled from providers but is subject to their retention limits above. Withdrawing your health-data consent also turns AI sharing off (section 10).

6. Shared exercise library

When the coach creates a custom exercise for you, and both your health-data consent and AI consent are on, the app automatically sends its definition only (name, aliases, equipment, muscles, rep range, picture reference) to us so we can review it for Ember's shared exercise library. Your notes, history and other data are not sent. If either consent is off, the definition stays on your phone and is not sent. If we add it to the shared library, other users can see that exercise (not who created it), and it stays in the library after you delete your account, with no link to you. When you delete your account, a submission only you sent is deleted. If other users sent the same exercise, the submission stays and only your link to it is deleted. Exercise guides written for shared exercises contain nothing about you and may be shared with all users.

7. Other third parties (service providers)

We have [CONFIRM: data processing terms in place with Vercel and Neon — link or describe]. We may disclose data if required by law, to protect people's safety, or as part of a transfer of the app to a new operator who agrees to this policy (we will tell you first).

8. How long we keep data

9. Deleting your account

In the app: 我的 / Me → 账号 / Account → 删除账号 / Delete account. This deletes your account, sign-in identities, sessions, all backups, AI usage records, consent records, personal records and feedback linked to your account from our server, deletes exercise submissions only you sent, removes your link from any others, and erases Ember data on that iPhone. We also ask Apple to revoke your Sign in with Apple link; the account is deleted even if that request fails. We hold no Google token to revoke, so you can remove Ember from your Google Account's connected apps yourself. Deletion cannot be undone.

What stays: exercises already approved into the shared library, and AI-written guides for shared exercises, stay with no link to you. Feedback that is not linked to your account (sent while signed out, or with an expired session) stays until it is deleted as section 8 describes; to have it deleted sooner, email us and tell us what you sent. New-account limit hashes are not linked to you. Copies may stay in the database recovery history for up to [CONFIRM] and with AI providers for their retention periods. You can also email us to request deletion.

10. Your rights

Everyone can ask us to access, correct, export or delete their data, or withdraw consent, by emailing privacy@waipyy.com. We answer within 30 days (Canada) or 45 days (US), and tell you if we need more time. We may need to confirm the request comes from your account (for example by replying from the email on your account). We will not treat you differently for using your rights.

Your consents in the app. Your phone keeps a working copy of your health-data consent, health notice, 18+ confirmation and AI consent for the account signed in there. Signing out, or your session ending, clears that copy, and you are asked again the next time you sign in.

We also keep a consent record on our server (section 2). The app sends one in the background whether or not cloud backup is on: when you agree on a consent screen, when you answer "Not now" on the AI screen, when you change AI sharing or the Apple Health switch, and when you withdraw a consent. If you are offline, or sign out first, it waits on your phone and is sent the next time that account can reach our server. Signing out is not a withdrawal and is not recorded, and neither is leaving the first consent screen without agreeing. We keep these records to show what you agreed to and when, so withdrawing adds a record and does not erase earlier ones. They are deleted with your account (section 9), and you can ask us for a copy.

You can withdraw your health-data consent in 我的 / Me → 隐私 / Privacy. This stops Apple Health reads and cloud backups, turns AI sharing off and brings the consent screen back; the rest of the app cannot be used until you agree again. It does not delete your account, the data on your phone or backups already on our server. To erase them, delete your account (section 9) or email us at any time. The consent screen has sign-out and Delete account too, so you do not have to agree again to leave. If you agree again, any Apple Health sync or backup you had on restarts, and AI stays off until you turn it on in AI settings.

Canada (PIPEDA and provincial laws). You can access and correct your personal information and withdraw consent, subject to legal limits. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). In Quebec, you may also ask how your information is processed, request de-indexing or portability where the law allows, and complain to the Commission d'accès à l'information (cai.gouv.qc.ca).

United States. Ember is a small free app and may not meet the thresholds of every state law [CONFIRM: annual revenue and user counts against CCPA thresholds]. We still offer residents of all states the rights described in this section. For California, Colorado, Connecticut, Texas, Virginia, Oregon and other states with consumer privacy laws: you can request to know, access, correct, delete and port your data. We do not sell or "share" personal information for cross-context behavioral advertising, and we use sensitive data (health data) only to provide the features you ask for, with your consent. If we deny your request, you can appeal by replying to our answer; we respond within 45 days (60 in Colorado), and you can then contact your state attorney general. Washington and Nevada residents: see our Consumer Health Data Privacy Policy.

