Storage, analytics and service providers
Operator: Ember Gaming LLC, 14534 S Abbott Rd E, Homer Glen, IL 60491, USA. Support: support@embercreator.com. Effective: November 15, 2026.
Cookies: Ember Links uses necessary cookies, for sign-in and session and for security (human check). It uses no advertising cookies. The signed-in dashboard's product analytics (PostHog) may set browser storage. Where the law requires consent, product analytics in the dashboard runs only after you agree. PostHog is not loaded on creators' public link-in-bio pages. Ember does not host or sell adult content.
Import disclosure update,2November2026: public source websites and their content/CDN hosts can receive the selected URL and server connection metadata during an authorized fetch. They are external recipients with their own practices, not automatically Ember-contracted subprocessors. Stored import reports, review choices and durable photo source-key bindings can retain identifying URL/query values. No final binding-retention schedule is accepted. The proposed isolated rendering runtime has no selected/activated provider or region; review its network/session/logging behavior and contracts before adding it as an actual service provider. Existing source transport does not reuse signed-in user browser profiles or forward Ember login credentials to imported sources. This is a technical draft disclosure, not a complete live inventory.
All cookies are first-party, Secure and HttpOnly. All except the referral cookie are host-only (`__Host-` prefix). No advertising or cross-site tracking cookies.
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
| `__Host-ember-customer-resume-0` / `-1` | Dashboard (app.emberlinks.bio) | Keeps you signed in when you reload; encrypted | Browser session; the stored sign-in is valid for at most 1 hour before it must be refreshed |
| `__Host-ember-oauth-pkce` | Dashboard | Protects Google sign-in against forgery | 10 minutes |
| `__Host-ember-signup-pkce` | Dashboard | Protects email sign-up confirmation | 10 minutes |
| `__Host-ember-password-recovery-pkce` | Dashboard | Protects password-reset links | 10 minutes |
| `__Host-ember-password-update` | Dashboard | Lets you set a new password after a reset link | Up to 5 minutes |
| `__Host-ember-verification` | Creator pages | Human check (when a creator turns on protection) | 10 minutes |
| `__Host-ember-page` | Creator pages | Remembers you passed a page's protection check | 10 minutes |
| `__Host-ember-analytics` | Creator pages | Visitor analytics session, set only after the visitor's consent where analytics consent is shown | 30 minutes |
| `ember_ref` | Dashboard; set only after a visitor opens a referral link (`/r/<code>`), never on other pages | Remembers which referral link brought you, so the referrer earns account credit if you start a paid plan. SameSite=Lax | 60 days |
Edge delivery (November 14, 2026): Cloudflare serves the dashboard's page frame from the location nearest to you. Account data stays in the United States. No new cookies and no new data are involved.
Browser storage (not cookies): localStorage `ember-theme` and `ember-sidebar` (dashboard display preferences, kept until you clear them); sessionStorage `ember-invite` (holds a team-invite code from an invite link until you sign in; cleared when the tab closes or when used). Cloudflare Turnstile may set its own strictly necessary data for the human check.
Before publishing, measure exact cookie/local-storage names, purposes, lifetimes and vendor settings on company, editor, creator, verification, OAuth and checkout flows. This register states intended/known roles, not a completed consent audit.
| Service | Role/data boundary | Current limitation |
|---|---|---|
| Cloudflare | Workers hosting; D1 database (stored in the United States); Email Sending for transactional email from no-reply@notify.emberlinks.bio; Turnstile human checks; Access for staff-only areas; custom hostnames and certificates; DNS/delivery, private R2, request security | Separate product terms and retention |
| Supabase | Accounts and sign-in: email/password and Google sign-in, two-step verification | United States (us-east-1, Northern Virginia) |
| Connected apps you choose (for example Claude by Anthropic, through MCP) | Read-only access you approve: your page list, drafts and analytics | The app and its provider are not Ember's processors; they act under their own terms. You can revoke each app under Connected apps. Ember stores only hashed tokens (1-hour access, 30-day renewal) |
| Sentry | Error monitoring with personal data scrubbed | No tokens/destinations/raw uploaded content; verify event payloads and retention |
| PostHog (US cloud) | Product analytics for the signed-in dashboard (app.emberlinks.bio) only: how creators use the dashboard. Separate Ember project, explicitly enabled product events. Not loaded on creators' public link-in-bio pages for their visitors | Optional analytics consent/opt-out, retention and actual browser storage inventory still to verify |
| Backblaze B2 | Selected destination for application-encrypted off-host backups | A retained source archive has recorded upload/readback verification; that does not prove current complete backup coverage, independent key retrieval, decryption, restore or an accepted lifecycle |
| Optional social-profile lookup candidate: SociaVault | Public Instagram handle and service credential; candidate profile ID/name/handle, avatar/bio addresses, follower count and observation metadata | Source integration is separately gated; no live provider/license/DPA/region/retention or follower-display acceptance inferred. No creator Instagram password is requested; the source does not explicitly copy visitor cookies or IP metadata into its outbound options. Live payload verification remains pending. Returned URLs are not permission to fetch/copy them. |
