1. Who We Are

Emberlitt Inc. ("Emberlitt," "we," "us," or "our") makes Emberlitt, a reading app for iOS, and the website emberlitt.com. We are headquartered in Miami, Florida, United States. This Privacy Policy explains what personal data Emberlitt collects, how we use and share it, who else can see it, how long we keep it, and how you can delete it. Data Controller: Emberlitt Inc., Miami, FL, United States Contact: emberlitt1@gmail.com Privacy requests: emberlitt1@gmail.com Website: https://www.emberlitt.com

2. Scope

This Privacy Policy applies to the Emberlitt iOS app and to emberlitt.com, including your account and profile, your library and reading progress, passages, the Margin, Today's pages, Bonfires and their chapter conversations, books you add to Bonfires, messages, Find readers and the Find Readers map, Ember, notifications, analytics, and related support and safety operations.

3. Data We Collect

We collect what you give us, what is created when you use Emberlitt, and some information from your device. • Account: your name, username, email address, how you sign in (Apple, Google, or email and password), and your date of birth. If you add them in Account Information: your country, phone number, and gender. • Profile: your photo, bio, favorite genres, and other details you choose to show. • Passages: the text you keep from a book (up to 1,000 characters), your optional note, its themes, the book and your position in it, and who can see it. Also passages you keep from other readers, and a short memory you can write when you finish a book (only you can see it). • Library and reading: the books in your library, reading progress, reading time and goals, your notes for each book, and your shelves. Books you import from your own files stay on your device unless you upload them to your cloud library, add them to a Bonfire, or send them in a chat. • Bonfires: the Bonfires you create or join, reading plans, chapter conversations, posts, and books you add. • Messages: direct and group messages, message requests, and the photos, videos, voice notes, and books you send in them. • Posts: photos you post, their captions, and a place, only if you pick one. • Reading trail: only if you turn on Share my reading trail, how far you've read in a book over time. • Location: only if you turn on location sharing for the Find Readers map, an approximate area rounded to about 1 km. We don't collect your location otherwise, except a place you pick yourself for a post or a Bonfire. • Connections and safety settings: who you follow and who follows you, follow requests, blocks, mutes, and your privacy and notification settings. • Device and usage: device model, operating system, app version, language, time zone, push notification token, app events (such as screens opened and features used), crash reports, and performance data. • Support and safety: messages you send to support, reports you make or that are made about your content, and moderation decisions. We do not collect what you ask Ember or what Ember answers. That stays on your device (see Section 6).

4. How We Use Data

• To run Emberlitt: create and manage your account, sync your library, passages, and progress across your devices, and deliver messages and notifications. • To show your passages to the people you choose. Public passages appear on your profile, in that book's Margin, in other readers' Today's pages, and on emberlitt.com. Followers passages appear only to readers who follow you. • To keep the Margin spoiler-safe: we use your position in a book to hide passages from later in the book until you reach them. • To compose Today's pages: passages from readers you follow, from books you're reading, and on themes you keep, a passage of your own to re-read, and a few from the Emberlitt editorial account. • To suggest readers, based on public activity such as public Bonfires you share, books you both keep public passages from, favorite genres, language, and activity. • To keep Emberlitt safe: review reports, investigate abuse, enforce the Terms of Service and Community Guidelines, and detect spam, fraud, and security incidents. • To respond to support requests and legal requests. • To fix crashes, measure performance, and improve the app, including with aggregated or de-identified analytics. • To comply with law and protect readers, Emberlitt, and rights holders. We do not use your data for advertising and we do not sell it.

5. Legal Bases for Processing

Where required by law, including in the European Economic Area (EEA), the United Kingdom, Switzerland, and similar jurisdictions, Emberlitt relies on the following legal bases: • Contract: to create and run your account and provide the features you use. • Legitimate interests: to secure, moderate, improve, and defend the service, and to suggest readers. • Consent: for optional permissions and features, such as push notifications, the microphone (voice notes and dictation), speech recognition, the photo library and camera (profile photos, posts, and messages), location (the Find Readers map), and Share my reading trail. • Legal obligation: to comply with lawful requests and keep required records. You may withdraw your consent at any time by turning the feature off in the app, changing the permission in iOS Settings, or contacting emberlitt1@gmail.com. Withdrawing consent does not affect processing that happened before.

