EMBARK Privacy Policy

Effective November 2, 2026.

EMBARK ("we", "us") is a discipline app with a built-in coach called ONYX. You add tasks, your phone's data checks the ones it can, and on Plus and Pro a task you chose to lock your apps with locks them the next day if it isn't done by midnight. This policy explains, in plain words, what we collect, why, who else handles it, and how you remove it. It is published by Aryeh Zaghi. Questions: embarkteam.app@gmail.com.

The short version

• We collect what it takes to hold you to your own tasks, and nothing for advertising. No ads, no selling your data, no ad or outside analytics tools. The few counts we keep to see what works stay on our own server (section 7).
• Phone data (steps, sleep, workouts, floors, meditation, distance, screen time) is read only for tasks that need it, only after you say yes, and only the number leaves your phone. Weight, calorie and food goals are off unless an adult turns them on, and only you see those numbers, unless you let ONYX see your weight to coach you.
• ONYX is an AI coach, not a person. Its replies are written by Anthropic's AI, and we ask your OK before your first chat.
• ONYX remembers your habits and slips from your first chat unless you turn ONYX memory off; a notice tells you then, and nothing is kept before it. See, edit or delete every note, or turn it off, anytime (section 3).
• Your voice turns into text on your phone, in the chat and on an ONYX Live call. EMBARK never records it and it never reaches us.
• Faith, observance and health details are kept only if you choose to share them, and you can delete them any time.
• You can erase your data or delete your account from Settings, or ask us on the web.

1. Your account

• What: your email address, a password (stored only as a one-way hash, never readable), or the sign-in you used (Google or Apple: we receive your email, your name if you share it, and an ID that tells us it's you). Your username, the time you created the account and last signed in.
• What you agreed to: we record which version of the Terms and this Privacy Policy you agreed to, and when.
• Sessions: when you sign in, we keep a hashed session key, the time it was made and last used, and the short device description the app sends (its "user agent"), so you can stay signed in and we can end sessions you don't recognise.
• This phone: a random ID made by EMBARK when it's installed. It lets us keep one person's lock from being escaped by signing into a second account on the same phone. It isn't your phone's advertising ID or serial number.
• Emails: we send sign-in codes and account emails (for example, to confirm your address or reset your password) to the address on your account.

2. Your tasks, day and plan

• Your tasks (what, the target, the time, how it's checked, whether it locks your apps) and whether each was done, not done or unchecked. Promises made before this change are kept the same way until they finish.
• Your schedule and tasks, synced so they're on every phone you sign into.
• Your plan (for example "less scrolling") and its weekly results.
• Emergency passes you used, your streak and your score.
• Your notification choices (quiet hours, brief time, which reminders).
• Your subscription status (active, trial, ended) from Google Play or the App Store, never your card. When you start a free trial, our payments provider (RevenueCat) also keeps which version of the trial terms you saw and when you tapped, as a record of what you agreed to.
• Home-screen widgets show this on your phone; with Private widgets on, they show only numbers and times.
• Tools ONYX adds to Progress (only if you ask for one): when ONYX builds a tool for your goal, your goal's words go to Anthropic to build it. We keep each tool's setup, like its name and type. What you log, tick or write in it stays on your phone.