11. Where your data is processed (Canadian users: cross-border notice)

Our servers are in the United States. AI requests can be processed by providers in the United States and China (section 5) [CONFIRM: also Singapore if applicable]. Data stored or processed in another country is subject to that country's laws, and its courts, police and national security authorities may be able to access it. Chinese law can require companies to cooperate with state intelligence work. We send only what each AI feature needs, without your name or email, and only after your consent. For Quebec residents, we assessed these transfers before making them, as Quebec law requires [CONFIRM: a privacy impact assessment for transfers outside Quebec has been completed and is on file].

12. Security

Connections use HTTPS. Sign-in tokens are stored on your phone in the iOS Keychain and only a hash is stored on our server. Access to our server and database is limited to the operator [CONFIRM: multi-factor authentication on Vercel, Neon, Apple and Google developer accounts]. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.

13. Age limit

Ember is for people 18 and older. During setup you must confirm you are 18 or older and enter your birth year. If that year shows you are under 18, your profile is not saved and the app stops at a screen whose only action is to delete your account. Your sign-in account, display name and consent records stay on our server until that deletion is done. The birth year you entered is not recorded; our server records only that your consents were withdrawn. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email us and we will delete it.

14. Changes

We will post changes here with a new effective date, and tell you in the app before material changes take effect. If a change means sending your data to a new kind of recipient or for a new purpose, we will ask for your consent again.

简体中文

生效日期：[CONFIRM: 上线日期，计划 2026 年 11 月 13 日]
我们是谁：Ember 是一款免费的健身与营养应用，由 [CONFIRM: 运营者法定名称（个人或公司）及通信地址]运营（下称"Ember""我们"）。
联系方式：privacy@waipyy.com。该邮箱同时是我们在魁北克的个人信息保护负责人及加拿大（PIPEDA）隐私联系人的联系方式：[CONFIRM: 负责人姓名或职务]。

我们另行发布《消费者健康数据隐私政策》（适用于华盛顿州、内华达州等法律）：https://ember.waipyy.com/health-privacy.html。如果你住在华盛顿州或内华达州，该政策与本政策共同适用于你的消费者健康数据。

1. 简要说明

• 你的大部分 Ember 数据（训练、计划、饮食记录、体重、对话）保存在你的 iPhone 上。
• 使用 AI 功能时，该功能所需的数据会经我们的服务器发送给第 5 节列出的 AI 服务商，其中包括位于中国的服务商（阿里巴巴、DeepSeek、智谱 Z.ai）。我们会先征得你的同意，你也可以随时撤回。
• 云端备份默认关闭，除非你主动打开。
• 我们不出售你的数据，不展示广告，不把你的数据用于广告，也不跨应用追踪你。
• 你可以在应用内删除账号（我的 → 账号 → 删除账号）。

2. 我们收集哪些数据，为什么

我们不收集精确位置、通讯录、浏览记录、支付信息、广告标识符，也不读取 Apple 健康中除体重以外的数据。每次联网时，我们的服务器和服务商都会收到你的 IP 地址；我们不用它来定位你。我们的数据库不保存 IP 地址，只保存上述哈希值。[CONFIRM: Vercel 请求日志（含 IP 和请求路径）的保存期限]

3. 只保存在你 iPhone 上的数据

Ember 把数据保存在你 iPhone 上的应用存储中。删除应用或删除账号时，这些数据会被清除；退出登录不会清除。云端备份关闭时，我们的服务器上没有你的健康与健身数据副本，但你发送给 AI 功能或写入反馈的内容除外（见第 2、5 节）。Ember 读取的 Apple 健康数据不会被 Ember 存入 iCloud。

4. 云端备份（默认关闭）

如果你打开云端备份（我的 → 云备份）并在应用询问时确认，应用会把 Ember 数据的副本上传到我们的数据库：个人资料、体重（包括从 Apple 健康读取的体重）、身体数据、训练和计划、自定义动作、教练记忆（包括伤病）、动作要点、饮食记录和 AI 估算、与教练的对话（包括照片），以及手机上的 AI 调用记录。

• 每个账号保留最近 60 份备份，更早的会自动删除。
• 服务器会根据你最新的一份备份计算个人纪录（每个动作的最佳重量和次数）。
• 你可以随时在应用中删除某一份或全部备份。关闭备份时可以选择同时删除服务器上已有的副本。
• 我们的数据库服务商会保留短期的时间点恢复记录。已删除的数据可能在其中最多保留[CONFIRM: 生产环境 Neon 时间点恢复窗口，如 1、7 或 30 天]，之后彻底消失。我们只在故障恢复时使用它。

5. AI 功能与 AI 服务商

AI 功能包括：教练对话与训练计划、训练点评、动作要点、通过照片或文字估算餐食、餐食追问、修改食物，以及把常吃食物与 USDA 数据匹配。在你于"AI 数据使用同意"页面同意之前，Ember 不会向任何 AI 服务商发送数据。不同意也可以正常记录和追踪。

