Emberlo Privacy Policy
Emberlo is designed so that we keep as little of your data as possible. This page says what data we process, for what purpose and on what legal basis, how long we keep it, and how you exercise your rights.
Part 1. The Emberlo app
1. Who we are
Emberlo is made by HAIKOTEK COMPANY LIMITED (CÔNG TY TNHH HAIKOTEK), business registration no. 0318449407, address 44/24A Truong Phuoc Phan Street, Neighborhood 1, Binh Tri Dong Ward, Ho Chi Minh City, Vietnam (“we”, “Haikotek”). Contact for personal data: info@haikotek.com.
We decide the purposes and means of processing for the data in section 4 (data on our servers). For the data in section 3 (on your phone) and for the contents of your book, which are end-to-end encrypted, we cannot read or process them.
2. Applicable law
This policy is written under Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 (in force since 1 January 2026) and Decree No. 356/2025/ND-CP that implements it. Decree 356/2025/ND-CP replaced Decree No. 13/2023/ND-CP from 1 January 2026. It also meets the privacy-policy and data-disclosure requirements of the Apple App Store and Google Play.
3. Summary
- Emberlo has no account. We do not ask for your email, phone number or ID.
- Your ledger lives on your phone, encrypted.
- When you pair with your partner, shared data goes through our relay server end-to-end encrypted: only the two phones can read it, we cannot.
- Entries in your Private pocket and For later (the Unassigned inbox) never leave your phone.
- When you buy a paid plan, Apple or Google processes the payment. We receive only a transaction id and plan status, never your name, email, Apple ID or card details.
- No ads, no selling data, no location, no third-party analytics, and no identifying you across other apps and websites.
4. What we process, why, where, and for how long
Group A. Data on your phone. We do not receive this data in readable form.
| Data | Purpose | Where it lives and who can read it | How long |
|---|---|---|---|
| The display name you enter, jars, spending entries, agreements, shopping list, self-declared funding sources | Keeping shared spending records | On the phone, in an encrypted database (SQLCipher) with the key in the Keychain or Android Keystore. You can read it; shared parts are also readable by your partner after pairing | Until you delete the entry, leave the shared home or uninstall the app |
| Entries in the Private pocket and For later | Your own private notes | Only on your phone, never synced. Your partner sees only the pocket limit written in the agreement | As above |
| Receipt photos, warranty photos, text read from screenshots | Keeping receipts, quick search | Only on the phone that took them, excluded from operating-system backups. Text recognition runs on the device. They enter Emberlo’s own backup file only if you choose “include photos” (a Pro feature): then they are resized, location data is removed, and they are encrypted with your recovery words | Until you delete them or uninstall |
| Evening reminder | A nudge to log entries | Created on the device; no push server is used | Until you turn it off |
| Backup file | Restoring your book on a new phone | Where you save it (Files, iCloud Drive, Google Drive…), encrypted with your 16 recovery words. Only someone with the 16 words can read it. It holds receipt and warranty photos only if you chose to include them (Pro) | Managed by you |
| CSV file you export | Using your ledger elsewhere | Where you save it, not encrypted. Anyone who can open the file can read it | Managed by you |
Group B. Data we receive and store on our servers. Our server is located in Tokyo (Nhật Bản / Japan), provided by Vultr (The Constant Company, LLC). None of the tables below has a name, email or phone column.