3. ONYX, your coach

• ONYX is an AI. It isn't a person. The chat says so with an AI coach tag and a reminder, and before your first chat we ask your OK, once, to send what you tell ONYX to our AI provider (section 8).
• Conversations: what you and ONYX say to each other is stored so the chat is there on every phone and ONYX can keep context.
• What ONYX knows: short notes ONYX keeps about you while ONYX remembers is on, which it is from your first chat unless you turn it off (see ONYX memory below). You can see, edit and delete each one in Settings > About you > What ONYX knows about you.
• What ONYX never saves: crisis or self-harm, health details (a condition, an injury, a pregnancy, a sleep problem, sobriety, treatment), medications, eating, weight or your body, your faith or observance beyond your protected-time settings, sex life or orientation, race, citizenship, your precise location or address, calendar event names, what's in a photo or file, financial details, or private details about other people beyond a first name and how you know them. If the model tries, our server drops it, and the same filter applies to notes you add or edit.
• Your life: your wake and sleep times, the week you describe (work, school, family time), and the rules you set. Kept to plan your days around your real life.
• Protected time: the times nothing may lock or be due (a day of rest, prayer times, fasting, holidays, family time). If you want sun-based times (like sunset), you type a city or coordinates; we store that place and your timezone. We never use your phone's GPS.
• Faith and observance: only if you choose to tell EMBARK, only after you opt in, never guessed from chat, never used for anything but protecting that time, and deletable in Settings > About you.
• Photos and files you show ONYX (Pro, optional): when you tap + in the chat and take a photo, pick one or pick a PDF, it goes to our AI provider, Anthropic, to answer that one message. Before your first one we ask your OK, once. EMBARK doesn't keep the photo or file after the reply; the chat only shows that you sent one. Anthropic deletes what it receives within 30 days by default and doesn't train on it. A photo or file in the chat is never proof that you did a task (challenge proof is separate: see section 6), and ONYX never comments on your body or looks, never estimates food amounts, and never identifies people.
• ONYX's photo check of a task: when ONYX checks a task from a photo, you take it with the camera when the task is done. It goes to Anthropic for that one check; EMBARK keeps only whether it counted, and Anthropic deletes it within 30 days.
• ONYX Live (Pro, optional). During a Live call your phone turns your speech into text on the phone; your voice is never recorded, saved or sent. The text of the call, and any camera or screen pictures you share, go to ONYX's AI provider, Anthropic, to answer you. While your camera is on, ONYX sees a picture every few seconds and when you talk. For a form check it also gets a few frames and your body's joint positions for that set. Screen pictures are taken only when you talk or ask ONYX to look. Pictures are never kept by EMBARK and are never used as proof; Anthropic deletes them within 30 days and never trains on them. The words of the call are kept as your ONYX chat, which you can delete anytime. At the end of a call, ONYX saves a short recap in your ONYX chat. With 'ONYX remembers' on, ONYX can use it in later chats and calls. Delete it anytime. Screen sharing shows ONYX whatever is on the shared screen, including notifications and other people's messages, so share one app and stop before opening anything private. A call keeps going if you switch apps, with a notification you can use to mute or end it. Live mutes itself during phone calls.
• Share to ONYX (paid plans, optional). When you share text, a picture or a file from another app to ONYX and tap Send, it goes to ONYX's AI provider, Anthropic, to answer that message. EMBARK doesn't keep shared pictures, files or text after the reply; your chat shows a placeholder instead. Shared content may include other people's messages: EMBARK uses them only for that reply and never saves or remembers them. Anthropic deletes inputs within 30 days and never trains on them.
• ONYX in your notifications (Pro, Android, optional). ONYX's messages can appear in your phone's notifications. Their text is hidden on the lock screen unless you choose to show it. If you turn on replying from notifications, what you type there is sent to ONYX the same way as in the chat, and your phone has to be unlocked to reply. EMBARK keeps the last few lines of that conversation on your phone only while it shows, and removes them when you swipe it away, clear your chat, sign out or erase your data.
• Costs: for each call to the AI model we log the purpose, the size and the cost, not the content, to keep ONYX affordable.

ONYX memory

• What's kept: with ONYX remembers on (on from your first chat, when a notice tells you; nothing is kept before it, and you can turn it off there or anytime after), short notes about your habits: the rules you set, reasons you gave for an unfinished task, wins, first names of people in your week, facts that shape your plans, and patterns EMBARK learns each night from your done and unfinished tasks (for example the hour you slip most, or the kind of task you finish). If you've connected health data, a pattern can come from it ("Finishes steps tasks: 9 of the last 10"), never the daily numbers themselves.
• Why: so ONYX can coach you better: plan at times that work for you and name an excuse you keep giving. Memory never makes a lock, a consequence or a target stricter on its own; only a task you chose to lock can.
• What works for most people: with ONYX remembers on (adults only), when ONYX helps you with a problem with a task, it notes the kind of problem and the kind of advice from a fixed list (for example "putting a task off" and "one small first step"), never your words. That note stays on your account for up to 4 days, until EMBARK sees whether your tasks in the next day and a half got done. Then it only adds one to two shared counts (how often that advice was followed by tasks getting done), with no account or words attached, and is deleted from your account. ONYX reads those counts to coach everyone better.
• Your choice: before your first chat we ask you once, and it stays off unless you turn it on. With it off, nothing new is kept, nothing is learned, and what's stored isn't sent to our AI provider. Turn it on or off anytime in Settings > About you > What ONYX knows about you.
• Where, and who receives it: stored on EMBARK's servers (TiDB Cloud, encrypted at rest) and sent to ONYX's AI provider, Anthropic, with your chats, to write ONYX's replies. Never sold, never used for ads, and never used to train AI.
• See, edit or delete: every note is on What ONYX knows about you, with its date and how many times it came up; nothing ONYX uses is hidden. Edit or delete any note, tap Delete all, or Share a copy. Deleting your account deletes all of it.
• How long: a note unused for 12 months is deleted automatically. A note you delete is gone from our database at once and from our backups within 30 days.