6. Ember, Dictation, and Recommendations

Ember is Emberlitt's reading companion. Its answers (Ask, Explain, Define, and Translate) and Ember Notes are produced on your device with Apple Intelligence, Apple's Translation framework, and the iOS dictionary. The page text and your questions are not sent to Emberlitt or to any AI provider, and Ember conversations are not stored: each time you open Ember it starts fresh. Your Ember preferences, such as answer length, are stored only on your device. If you ask Ember to add something to your notes for a book, it is saved like any note you write, and an Ember Note you keep becomes a passage like any other. Dictation uses Apple's speech recognition. When your device supports it, recognition happens on your device; otherwise Apple may process the audio under Apple's privacy policy. Reader suggestions and Today's pages are put together by ranking rules that use the information described in Section 4. They do not make decisions with legal or similarly significant effects about you, and you are not subject to decisions based solely on automated processing that produce such effects, as described in Article 22 of the GDPR.

7. When We Share Data

• With service providers that run Emberlitt for us, mainly Google (Firebase Authentication, Cloud Firestore, Realtime Database, Cloud Functions, Cloud Run, Cloud Storage, Cloud Messaging, Analytics, Crashlytics, Performance Monitoring, Remote Config, App Check, and BigQuery). • With Apple and Google when you sign in with them, and with Apple for push notifications. • With other readers, according to your settings (see Section 8). • With moderators, advisors, auditors, insurers, and professional service providers. • With law enforcement, regulators, courts, or rights holders where legally required or reasonably necessary, including reports of child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC). • With a buyer or successor in a merger, acquisition, financing, or asset sale. Emberlitt does not sell personal information and does not share personal information for cross-context behavioral advertising.

8. What Other Readers Can See

Emberlitt is a social reading app, so some of what you do is visible to others. You control most of it in Settings. • Profile: your username, display name, photo, and bio can be seen by anyone, including on emberlitt.com. If you turn on Private account, only followers you approve see your posts and reading activity. • Passages: each passage is Public, Followers, or Private. New passages are Public unless you change the default in Settings › Passages & Company; private accounts and readers under 18 start with Followers. Public passages can be seen by anyone, including people without an account on emberlitt.com. They appear on your profile, in that book's Margin, and in other readers' Today's pages, and readers of the same book see them in the Margin only once they reach that point in the book. Followers passages are seen only by people who follow you, and Private passages only by you. A passage you share to a Bonfire is seen by its members. Other readers can keep a copy of a passage they can see; that copy is saved to their account. • Reading trail: off by default. If you turn on Share my reading trail, readers who follow you see in the Margin how far you've read in that book. • Bonfires: members see the other members, the reading plan, chapter conversations, posts, and the books added to the Bonfire. Public Bonfires (their name, description, members, and any place the host sets) can be found by other readers. Private Bonfires don't appear in search or on the map. • Messages: seen by the people in the conversation. A message from someone you don't follow arrives as a message request. • Find Readers map: off by default. If you turn on location sharing, other readers see your approximate area (rounded to about 1 km), never your exact location. Private accounts and readers under 18 are never shown on the map. • Suggestions: unless you turn off Suggest my account to other readers, you may be suggested to other readers, with a reason based on public activity (for example, a book you both keep public passages from). Find readers may also show recent photos posted by adult readers who can be suggested. Private accounts and readers under 18 are never suggested to people they don't know.

9. User-Generated Content and Safety

Emberlitt gives readers tools to report content and accounts, block and mute other readers, and decide who can message them through message requests. Reports are reviewed by people, and we act on them as described in the Terms of Service. Reports, enforcement decisions, and related evidence may be used to investigate repeat violations, copyright complaints, scams, harassment, threats, and other misuse.