请求路径：你的手机 → Ember 服务器（Vercel，美国）→ Vercel AI Gateway → 运行模型的 AI 服务商。请求使用我们的凭证而非你的身份，不包含你的姓名和邮箱。但内容本身（例如照片或你写的话）仍可能识别出你。

各服务商可能收到的数据（仅限你使用的 AI 功能）：

[CONFIRM: Vercel AI Gateway 是把请求发给模型厂商自己的服务，还是发给其他托管商（例如在美国托管的 Qwen、DeepSeek、GLM）。如有其他托管商，需在此列出，或把路由固定到上表厂商。]

发送的内容：

• 教练对话、计划、训练点评：你的消息和照片；个人资料（性别、年龄、身高）；体重趋势、目标体重和身体数据；目标和经验；教练记忆（可能包括伤病）；近期训练与恢复；最近两天的饮食和热量目标；教练查询时的更多饮食记录。
• 餐食估算：你的餐食照片或描述及你的回答。每次估算会同时发给三个模型（Qwen、GPT、DeepSeek），应用取中间值。
• 动作要点：动作信息；对你自己的动作，还包括你保存的伤病与限制。
• Apple 健康体重只有在你另外打开"同时把 Apple 健康中的体重发给 AI"开关时才会包含在内。

服务商保存：AI 服务商可能按其条款在有限时间内保存请求，例如用于滥用监测。[CONFIRM: 经 Vercel AI Gateway 的各服务商保存期限、是否用于训练（应为"否"）、是否启用零数据保留路由。]我们不允许服务商把你的数据用于广告。

每日 AI 额度：每个账号每天有 AI 额度（目前为每天 0.20 美元的 AI 成本，美国太平洋时间午夜重置）。

整体 AI 上限：Ember 还为全部用户每天的 AI 总花费设了上限。达到上限后，所有用户的 AI 功能都会暂时不可用，直到花费回落到上限以下。以上两种情况下，非 AI 功能都不受影响。

撤回同意：在 我的 → AI 设置 中关闭 AI 数据共享，新的 AI 请求会立即停止。已经发送的数据无法从服务商处撤回，但受上述保存期限限制。撤回健康数据同意也会关闭 AI 数据共享（第 10 节）。

6. 共享动作库

教练为你创建自定义动作时，如果你的健康数据同意和 AI 同意都已开启，应用会自动把该动作的定义（名称、别名、器械、肌群、次数范围、图片引用）发给我们，供审核是否加入 Ember 共享动作库。你的备注、训练历史和其他数据不会发送。任一同意关闭时，该定义只留在你的手机上，不会发送。如果加入共享库，其他用户能看到这个动作（看不到是谁创建的），删除账号后它仍留在库中，且不再与你关联。删除账号时，只有你提交的动作会被删除；如果其他用户也提交了同一动作，该提交会保留，只删除它与你的关联。为共享动作生成的要点不含任何关于你的信息，可能向所有用户展示。

7. 其他第三方（服务提供商）

我们已与 Vercel 和 Neon [CONFIRM: 签订数据处理条款——链接或说明]。在法律要求、为保护人身安全，或应用转让给同意遵守本政策的新运营者时（会事先通知你），我们可能披露数据。

8. 保存期限

9. 删除账号

在应用中：我的 → 账号 → 删除账号。这会删除服务器上的账号、登录身份、会话、全部备份、AI 使用记录、同意记录、个人纪录和与账号关联的反馈，删除只有你提交的动作，解除你与其他提交的关联，并清除这台 iPhone 上的 Ember 数据。我们还会请求 Apple 撤销"通过 Apple 登录"授权；即使该请求失败，账号也会被删除。我们没有可撤销的 Google 令牌，你可以自行在 Google 账号的已关联应用中移除 Ember。删除后无法撤销。

会保留的内容：已加入共享动作库的动作和为共享动作生成的 AI 要点会保留，且不与你关联。未与账号关联的反馈（未登录时发送，或用已过期的会话发送）会保留到按第 8 节删除为止；如需提前删除，请发邮件告诉我们你发送的内容。新账号限制哈希值不与你关联。副本可能在数据库恢复记录中最多保留 [CONFIRM]，并在 AI 服务商处保留至其期限届满。你也可以发邮件要求删除。

10. 你的权利

任何人都可以发邮件到 privacy@waipyy.com，要求访问、更正、导出或删除自己的数据，或撤回同意。我们会在 30 天（加拿大）或 45 天（美国）内答复，需要延期时会告知你。我们可能需要确认请求来自你的账号（例如用账号邮箱回复）。你行使权利不会受到差别对待。