Safety

• Crisis. If something you write suggests you may be in crisis, ONYX points you to real help and stops pushing. EMBARK notes the date that this happened (not what you wrote) so nothing locks and no pressure is added for a while.
• Eating. If a message suggests an eating-disorder risk, ONYX stops suggesting food goals for that chat. This is not saved to your account. If you turned on weight, calorie and food goals, they pause too, for 14 days, and one that isn't done doesn't lock your apps; for that we save only the date the pause ends.
• Reporting ONYX. Every ONYX reply has a Report button. Reports go to a person on our team (the founder) and are reviewed within 7 days; reported replies are kept for review and deleted after.

4. Data from your phone

EMBARK reads phone data only to check tasks you added. Only the resulting number leaves your phone.

• Steps and sleep (Android: Health Connect; iPhone: the Health app): the total steps from midnight to a task's time, and the hours asleep the night before. Read only; EMBARK never writes health data. Read only on days you have such a task, at most 7 days back. With your permission, also while EMBARK is closed. Stored: one number per source per day. Section 5 says exactly how these numbers are used.
• Workouts, floors and meditation (Android: Health Connect; iPhone: the Health app): the minutes of exercise logged by any app that shares with your phone's health data (a gym log, a running app, your watch), the floors you climbed, and the minutes of meditation, each from midnight to a task's time. Only the total: never routes or locations, heart rate, calories or any notes. The kind of session (running, strength training) is read only for Let ONYX see my past data. Each one is read only after you say yes to that type, and only on days you have a task that uses it, at most 7 days back. Workouts typed in by hand don't count as proof. Stored: one number per source per day.
• Distance (Health Connect on Android, the Health app on iPhone): the day's total distance you walked, ran or rolled (a wheelchair push counts), from midnight to a task's time, only after you say yes to distance, asked the first time you add a distance task, and only on days you have one. Only the day's total: never routes, pace, maps or places. Distance typed in by hand doesn't count as proof. Stored: one number per day. It's shown in kilometers or miles, as you choose in Settings > Units. EMBARK never reads body measurements, heart rate, blood pressure, cycle tracking or any medical record, and reads weight, calories and nutrition only as the next point says.
• Weight, calories and food (Android: Health Connect; iPhone: the Health app, except meals logged, which are Android only; off unless you turn it on, adults only): with Settings > Weight, calories and food on, and only for a task that needs it: the active calories you burned from midnight to the deadline (never calories eaten; entries typed in by hand don't count); whether you weighed in that day (EMBARK looks at the weight on your phone to see that one was recorded; the weight itself leaves your phone only if you turn on Let ONYX see my weight, section 5); and, from the food you log in a nutrition app, how many meals you logged and your grams of protein (never calories eaten, other nutrients or what you ate). Each type is read only after you say yes to it. Stored: one number per source per day (for a weigh-in, 1 or 0). These numbers are yours alone: they never go to friends, widgets or notifications, and never to ONYX or Anthropic, except your weigh-ins if you turn on Let ONYX see my weight. Turning it off deletes them.
• ONYX sees your day (only if you turn it on): with this switch on (Settings > Proof sources), your phone also sends today's total for each health type you've connected (steps, hours slept, minutes of exercise, floors, minutes of meditation), even on days no task uses it, and ONYX sees today's and the last 2 weeks' totals (this week against the week before), so it can coach the whole picture and tell you when you're slipping. These totals never decide a task. Turning the switch off stops it and deletes the totals EMBARK kept.
• Let ONYX see my past data (only if you turn it on): with this switch on (Settings > Proof sources), your phone reads up to the last 90 days of the health types you've connected (steps; sleep, including sleep stages, bed and wake times and wake-ups; workouts and their type; floors; meditation; daily distance, never routes or places) and sums them up on your phone, for example "last 30 days: 6.1 hours of sleep a night, 3 workouts a week". Only that summary goes to ONYX with your messages (section 8). The daily records stay on your phone, and EMBARK's server doesn't store the summary. Past data never decides a task. Turning the switch off stops it at once.
• Health Connect: EMBARK's use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.
• Screen time (Android: Usage Access): the minutes you spent on the apps named in a screen-time task or a daily limit, and, for a pickups task, how many times that day your screen came on and an app was opened (one number; never which apps). The app list and the usage of every other app stay on your phone.