10. International Transfers

Emberlitt may process and store personal data in the United States and other countries where our providers operate. Where required by applicable law, including the GDPR and UK GDPR, Emberlitt relies on appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs), adequacy decisions, or other safeguards recognized under applicable law.

11. Data Retention

• Account and profile data: while your account is active.
• Passages, posts, and other content you create: until you delete them, your account is deleted, or Emberlitt removes them under the Terms of Service. Copies other readers kept of your passages belong to their accounts.
• Messages and chat history: while your account is active and as needed for the other participants, delivery, abuse review, dispute handling, and safety.
• Library, reading progress, reading trail, reading time, and goals: while your account is active, unless you delete them earlier.
• Ember conversations: not stored.
• Location for the Find Readers map: only while location sharing is on. When you turn it off, you are removed from the map.
• Analytics and recommendation signals: up to 24 months, then deleted, aggregated, or de-identified.
• Push tokens and inactive device records: while the device is linked to your account; stale records are typically removed after 90 days of inactivity.
• Support, abuse, security, and moderation records: up to 3 years, or longer if needed for repeat-offender tracking, legal claims, audits, or safety investigations.
• Security and server logs: typically up to 90 days, unless longer retention is needed for an investigation or legal hold.
• Backups: encrypted backups may be kept for up to 30 days after the source data is deleted.

12. Account Deletion and Data Export

You can delete your account from within the app. Emberlitt asks you to sign in again before deletion. Once you confirm, Emberlitt starts a deletion process that deletes your profile, passages, posts, library and uploaded books, social connections, notifications, location data, and other account-linked records. Messages you sent may be anonymized rather than deleted where they must remain for the other people in the conversation or for safety and legal reasons. Analytics records linked to your account are anonymized. Emberlitt may also start the deletion process when an account is terminated for a Terms of Service violation, as described in the Terms of Service. In rare cases, accounts or data may be deleted because of technical errors or administrative actions; Emberlitt keeps commercially reasonable backups but cannot guarantee recovery in every case. You can download a copy of your data, including your passages, from Settings › Download my data. Exports are provided as structured, machine-readable JSON files inside a ZIP archive, in line with GDPR Article 20 (data portability) and CCPA Section 1798.100, and may be rate limited for security reasons. You can also export your passages as text from your Passages.

13. Your Privacy Rights

Depending on where you live, you may have rights regarding your personal data, as described below. • European Economic Area, United Kingdom, and Switzerland: You may have the right to access, correct, delete, restrict processing, object to processing, and port your data under the GDPR and UK GDPR. You also have the right to lodge a complaint with your local data protection authority (supervisory authority). • California (CPRA/CCPA): You may request to know, access, correct, or delete personal information. You may opt out of the sale or sharing of personal information. Emberlitt does not sell or share personal information for behavioral advertising. You have the right to limit the use of sensitive personal information. Emberlitt will not discriminate against you for exercising these rights. • Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other US states: You may have rights to access, correct, delete, and port your data, and to opt out of targeted advertising, sale of personal data, and profiling. • Brazil (LGPD): You may have the right to access, correct, anonymize, block, or delete your data, and to obtain information about the entities with which your data has been shared. To exercise any of these rights, contact emberlitt1@gmail.com or emberlitt1@gmail.com. Emberlitt may need to verify your identity before acting on a request. Emberlitt will respond within the timeframes required by applicable law (typically 30–45 days, with extensions where permitted).

14. Children’s Privacy

Emberlitt is not for children under 13, and children under 13 may not use it. In some countries the minimum age to use online services on your own is higher (16 in some EU countries); if you are below that age where you live, you may not use Emberlitt. We ask for your date of birth when you sign up. Readers aged 13 to 17 have extra protections: • Their new passages are visible to Followers unless they change it. • They are never shown on the Find Readers map. • They are never suggested to readers they don't know, and they are not shown suggestions of readers they don't know. If Emberlitt learns that it collected personal data from a child below the applicable minimum age, Emberlitt will delete the account and its data.