应用内的同意：手机上保存着你的健康数据同意、健康提示确认、18 岁确认和 AI 同意的工作副本，对应在这台手机上登录的账号。退出登录或会话结束时，该副本会被清除，下次登录时会再次询问。

我们还会在服务器上保存同意记录（第 2 节）。无论是否开启云备份，应用都会在后台发送记录：你在同意页面同意时、在 AI 页面选择"暂不使用 AI"时、更改 AI 共享或 Apple 健康开关时，以及撤回同意时。如果你处于离线状态，或已先退出登录，记录会留在手机上，等该账号下次能连接服务器时再发送。退出登录不算撤回，不会记录；未同意就离开第一个同意页面也不会记录。我们保存这些记录是为了说明你同意过什么、在何时同意，因此撤回只会新增一条记录，不会抹去之前的记录。这些记录随账号删除（第 9 节），你也可以向我们索取副本。

你可以在 我的 → 隐私 中撤回健康数据同意。撤回后，应用会停止读取 Apple 健康和云备份，关闭 AI 数据共享，并回到同意页面；再次同意之前无法使用应用的其他部分。撤回不会删除你的账号、手机上的数据或服务器上已有的备份。如需清除，请删除账号（第 9 节）或随时发邮件给我们。同意页面上也有退出登录和删除账号，你不必再次同意就能离开。再次同意后，你之前打开的 Apple 健康同步或备份会恢复，AI 则保持关闭，直到你在 AI 设置中打开。

加拿大（PIPEDA 及省级法律）：你可以在法律允许的范围内访问、更正个人信息并撤回同意，也可以向加拿大隐私专员办公室（priv.gc.ca）投诉。魁北克居民还可以询问信息的处理方式，在法律允许时要求停止索引或数据可携，并可向魁北克信息查阅委员会（cai.gouv.qc.ca）投诉。

美国：Ember 是小型免费应用，未必达到各州法律的适用门槛 [CONFIRM: 年收入与用户数是否低于 CCPA 门槛]。我们仍向所有州的居民提供本节所述权利。对于加州、科罗拉多、康涅狄格、得州、弗吉尼亚、俄勒冈等有消费者隐私法的州：你可以要求知情、访问、更正、删除和携带数据。我们不出售或为跨情境行为广告"共享"个人信息；敏感数据（健康数据）只在你同意后用于你要求的功能。如果我们拒绝你的请求，你可以回复我们的答复提出申诉；我们会在 45 天内（科罗拉多州 60 天）答复，之后你可以联系所在州的总检察长。华盛顿州和内华达州居民请参阅《消费者健康数据隐私政策》。

11. 数据处理地点（加拿大用户跨境说明）

我们的服务器位于美国。AI 请求可能由位于美国和中国的服务商处理（第 5 节）[CONFIRM: 如适用，还包括新加坡]。在其他国家存储或处理的数据受该国法律约束，其法院、警方和国家安全机关可能获取这些数据。中国法律可以要求企业配合国家情报工作。我们只发送每个 AI 功能所需的内容，不含你的姓名和邮箱，并且只在你同意后发送。对于魁北克居民，我们已按魁北克法律要求在传输前进行评估 [CONFIRM: 已完成并存档魁北克境外传输的隐私影响评估]。

12. 安全

连接使用 HTTPS。登录令牌保存在你手机的 iOS 钥匙串中，服务器只保存其哈希值。服务器和数据库仅限运营者访问[CONFIRM: Vercel、Neon、Apple 和 Google 开发者账号均已开启多重验证]。没有绝对安全的系统；如果数据泄露影响到你，我们会依法通知你。

13. 年龄限制

Ember 仅供 18 岁及以上的用户使用。设置时你必须确认已年满 18 周岁并填写出生年份。如果该年份显示你未满 18 岁，个人资料不会保存，应用会停在一个页面，唯一的操作是删除账号。在删除完成之前，你的登录账号、显示名称和同意记录仍保留在我们的服务器上。我们不记录你填写的出生年份，服务器只记录你的同意已被撤回。我们不会在知情的情况下收集 18 岁以下人士的数据。如果你认为有未成年人注册了账号，请发邮件告诉我们，我们会删除该账号。

14. 政策变更

变更会在此发布并更新生效日期；重大变更生效前我们会在应用内通知你。如果变更涉及把数据发送给新类型的接收方或用于新目的，我们会重新征得你的同意。

本政策以英文版为准；中文版供参考。[CONFIRM: 是否接受英文版优先。对魁北克用户，见使用条款中的法语说明。]