• Screen time (iPhone: Screen Time): iPhone never tells EMBARK which apps you picked or how long you used them. It only says "these apps reached N minutes", and that is all EMBARK keeps.
• App locking (Android: Accessibility): EMBARK uses Accessibility to lock the apps you choose. They lock, for example, after an unfinished task you chose to lock. Locking starts only after your one-time yes, and you can turn it off in Locks. It only looks at which app is on screen, on your phone, so it can send you home from a locked app. Beyond that it never reads what's on your screen (except the two switches you turn on yourself: Website blocking and Stop me turning EMBARK off, below), never records anything, and nothing from it leaves your phone.
• Stop me turning EMBARK off (Android, only if you turn it on): during a lock with no passes left, EMBARK reads the titles of Settings pages and the uninstall box, only to spot its own off switch and its uninstall box. Nothing it reads is kept or sent.
• Whether locking is on: if you turn off app locking, Usage Access or Screen Time, or change the phone's clock, EMBARK notes the day it happened. On Android, EMBARK also notes when locked apps were used during a lock, or when its lock was stopped while you were using your phone (for example by starting the phone in safe mode or force-stopping EMBARK). To tell, your phone sends how many minutes the locked apps were open during a lock, and when the screen was last turned on and an app last opened, never which apps. It's allowed; it counts as unchecked. During a lock, EMBARK checks your phone's app-usage history to see whether locked apps were used, only to apply that lock's rules.
• Your voice: when you hold the mic, your phone's own speech recognizer turns what you say into words, offline on your phone. If your phone doesn't have its offline speech pack yet, EMBARK asks you to download it and the mic stays off until you do; EMBARK never sends your voice online instead. EMBARK gets only the words, like a typed message. No recording is made, and your voice never leaves your phone. When ONYX reads a reply aloud in a natural voice, your phone sends that reply's text back to our server to work out how to say it. Our server doesn't store or log it. On a Live call, that reply's text also goes to our voice service, which has its own retention (section 8).
• Your calendar (only if you turn it on): with Settings > Your calendar on, EMBARK reads the events in the calendars you pick (Google, Outlook, Samsung or iCloud, whatever your phone syncs), today and the next two weeks, to show them in your day and keep your plan clear of them. Only each event's name, time and whether it's marked free; never notes, guests or places. The events stay on your phone. EMBARK changes or deletes an event in your phone's calendar only when you tap Save or Delete on it. Your calendar app syncs that change as usual. EMBARK's servers never see it. Marking an event done stays in EMBARK on your phone. With a second switch, Let ONYX plan around them, the times of your events go with your messages to ONYX (section 8) as busy time, so it never plans over them. Event names go too only with a third switch, Send event titles to ONYX, off until you turn it on, because a name can mention an appointment or a person; events you marked private stay "Busy" either way. ONYX treats a health appointment as busy time only and never remembers it. Times and names are used for that reply and not kept on our server; Anthropic deletes what it receives within 30 days by default. Turning any switch off stops it.
• Your app time (only if you turn it on): EMBARK already reads how long each app was open (usage access) to run your locks. Your day uses it on your phone to show which apps took your time; that stays on your phone. With Let ONYX see your app time on (off until you turn it on), how many minutes you spent in each app each day, for up to the last 7 days, goes with your messages to ONYX (section 8), so it can tell you where your time goes. Never what you did inside an app, never the time of day, never your notifications. Apps that could reveal your health, faith, dating or sexuality are grouped as "Other" unless you choose to show one by name. Worked out on your phone; used for that reply and not kept on our server; Anthropic deletes what it receives within 30 days by default. Turn it off anytime in Your day.
• AI apps you connect (only if you connect one): in Settings > AI assistants you can connect an AI app (ChatGPT, Claude, Manus or another). It then sees your task titles, days, times and done marks, and can add tasks; it can never tick, change or delete them, and never sees your messages with ONYX, your health data or your locks. Remove it any time on the same screen, and it loses access at once.