| Data | Purpose | Where it lives and who can read it | How long |
|---|---|---|---|
| Sync packets between the two phones, with a random box id for the home, size and send and receive times | Passing data between two phones | The relay server, end-to-end encrypted. We and our server host have no key, so we cannot read it. Logs never record the box id or contents | Deleted the moment the other phone receives it, and after 14 days at most. Not in server backups |
| The phone’s IP address when it calls the server | Rate limiting to stop abuse | On every Emberlo route (relay and plan) the address is turned into a one-way keyed hash that changes every day, and only that hash is kept, as a counter key in short-lived memory. The address itself is not written to our database or application logs, and a hash cannot be linked from one day to the next. On the relay path the web server also holds the address in memory only, to count requests per second; nothing is written to disk | From 60 seconds up to 1 hour at most (the counting window) |
| Web-server access log: IP address, time, HTTP method, requested path (without the query string), response code, bytes sent. No request headers, no user agent | Security and troubleshooting | For plan and store-verification calls (redeem a code, buy, restore, refresh, store notifications). The relay path has access logging off, so no relay request is logged. Only our engineers can read it | 14 days |
| A hashed device id (SHA-256 of a public key made on the phone), plan source (store or gift), plan id, seats, start and end dates, status | Granting, renewing and withdrawing the right to use a paid plan | Our database. It holds nothing that identifies you | While the plan is active; after it ends we keep it 24 more months, then delete or anonymise it. A seat is one installation of the app; released seats are deleted after 400 days |
| Store subscription records: original transaction id (HMAC hash), plan id, status, period end, auto-renew or not, offer type. The original transaction id (Apple) and the purchase reference (Google) are also kept encrypted, because we need them to ask the store for the plan status. A hash of your support code (see below) | Confirming purchase, renewal, cancellation and refund; asking the store for the plan status | Our database. We do not receive your name, email, Apple ID, Google account or card details | As the row above |
| Store notifications: notification id, type, time received | Not processing the same notification twice | Our database | 90 days |
| Gift and offer codes: the code as a hash, a short hint, times used; the grant event log (event type, time) | Redeeming codes, reconciliation, abuse prevention | Our database | 24 months after the code expires or is withdrawn; the event log 24 months |
| Email you send to info@haikotek.com | Replying to you | Company mailbox | Until no longer needed |
Install id when you buy. When you buy, the app creates a random id for this install and passes it to the store with the transaction (Apple calls it appAccountToken). It holds no personal data and is used only to match a transaction to the plan entitlement. From it the app works out a support code (SUP-XXXXX-XXXXX, shown in Me → About Emberlo once you have bought a plan). We keep only a one-way hash of that code, so that you can ask us to find or delete your record by quoting it.
We do not collect: location, contacts, bank account numbers, bank login details, advertising identifiers, usage logs, or your photos. Usage measurement is off and the app contains no analytics or advertising SDK.
On Android only: to read text from images and scan the pairing QR code, the app uses the Google ML Kit and Google code scanner libraries. They send Google technical diagnostics (device model, OS version, app name and version, a random install id, processing time, error codes). No image content, amounts or names are in it. See Google’s disclosure.
5. Permissions the app asks for
- Camera (iOS): only to scan the QR code when pairing. The picture is not saved. On Android the Google Play services scanner does the scanning and the app does not request camera permission.
- Photos: only the pictures you choose or share into the app (the system photo picker).
- Notifications: the evening reminder, created on the device. No server push service is used.
- Internet: to sync between the two phones, and to check your plan when you buy or redeem a code.
6. Purposes and legal basis
We process data only for these purposes: (a) running the app, including records, backup and restore; (b) syncing between the two people in a home; (c) granting, renewing and withdrawing the right to use a paid plan, and handling gift codes; (d) keeping things safe and preventing abuse; (e) replying when you contact us; (f) meeting legal duties such as accounting, tax or lawful requests from authorities.
Basis. The main basis is your consent under Article 9 of the Law on Personal Data Protection: voluntary, for each specific purpose and clearly given. You consent when you turn on sync and pair, when you buy a plan or redeem a code, and when you email us. Silence is not consent. You may withdraw consent at any time (see section 10); withdrawing does not affect processing already done. For records the law requires us to keep, the basis is a legal obligation.
You can use Emberlo alone, sending nothing to our servers, if you do not pair and do not buy a plan. We do not use data for advertising, do not profile you, make no automated decisions about you, and do not use data for another purpose without asking for your consent again.
Financial data. A spending ledger holds personal financial information and may count as sensitive personal data. So the app is designed so that we never hold a readable copy of the ledger: all processing of its contents happens on your phone.
7. Payments through Apple and Google
All payments for a paid plan are processed by Apple (App Store) or Google (Google Play) under their own policies: Apple and Google. We do not see or store your card number, name, email, Apple ID or Google account. We receive only the transaction id, plan id, status, period end, and whether the plan auto-renews, as in the table in section 4.
9. Retention and deletion
How long each kind of data is kept is in the last column of the two tables in section 4. In addition:
- Server backups are encrypted and kept as 7 daily and 4 weekly copies. Deleted data disappears from backups when the copy expires, after about 5 weeks at most.
