Privacy

Privacy policy

Your mixes and imported sounds stay on your devices. The Mac and iOS apps work without an account and contain no advertising or usage-analytics SDKs. Online actions, such as downloading a sound pack, visiting this website, subscribing to updates, or contacting support, involve the information described below.

Idle Foundry Ltd. is the controller responsible for Ember Noise and embernoise.com. Our registered office is 350 Bay St, Suite 1300B, Toronto ON M5H 2S6, Canada. Contact [email protected] for privacy matters.

Effective September 10, 2026. Covers the Mac and iOS apps and this website.

The app and your controls

• Local storage. Mixes, presets, imported audio, EQ settings, and timer settings are stored on your device. We cannot read or remotely erase them.
• Offline playback. Every built-in sound ships with the free app. Email updates are optional.
• Local diagnostics. The app keeps diagnostic information for troubleshooting on your device. A problem report leaves the device only through a send, share, or copy action you choose.
• Deletion. Individual presets and imported sounds can be deleted in the app. On iOS, deleting the app removes its app data; offloading preserves it. On macOS, moving the app to Trash can leave its settings and data container behind. Contact support for help removing these. Exported files, system backups, and Keychain items can remain separately.
• Apple services. App Store distribution, TestFlight, and device backups are governed by your Apple settings and Apple's privacy information. They operate separately from our app's local storage.

Send to Device

Send to Device transfers selected presets and sounds between devices you pair over your local network. Discovery uses Bonjour. Pairing identities are held in the system Keychain and transfers are encrypted end to end. They pass directly between paired devices. On iOS, discovery and receiving run while Ember Noise is open in the foreground. A Mac may remain available from its menu-bar app after you activate Nearby Transfer once. Local Network permission is requested when you open this flow. You can revoke it in system Settings and unpair devices in the app to remove their saved pairing identities.

Sound-pack downloads and website visits

Opening a hosted sound-pack link connects to embernoise.com over HTTPS to download the file. The request identifies the requested pack and exposes your IP address and ordinary request information, such as time, app or browser information, and response status, to our hosting provider, Cloudflare. Visiting website pages involves similar requests. These requests do not upload your existing mixes or imported audio.

We use this information to deliver the pages or downloads you request, keep them available, and investigate abuse or faults. Where EU or UK data-protection law applies, delivering requested digital content relies on performing our agreement with you (Article 6(1)(b)); website operation and security rely on our legitimate interests in running and protecting the service (Article 6(1)(f)). Technical request information is necessary to provide an online response. Built-in playback remains available offline.

Cookies and bot protection

This website uses neither advertising cookies nor audience-analytics scripts. Cloudflare Turnstile protects the email form from automated submissions. It processes limited browser, device, and network signals, including IP address and browser information, for bot detection. Our legal basis is the legitimate interest in preventing abuse. Cloudflare also processes signals to improve its bot detection as an independent controller, as explained in its Turnstile Privacy Addendum. Any security storage used by Cloudflare is for protection of the service.

The form sends your email address to Klaviyo only after the server verifies your consent choice and the bot check. You can use the website and download the free pack without submitting that form.

Email updates

If you choose to subscribe, we use your email address to send the 2049 pack and occasional Ember Noise release, platform, and future-store news. The legal basis for marketing is your consent (Article 6(1)(a)). New subscribers confirm through a double-opt-in email before receiving marketing. Existing subscribers can request the pack again. You can instead get the pack without email updates. Unsubscribing leaves your app and downloaded pack available.

• Information processed. Email address, subscription and suppression status, signup source, consent and confirmation records, pack requests, and delivery information such as bounces and unsubscribe requests. New signup requests include the consent wording and version presented by this form.
• Email tracking. We have disabled Klaviyo's recording of email opens and clicks and its email-to-website activity tracking. Email images and service links can still contact Klaviyo for delivery, security, or subscription management. These controls do not remove previously recorded events.
• Your choice. Use the unsubscribe link in a marketing email, or email [email protected]. Withdrawal is as available as signup and does not require an app account.

Support and problem reports

If you contact us, we receive your contact details, message, and any attachments you choose to send. If you leave a voicemail, we receive your caller number, call time and duration, and the recording. Our phone provider stores the voicemail and sends a copy to our company mailbox. An optional diagnostic report can contain app and OS details, settings, and recent diagnostic events; you can inspect it before sharing. Please include only what is needed to explain the problem. We use support information to respond, resolve problems, and maintain a reliable service, relying on our legitimate interests (Article 6(1)(f)) or performance of an agreement when your request concerns that agreement (Article 6(1)(b)).

How long information is kept

• Local app information. Until you remove it using the controls described above. Your own exports and backups follow your storage settings.
• Email list. While you remain subscribed. After withdrawal, we keep only information needed to honour the suppression, demonstrate the consent history, or address a legal claim. Suppression is retained while needed to prevent further marketing to that address. Consent evidence is retained for the applicable period for demonstrating compliance or resolving claims.
• Unconfirmed requests and pack events. Only while needed to complete or troubleshoot a request, prevent abuse, or demonstrate the signup choice. An unconfirmed request does not authorize marketing.
• Support. While resolving your request and subsequently while needed to investigate a recurring issue or establish, exercise, or defend legal claims. We consider the issue, the last relevant contact, and applicable legal retention or limitation periods, and remove unnecessary attachments sooner.
• Hosting and security. Request and security records follow Cloudflare's service retention periods. Any diagnostic extracts we retain are limited to what is needed to resolve an incident or meet a legal obligation. We do not maintain a separate visitor-profile database.

We review retained information and remove or anonymize it when these purposes end. A legal obligation or active dispute can require limited information to be kept longer. You can ask us about the retention criteria that apply to your information.

Providers and international processing

Cloudflare provides website hosting, downloads, bot protection, and support-email routing. Klaviyo provides subscription management and email delivery. Support mail is delivered to our Gmail mailbox, operated by Google. VoIP.ms provides our business phone and voicemail service. Access is limited to people and providers who need it to operate these services. Providers may also act as independent controllers for their own security and service purposes. We may disclose limited information when a legal obligation requires it.

We are based in Canada. These providers may process information in Canada, the United States, and other countries outside the EEA. Cloudflare and Klaviyo publish data-processing terms with transfer mechanisms such as the European Commission's Standard Contractual Clauses. An applicable adequacy decision may also be used where its conditions are met. A country's location alone does not establish that a particular transfer is covered. Contact us for information about the safeguards relevant to your data or a copy of applicable safeguards.

Provider information: Cloudflare privacy, Cloudflare data-processing terms, Klaviyo privacy, Klaviyo data-processing terms, Google privacy, and VoIP.ms privacy.

Your privacy rights

Under the GDPR, where applicable, you can request access, correction, erasure, restriction, and portability of eligible data. You can object to processing based on legitimate interests and object to direct marketing at any time. You can withdraw consent without affecting the lawfulness of processing before withdrawal. Some rights have conditions or exceptions, which we will explain if relevant to your request.

Send requests to [email protected] or [email protected]. We normally respond within one month of receipt. If a request is complex or numerous requests require an extension, we will explain it within that month; the GDPR permits up to two additional months. We may request proportionate information to verify identity before disclosing data.

You can complain to a data-protection authority, including the authority where you live, work, or believe an infringement occurred. You do not have to contact us first. The European Data Protection Board lists EEA supervisory authorities.

We do not sell personal information or use it for automated decisions producing legal or similarly significant effects. Local playback does not require you to supply personal information to us.

Changes and questions

Revisions appear here with an updated effective date. If a change requires a new consent, we will obtain it before that processing begins. Contact [email protected] with questions about this policy.