• ONYX's plan in your calendar (only if you turn it on): If you turn on 'Add ONYX's plan to my calendar', EMBARK adds the blocks you approve to the calendar you pick on your phone. If that calendar syncs to a service like Google or Samsung, the blocks go to that service under its own privacy policy, and people you share that calendar with can see them. EMBARK only changes or removes events it added, and only after you tap to confirm. Blocks stay in your calendar if you uninstall EMBARK.
• Saved places (optional): if you start a routine by arriving at a place, EMBARK checks your phone's location in the background, even when EMBARK is closed, only to tell when you reach or leave a place you saved. Your location and your saved places never leave your phone. Remove a place or turn this off anytime in Settings. When you arrive, your phone tells our server only that the routine started, never where you are, and our server deletes that run as soon as it ends (when you leave, or at its time limit), so EMBARK keeps no history of when you were anywhere. A place is erased from your phone when you remove its routine or sign out. Looking up an address you type uses your phone's own map service. With location off, the routine still starts when you tap Start.
• Notes on a locked app (only if you write one): what you type on the locked screen about why you opened an app, up to 1,000 characters a note, with the app's name. It's saved to your account so it's there on any phone you sign into. It's never sent to ONYX, never shown on your phone's lock screen or in a notification, and never counts as proof. Signing out removes them from that phone; deleting a note removes it from your account and every phone.
• Your notebook (only if you write in it): notes you write in the Notebook are saved to your account, so they come back on a new phone or after you reinstall EMBARK, with a copy on your phone so they open without a connection. Only you see them: they're never sent to ONYX or Anthropic, never shown to friends, on a widget, your lock screen or in a notification, never used for ads, and never count as proof. Signing out keeps the copy on that phone for when you sign back in (no other account can open it). Deleting a note removes its words from your account and every phone you use; deleting your account erases them all.
• Your profile picture (only if you add one): a small, square copy of the photo you pick stays on your phone and shows only in your own account circle. It's never uploaded, so we, ONYX and your friends never see it. Location and other details stored inside the photo aren't kept. Removing the photo or deleting your account erases it.
• Your daily progress photo (only if you take one): your daily progress photo stays on your phone. It's never uploaded, so we, ONYX and your friends never see it. Deleting it, or your account, erases it.
• Website blocking (optional): if you turn it on, EMBARK reads the site name in supported browsers while a lock that blocks websites is on, only to block the sites you chose: the websites of locked apps, sites you name and types of sites. This happens on your phone; the address you visit is never saved or sent to us or anyone. The lists of site types are built into the app.
• Move to unlock (Pro, Android, only if you set it up): your camera counts your reps on your phone. Only your body's joint positions are read, never your face, and nothing is recorded, saved or sent: no picture or video, no count, no exercise. Which exercise you picked, your reps and your other way out stay on your phone, and are never sent to us or to ONYX. A second way out is checked on the phone too (your phone's own steps or app-use data). It's erased when you turn it off and its lock ends, or when you sign out.
• Notifications: a push token from your phone's system, so we can send ONYX's warnings, verdicts and lock notices.
• Photos and files: only the one photo or PDF you pick yourself, through your phone's own picker, when you tap + in ONYX's chat (section 3). EMBARK can't see the rest of your photos or files.
• The camera: when you tap Take photo in ONYX's +, for that one picture; when ONYX checks a task from a photo (section 3); for your daily progress photo, which stays on your phone (above); on an ONYX Live call (above); and for Move to unlock, where nothing leaves your phone (above). A Take photo picture is handled like any photo you send ONYX: it goes to Anthropic to answer you, EMBARK doesn't keep it, and Anthropic deletes it within 30 days.
• Find friends from contacts (only if you tap it): your phone turns the email addresses and phone numbers in your contacts into scrambled codes and sends only those codes to check which belong to people who chose to be findable. A scrambled code made from a phone number can be worked back to the number, so we treat the codes as personal information: we use them only for that check, in memory, and don't store your contacts or the codes, and we never contact or text anyone in them. You can be found this way only if you turn on Let people who have my email find me or Let people who have my number find me.
• Nothing else: EMBARK doesn't access your messages, calls or advertising ID, reads your contacts only when you tap Find friends from contacts (above), and uses your location only for a routine's place, as above.