15. Third-Party Services

Emberlitt relies on Google Firebase and Google Cloud, Apple platform services (including Sign in with Apple, push notifications, Apple Intelligence, and speech recognition), and Google Sign-In. To find and download free books and audiobooks, the app contacts these sources directly: Project Gutenberg (and the Gutendex catalog), Standard Ebooks, LibriVox, the Internet Archive, and Open Library (book details and covers). They see your IP address and what you look up or download, and they handle that under their own policies. Links that open other websites, such as a bookstore, are governed by those websites' policies. Providers that act as independent controllers process data under their own privacy terms.

16. Changes and Contact

Emberlitt may update this Privacy Policy. If Emberlitt makes material changes, the effective date will be updated and additional notice will be provided where required, including through the app or by email. Questions or requests: emberlitt1@gmail.com or emberlitt1@gmail.com Technical support: emberlitt1@gmail.com

17. Tracking Technologies and Analytics

Emberlitt uses Firebase Analytics to understand how readers use the app, together with Crashlytics (crash reports), Performance Monitoring (app speed and network performance), Remote Config (turning features on or off), and App Check (making sure requests come from the real app; on the website, App Check uses Google reCAPTCHA Enterprise). These tools collect app events, session information, and device information, and analytics are linked to your Emberlitt account ID. Other services built into Emberlitt: • Firebase Authentication, Google Sign-In, and Sign in with Apple (sign-in) • Cloud Firestore and Firebase Realtime Database (data storage and sync) • Cloud Storage (photos, voice notes, and uploaded books) • Firebase Cloud Messaging (push notifications) • Cloud Functions and Cloud Run (server-side processing, Today's pages, the Margin, and reader suggestions) • BigQuery (aggregated analytics) • Kingfisher and GRDB (image cache and local database, on your device only) Emberlitt does not use advertising SDKs, advertising cookies, or cross-site tracking pixels, and does not share data with ad networks or data brokers. The website does not use analytics or advertising cookies. If you want us to delete analytics data linked to your account, contact emberlitt1@gmail.com. Deleting your account also anonymizes it.

18. Data Breach Notification

In the event of a data breach that compromises the security or confidentiality of your personal information, Emberlitt will notify affected readers in accordance with applicable law, including the GDPR (within 72 hours to supervisory authorities where required) and applicable US state breach notification laws. Notification may be provided through the app, by email to the address associated with your account, or through other appropriate means. Emberlitt maintains reasonable security measures to protect personal data, including encryption of data in transit and at rest, access controls, and monitoring. However, no system is completely secure, and Emberlitt cannot guarantee absolute security.

19. Do Not Track

Emberlitt does not track you across other companies' apps or websites, so there is nothing for a browser's Do Not Track signal to turn off. Emberlitt does not respond to Do Not Track signals in a special way.

20. Data Processing Agreements

Emberlitt's main infrastructure providers, including Google LLC (Firebase, Cloud Functions, Cloud Run, BigQuery, Cloud Storage), are bound by data processing agreements that require them to process personal data only as directed and to maintain appropriate technical and organizational security measures.

21. Governing Law

This Privacy Policy and any disputes arising from it are governed by the laws of the State of Florida, United States, without regard to conflict of law principles, except where overridden by mandatory local privacy law (such as the GDPR for European Economic Area residents or the UK GDPR for United Kingdom residents).

22. Apple Platform Disclosures

Emberlitt is distributed through the Apple App Store and follows Apple's App Store Review Guidelines, including its privacy and data handling requirements. The data categories in Emberlitt's App Store privacy label reflect the data collection and use described in this Privacy Policy. Emberlitt does not track you across apps or websites owned by other companies, so it does not ask for permission through Apple's App Tracking Transparency prompt.