| Network-intelligence service, unselected | A future approved service might classify visitor network addresses for protection | A local IPinfo response decoder is not an activated processor. Visitor-IP transfer, provider selection/license, purpose/basis, current classification, outage handling and retention require review before activation. No active vendor or IP transfer is asserted here. |
| Stripe | Payments, Checkout, Customer Portal, invoices | Card details are entered with Stripe; Ember keeps references and status, not card numbers |
| Domain-health checks | Only the domain name being checked is sent to Google Web Risk, abuse.ch (URLhaus, ThreatFox), Quad9, Norton Safe Web and Cloudflare DNS security filters | No personal data or visitor data, cookies, photos or destination links are sent. Each provider handles the lookup under its own terms and may log lookups (links below) |
| Cloudflare Email Sending | Service emails from notify.emberlinks.bio: closure receipt, data-download notice, domain-flag alert, free-trial reminder, team invitation | Recipient address and message text only; no marketing email |
| Registrar/support | Domain purchase/renewal or support messages requested by user | Exact providers, DPAs and retention not final |
Necessary storage may support authenticated sessions, verification/abuse prevention and the explicitly requested service. Explain it even where consent exemption is available. Optional product/marketing analytics must have a separate, meaningful choice where required; rejection should be as easy as acceptance, and consent withdrawal accessible later. Do not load optional tracking until a valid applicable choice. Cookieless does not automatically mean anonymous or exempt. Security telemetry must be minimized and not repurposed into advertising profiles.
Before release inventory every relevant origin/hostname, classify each storage/event, measure expiry, separate security and analytics, verify payload redaction and vendor contracts, and implement necessary/optional controls. Specify data location and international-transfer safeguards rather than claiming all data stays in one country. Log versioned consent without tracking a visitor across unrelated creator pages. No ad pixels, sale/share or cross-site retargeting is proposed in this initial pack.
Domain-health checks (updated November 13, 2026): the Google Web Risk lookup sends only a company-owned or verified customer hostname's HTTPS root URL to Google, with the service credential in a header. It sends no visitor session or cookie, creator photo or destination links. The other listed checkers receive only domain names. See docs/WEB-RISK-ACTIVATION.md.
Domain-health check providers: Ember sends only the domain name being checked. It sends no personal data and no visitor data. Each provider processes the lookup under its own terms and may log lookups. The providers are Google Web Risk ([Google Cloud terms](https://cloud.google.com/terms) and [Google privacy policy](https://policies.google.com/privacy)); abuse.ch for URLhaus and ThreatFox ([terms of use](https://abuse.ch/terms-of-use/)); Quad9 ([privacy policy](https://quad9.net/privacy/policy/)); Norton Safe Web ([Gen privacy](https://www.gen.com/privacy)); and Cloudflare DNS security filters ([Cloudflare privacy policy](https://www.cloudflare.com/privacypolicy/)). Ember keeps the latest scan result for each domain until the domain is removed or the account closes, including the date the domain was first flagged, which is kept with that scan result. Daily scan-usage counts are kept for 7 days. The email address used for flag alerts and free-trial reminders is kept until it changes, stops being verified, or the account closes.
Customer dashboard storage — source inventory, not a live cookie audit
| Mechanism | Source purpose/data | Persistence and limitation |
|---|---|---|
| localStorage `ember-links.customer.navigation-collapsed.v1` | Collapsed/expanded sidebar preference, boolean text | Source sets no expiry; browser/site-data controls determine removal. Not a login token or analytics identifier. |
| sessionStorage `ember-links.closure.pending.v1` | Bounded workspace/operation identifiers used to reconcile an uncertain closure request or cancellation | Tab-scoped storage; source intentionally preserves an unresolved operation across sign-out/reload for review. It contains no password, session token, backup key or deletion approval. Actual browser lifecycle behavior still requires verification. |
| In-memory Blob URLs | Explicitly prepared page-history/API-access JSON or original-photo download | Source revokes references on relevant cancellation/workspace/session cleanup. No saved file is claimed until the user downloads it; the resulting device file has its own custody. Browser/saved-file acceptance remains pending. |
This list covers these source consumers only. It does not inventory Access cookies, Supabase/OAuth state, visitor proof/consent storage, provider checkout or every origin. It does not establish a legal consent exemption. Complete the per-origin live audit and expiry/withdrawal tests before publication. Optional analytics must not use the navigation preference or recovery journal as a cross-page visitor identifier.
28 October source-only local comparison note: the disabled media review feature can read a user-selected file under15MB and compute its SHA-256 in browser memory, comparing it with proposed metadata. That comparison does not upload the bytes or filename, decode/validate an image or confirm rights. The native chooser may display the selected filename locally. Cancellation fences result handling; browser read/hash work may complete afterward. Verify actual browser behavior before publishing this disclosure or enabling the feature.
Questions about this policy: support@embercreator.com.