5. Health data (steps, sleep, workouts, floors, meditation, distance; weight, calories and food if you turn them on)

• Only after you say yes. EMBARK reads each type from Health Connect or the Health app only after you agree to that type in the app, and you can turn it off any time in Settings > Proof sources or your phone's settings.
• What it's for: checking the tasks you added, and letting ONYX coach you. ONYX sees the numbers (except weight, calorie and food numbers: see below) (for example, "6,200 steps by 7:00 PM" or "35 minutes of exercise"), so they're sent to Anthropic to write ONYX's reply. Anthropic doesn't train its models on them. If you turn on ONYX sees your day, ONYX also sees today's totals when no task uses them. If you turn on Let ONYX see my past data, ONYX also sees a summary of up to your last 90 days, built on your phone (section 4).
• Never on your lock screen by default. Notifications don't show your health numbers unless you turn that on.
• Never shown to friends. Friends see only whether a task was done or not, never the numbers.
• Weight, calories and food are private, and only goals to reach. They're off until you, an adult, turn them on in Settings with a separate yes and a risk acknowledgment. Only you see their numbers: ONYX sees only that such a task exists and whether it was done, unless you turn on Let ONYX see my weight. Then your phone sends your weigh-ins from the last 90 days with your messages, so ONYX can coach you on the weight goal you set. They go to Anthropic for that reply; EMBARK doesn't store them and ONYX never remembers them. If food or your body seems to be weighing on you, this pauses for 14 days. Friends, widgets and notifications never see them. They're only ever goals to reach (active calories burned, up to 1,000 a day; a weigh-in; grams of protein, meals logged, servings of vegetables or fruit), never a limit, calories eaten or a weight to reach, and nothing ever locks over a weigh-in. If what you tell ONYX suggests food or your body is weighing on you, these goals may pause on their own and one that isn't done doesn't lock your apps. We save only the date these goals are paused until (14 days), nothing about what you wrote; turning the setting off or deleting your account erases it.
• Never sold, never used for ads, and never shared with anyone except the services in section 8 that run EMBARK for us.
• Deletable any time: Erase my data or Delete account (section 9) removes them.

If you live in Washington, Nevada or Connecticut, section 14 is our Consumer Health Data Privacy Policy.

6. Friends and challenges

• Your username, and who can find you by it (Settings > Who can find me). A new account can be found only by people you share your invite code with, until you change Who can find me.
• Friends you add, invite codes, challenges you join, and nudges you send.
• Friends see your rank, score and streak, and whether your tasks were done or not (today and the last 7 days). Never what the task was, your step or sleep numbers, your tasks, chat, email or phone number.
• Challenges: for a challenge with its own goal we store, for each day, whether it counted, whether your phone or ONYX checked it, and, for a phone-checked day, the day's number. Your friends see only whether your day counted (and whether the phone or ONYX checked it), never the number. For a screen-time challenge, the apps you pick stay with you: no one else sees them. Leaving a challenge deletes your days and apps in it.
• Challenge proof (optional): when you send ONYX proof for a challenge day (a few words, and on Pro a photo), it goes to our AI provider, Anthropic, for that one check and isn't kept by EMBARK; only whether the day counted is stored. If you tap Report this result, we keep only the yes or no and the time.
• The world leaderboard shows your username, rank and streak only if you turn it on.
• Let people who have my email find me (Settings > Who can find me, off until you turn it on): we keep a keyed, scrambled code made from your email, only while it's on, so friends who have your email in their contacts can find your username. Turning it off, changing your email, choosing Nobody or deleting your account removes it at once.
• Let people who have my number find me (Settings > Who can find me, off until you turn it on, separate from the email switch): you give us your phone number so we can text you a code to confirm it's yours. We send the number to our texting provider only to deliver that code, and we don't keep the number itself: we keep a keyed, scrambled code made from it, only while the switch is on, so friends who have your number in their contacts can find your username. They never see your number. We ask you to confirm the number again once a year, since numbers get passed to new people. Turning it off, choosing Nobody, your plan ending or deleting your account removes it at once.
• If you block or report someone, we keep the block and the report (with the reason you gave) to act on it.

7. How we count what works

We count a few things ourselves, on our own server, to see what works and fix what doesn't:

• Sign-up steps: a random install ID made by EMBARK and the step reached (the app opened for the first time, an account made, the subscription screen seen, a permission turned on, a trial started or ended).
• Active days: which days you opened the app. A date, nothing else.
• Where you came from: a creator code you typed at sign-up, and on Android, Google Play's install referrer (which link or creator brought you).
• Why you cancelled: the reason you pick, only if you choose to give one.

There are no ad SDKs and no third-party analytics SDKs in EMBARK. These counts are never sold, never used for ads, and never contain health data or anything from your chat.