- If the law requires us to keep records (accounting, tax) or we need them to resolve a complaint in progress, we keep only that part for as long as needed and use it only for that purpose.
- Delete it yourself in the app: Me → Leave the shared home. Then choose “Start a new household” and confirm to remove the ledger copy from the phone. Uninstalling the app also removes the app’s data from the device.
- Ask us to delete plan records and gift codes held on our servers: see the data deletion page. The quickest way is to send your support code.
10. Your rights and how to use them
Under the Law on Personal Data Protection you have the right to be informed, to consent or refuse, to access, to withdraw consent, to delete, to receive a copy, to correct, to restrict processing, to object, to complain, report and sue, to claim damages, and to protect yourself. Because your ledger is on your phone, you exercise most of these in the app yourself:
- View, edit, delete: directly on each entry, jar and agreement.
- Get a copy: Me → export the ledger to a CSV file, or Me → encrypted backup.
- Withdraw consent and stop sharing: Me → Leave the shared home to stop syncing; uninstall the app to remove data from the device.
For data on our servers (Group B), email info@haikotek.com. Our records hold no name or email, so please include your support code (Me → About Emberlo), or the order id from your Apple or Google Play receipt email, or your gift code, so we can find the right record (see the data deletion page). We may ask a question or two to be sure the request comes from you.
| Right | How fast we act |
|---|---|
| Confirming we received the request | Within 2 working days |
| Access, correction, a copy | 15 days at most |
| Withdrawing consent, restriction, objection | 20 days at most |
| Deletion | 30 days at most |
These periods include the time our server host needs to cooperate. For a complex request the law allows one extension, and we will tell you the reason in writing. You may also complain to Vietnam’s authority in charge of personal data protection, or go to court.
11. Children
Emberlo is for people aged 18 and over and is not directed at children. We do not knowingly collect data from anyone under 16, the age the law treats as a child. If you are a parent or guardian and see that your child has used Emberlo, write to us and we will delete the related records on our servers.
12. Security and incident notice
The database on the phone is encrypted with SQLCipher; the key is made on the device and kept in the Keychain or Android Keystore. Sync uses XChaCha20-Poly1305 with a home key held only on the two phones; the 6-digit code lets both people confirm the right phone when pairing. Connections to the server use TLS. Records on the server use hashes instead of identifiers, and server backups are encrypted and open only to our engineers.
No system is absolutely secure: keep your 16 recovery words somewhere safe. If you lose both your phone and the 16 words, we cannot recover your book.
If personal data is exposed or lost, we notify the authority in charge of personal data protection within 72 hours of finding out, and we notify you when the law requires or when the incident could harm you. Because the ledger is end-to-end encrypted, an incident on our server does not expose its contents.
13. Changes to this policy
When this policy changes we update the date at the top and say so in the release notes. If a change widens the data we process or the purposes (for example turning on usage measurement), the app asks you first and we process only if you agree.
14. Contact
Any question, personal-data request or complaint: info@haikotek.com. By post: HAIKOTEK COMPANY LIMITED, 44/24A Truong Phuoc Phan Street, Neighborhood 1, Binh Tri Dong Ward, Ho Chi Minh City, Vietnam.
Part 2. This website
15. What the website collects
- The site collects no email and sets no cookies. There is no sign-up form and no account.
- No analytics or advertising tool runs on the page, and the page loads no fonts, code or images from outside servers.
- Your browser stores one “em-theme” value in local storage to remember light or dark mode. It stays on your device and is not sent anywhere.
- The interactive sample loads only when you press “Try it”, runs entirely in your browser and makes no network calls. After you press it, the sample keeps your try-out progress in the browser’s local storage; that data never leaves your device and you can clear it by clearing the site’s data in your browser.
16. Server logs and measurement
Like any website, the server and content delivery network (CDN) write technical access logs: IP address, time, page loaded, browser type. We use them for security and troubleshooting and keep them for at most 30 days, then delete them.
To see how the site appears in search we use Google Search Console. That tool measures on the search side and does not run on this site.
17. When you write to us
If you email info@haikotek.com, we use the contents and your address to reply to you, and keep the message in the company mailbox until it is no longer needed. Please do not send account numbers, card numbers or photos of ID.