8. Who else handles it

We don't sell or share your data with anyone for their own use. These services process it for us, only to run EMBARK, under contract (Cartesia's own terms are described in its entry below). Your data is stored in the United States.

• AI model provider: Anthropic (its Claude models write ONYX's replies): it receives what ONYX needs for one reply (your message, any photo or file you chose to send with it, recent chat, your notes, your day, your tasks for that day, your calendar events' names and times if you let ONYX plan around them, and the health numbers for your tasks: steps, sleep, workout, floors, meditation or distance; a summary of your last 90 days of health data, only if you turned on Let ONYX see my past data; your weigh-ins, only if you turned on Let ONYX see my weight) and returns the reply. We use Anthropic's paid business service, under which your content isn't used to train its models. No other AI company receives your data, except the voice service below, which gets only ONYX's replies.
• Database host (TiDB Cloud): stores the data in this policy, encrypted at rest.
• Server hosting (our cloud host, Railway): runs EMBARK's server.
• Backups (Backblaze B2): stores our encrypted nightly backups (section 9).
• Push delivery (Expo's push service, then Firebase Cloud Messaging from Google on Android and Apple Push Notification service on iPhone): delivers notifications.
• Email (Resend): sends sign-in codes and account emails. It receives your email address and the message.
• Texts (Twilio): sends the code that confirms your phone number when you turn on Let people who have my number find me. It receives your number and the code, nothing else.
• App updates (Expo's EAS Update): your phone checks it for new versions of the app. It sees your phone's internet address and app version, nothing from your account.
• Natural voice (Cartesia): when ONYX speaks to you in its natural voice on a Live call, the text of ONYX's replies (never your voice or your own words) goes to Cartesia to be turned into speech, with no name, email or account number. We have turned off Cartesia's use of our text to train its models. Cartesia keeps the text until we ask it to delete it, and its staff may see it only to run and support its service. There is no separate switch for it: if you'd rather not have it, don't use Live calls (ONYX's chat replies are never sent to Cartesia).
• Voice files (GitHub): if you turn on a natural voice, your phone downloads it (about 177 MB) from GitHub, which sees your phone's internet address like any website you visit. GitHub's own privacy statement applies; we send it nothing about you.
• Sign-in (Google, Apple): confirms it's you when you choose them.
• App stores and payments (Google Play billing, the App Store): handle purchases. We never see your card.
• Subscriptions (RevenueCat): keeps track of your subscription. It receives your EMBARK account number (not your email) and your purchases from the store, so we know whether your subscription is active.

When we fix problems: an AI coding tool (Anthropic's Claude, under a commercial agreement) may process data when we fix problems, for example a record that's causing a bug.

We may disclose data if the law requires it, to protect someone's safety, or to a buyer if EMBARK is sold (they'd be bound by this policy).

9. How long we keep it

• As long as your account exists, unless you erase it sooner.
• Erase my data (Settings) removes your schedule, ONYX chat, ONYX's notes (except your rules), phone readings, plan, past tasks and streak from your phone and our server, and turns off being found by email or number. Your account and your rules stay. So erasing never undoes what is running: today's locking tasks, a lock that's on, the passes you used this month and a crisis-safety pause from the last two days stay too.
• ONYX memory: each note until you delete it or it goes unused for 12 months, then deleted; out of our backups 30 days after that.
• Delete account (Settings) removes everything tied to your account, including ONYX's notes and memory, and signs you out everywhere. If you used Sign in with Apple, we also tell Apple to disconnect EMBARK.
• Voice recordings: never made by EMBARK. The text of ONYX's replies sent to our voice service (Cartesia) for speech on a Live call is kept by Cartesia until we ask it to delete it. Sessions: end when you sign out or after they expire.
• Backups: our nightly backups are encrypted, kept 30 days, then deleted. Our database host's own backups are also kept no more than 30 days. After that, deleted data is gone from them too.

10. Your choices and rights

• See and change most of it in the app: Settings > Profile, About you (with What ONYX knows about you, where you can also turn ONYX memory off or share a copy), Proof sources, Notifications, Who can find me.
• Turn off any phone permission in your phone's settings. If a task your phone checks can't be checked because access is off or EMBARK was stopped, it counts as not done, and a task that locks your apps locks them the next day. If something went wrong, you can explain it to ONYX from the lock screen.
• Delete your account in the app, or at https://joinembark.app/delete-account if you can't sign in.
• Ask for a copy of your data, a correction, or anything else about your data at embarkteam.app@gmail.com. We answer within 30 days. Depending on where you live (for example California or another US state), you have rights to access, correct, delete and move your data and to object; we honour them for everyone.
• If we turn down a request, you can appeal by replying to our answer. We answer an appeal within 45 days, and if you're still not satisfied you can contact your state's attorney general.

11. Age: adults only

EMBARK is for people 18 and older. At sign-up we ask your birthday to check this; we don't save the birthday, only the fact that the account was made by an adult. On phones that support it, EMBARK also asks Google Play or the App Store for the age range they already know (Google Play Age Signals, Apple's Declared Age Range). We use that answer only to check age, keep only whether it said adult or not, and it never leaves your phone. If it says you're under 18, EMBARK doesn't make an account, or pauses an existing one. We don't knowingly collect data from anyone under 18. If you believe someone under 18 has an account, write to embarkteam.app@gmail.com and we'll delete it.

12. Security

Passwords are stored as one-way hashes, session keys are hashed, data travels encrypted, backups are encrypted, and every request is limited to your own data. Sign-in attempts are rate-limited. No system is perfectly secure; if something happens that puts your data at risk, we'll tell you.

13. Changes

If we change this policy, we'll update the date at the top and tell you in the app before the change matters to you.

14. Consumer Health Data Privacy Policy (Washington, Nevada, Connecticut)

This section is our Consumer Health Data Privacy Policy under Washington's My Health My Data Act, Nevada's SB 370, Connecticut's law, and similar laws.

• What we collect: daily step totals, hours asleep, minutes of exercise, floors climbed, minutes of meditation and the day's total distance (never routes, pace or places) from Health Connect or the Health app; only if you turn it on, active calories burned, whether you weighed in (your weight itself goes to Anthropic only if you turn on Let ONYX see my weight, and we don't store it), meals logged and grams of protein; with Let ONYX see my past data on, sleep stages, bed and wake times and workout types, summed up on your phone and sent to Anthropic for a reply, not stored; whether each task that uses them was done or not, the date a crisis-safety pause started (not what you wrote), and, if you turned on weight, calorie and food goals, the date a pause of those goals ends (not what you wrote), and, with Let ONYX see my past data on, the date distance comes back into that summary after a 14-day pause (not what you wrote). Nothing else about your health; ONYX never saves diagnoses or medications. With ONYX remembers on, ONYX memory can also hold patterns learned from tasks that use this data (like how often you finish a steps task), never the daily numbers.
• Where it comes from: your phone's health data, only after you say yes in the app, and what you tell ONYX. A photo or file you choose to show ONYX, or a camera or screen picture you share on an ONYX Live call (with the camera on, a picture every few seconds and when you talk; for a form check, a few frames and your body's joint positions for that set), may show your body or health; it goes to Anthropic for that reply and EMBARK doesn't keep it. So may a calendar event's name (a doctor's appointment, therapy), which goes to Anthropic only with "Send event titles to ONYX" on, for that reply, and isn't kept.
• Why: to check the tasks you add, to let ONYX coach you on them (and on your whole day, if you turn that on), and to keep pressure off during a crisis. Never for ads, and never sold.
• Who we share it with: Anthropic, which writes ONYX's replies, Cartesia, which speaks ONYX's replies aloud on a Live call (it gets the reply text only), and the services that host EMBARK for us (Railway, TiDB Cloud, and Backblaze B2 for encrypted backups). They process it only for us, under contract (Cartesia's terms are in section 8). Calorie and food numbers never go to Anthropic; weigh-ins go only if you turn on Let ONYX see my weight, for that reply, and aren't stored. ONYX memory never learns from those tasks. Friends see only kept or missed, never the numbers.
• ONYX memory: those patterns are stored on EMBARK's servers and sent to Anthropic with your chats, to coach you; never sold, used for ads or used to train AI. See, edit or delete each one, or turn memory off, in Settings > About you > What ONYX knows about you. A pattern unused for 12 months is deleted, and deleted data leaves our backups within 30 days.
• Your rights: see what we have, withdraw your consent (turn off health data in Settings > Proof sources, weight, calories and food in Settings > Weight, calories and food, or ONYX remembers on What ONYX knows about you), and delete it (Erase my data or Delete account in Settings, or write to embarkteam.app@gmail.com). We answer within 45 days, and deletion reaches our providers and backups. If we turn down a request, you can appeal by replying to our answer.

15. Contact

Aryeh Zaghi, embarkteam.app@gmail.com, https://joinembark.app