Privacy policy

Ember (“we,” “us”) makes software for nonprofits. This policy explains what we collect on donewithember.com, why, and the choices you have. The site is where you learn about Ember and create an account.

What we collect

• Your email address, only when you type it into a sign-up or newsletter form, or sign up with Google. When you sign up for an account, we also record the page you were on, any ad or campaign tags in the link that brought you, and your IP address and device type, to stop spam and to see which pages work. We clear the IP address and device details after 90 days. (A sign-up to one of our email lists records only what is listed under “Our newsletter and other email lists”.)
• Basic usage data, when you visit, our analytics tool records things like which pages you view, the type of device and browser you use, the link that sent you here, and a rough location based on your IP address. This helps us learn which tools people want.
• How you use the site, to find confusing spots, a tool records general interactions like clicks and scrolls, and may capture anonymized session replays. We mask sensitive input.
• Our newsletter and other email lists. If you sign up for one of our email lists (our newsletter, our studies list or our Form 990 reminder), we store your email address, the list you joined, the page of our site you signed up from, and the dates you signed up, confirmed and, if you do, unsubscribed. If you sign up for the Form 990 reminder, we also store the month your organization’s tax year ends and, if you tell us, which Form 990 it files, so that we can email you before your Form 990 is due. We keep a record of each reminder we send you (which reminder, its due date, when we sent it, and our email provider’s reference or error message) so that we never send the same one twice. Each reminder has a link to change the month. We keep the month your organization’s tax year ends, any form type you provide, and the record of each reminder we send for as long as the email address remains on this list. We also note when we last sent you a confirmation email, and for which list, so we never send more than one a day; if a list’s confirmation has to wait for that reason, we send it the next day. Nothing is sent until you confirm: we email you a link, and you are added only when you use it. We keep these lists ourselves and do not sell or share them. Every email from these lists has a link to unsubscribe. Unsubscribing takes you off that list only. It does not take you off our other lists, close an Ember account or stop the sign-in emails an account needs. Our analytics records that someone signed up on a page, never the email address.
• Anything you send us, if you email us, we keep your message so we can reply.

Why we collect it

• To send your sign-in link (and, if you don’t use it, one reminder the next day), your email-list confirmations, the Form 990 reminders you ask for, and emails about Ember you’ve asked for.
• To understand which products nonprofits are most interested in, so we build the right things.
• To keep the site working well and improve it over time.

Who we share it with

We never sell your information. To run the site and learn what nonprofits need, we rely on a few trusted service providers, and, unless you opt out, two advertising platforms. Each only receives what it needs:

• Supabase (database), Fly.io (hosting) and Resend (email), which run the Ember app that our sign-up and email-list forms send to. They store your email address and send your sign-in link, your list confirmations, and the emails from the lists you joined.
• PostHog, product analytics. When you sign up, the Ember app tells PostHog that a sign-up was requested, with your email address and the page you came from, so we can see which pages lead to sign-ups. See PostHog’s privacy policy.
• Google Fonts, which serves the site’s typefaces. Your browser fetches them from Google, so Google receives your IP address and browser details. See Google’s privacy policy.
• YouTube, when a page here shows one of our films. The player loads with the page, so YouTube receives your IP address and browser details. We use the no-cookie player, which sets no cookies until you press play. See Google’s privacy policy.
• Google Analytics 4, the usage data above. See Google’s privacy policy.
• Microsoft Clarity, anonymized usage analytics and masked session replays that show us where the site confuses people. See Microsoft’s privacy statement.
• Google Ads & Meta (Facebook/Instagram), help us measure our ads and, where permitted, show them to people likely to find Ember useful. This involves advertising cookies, which you can turn off (see “Cookies and your privacy choices” below).
• Google Cloud Vertex AI (United States), which answers the questions you type into Flint, the assistant on some of our pages. We keep those questions and answers for 12 months, without names, email addresses or IP addresses.
• DigitalOcean (hosting), which serves the site.

We may also share information if the law requires it, or to protect our rights and the safety of others.

How we protect it

Everything you send travels over an encrypted connection (TLS). Inside Ember, your organization’s data is encrypted at rest and kept isolated from other organizations, and we use passwordless sign-in, so there’s no password to steal. We never sell your data. Owners and admins can download your organization’s records at any time, and can close the account, after which its records are deleted within 30 days.

Cookies and your privacy choices

We use a small number of cookies. Some are for analytics (Google Analytics, Microsoft Clarity), to understand how the site is used. Others are advertising cookies (Google Ads, Meta), which measure our ads and, where permitted, help show them to people likely to find Ember useful. Advertising cookies are on by default. You can opt out at any time:

• Your privacy choices. Select “Your privacy choices” at the foot of any page and switch ad cookies off. We remember your choice in your browser, stop loading the Google Ads and Meta tags, and remove the advertising cookies they set on this site. The choice applies to that browser on that device; if you clear your browser’s stored data, you will need to choose again.
• Global Privacy Control. If your browser sends Global Privacy Control (GPC), we treat it as a request to opt out, automatically. Advertising cookies stay off, and the switch cannot turn them on.
• Email. Write to hello+privacy@donewithember.org and we will apply your opt-out.

You can also block or delete cookies in your browser settings, and the site still works without them. California residents have further rights, set out below.

Your choices

• Unsubscribe anytime, every email from our lists and every optional email has an unsubscribe link. Sign-in and account emails don’t, because your account needs them.
• See or delete your data, email us and we’ll show you what we have or remove it.
• Depending on where you live (for example, the EU or California), you may have extra rights to access, correct, or delete your data. Just ask, we’ll honor it.

Your California privacy rights

If you live in California, you can ask what personal information we hold, access or delete it, correct it, and opt out of the “sale” or “sharing” of your personal information. We’ll never treat you differently for using these rights.

Do Not Sell or Share My Personal Information. We don’t sell your information for money. But using advertising cookies (Google, Meta) can count as “sharing” for cross-context behavioral advertising under California law. You can opt out in any of these ways:

• Select “Your privacy choices” at the foot of any page and switch ad cookies off.
• Turn on Global Privacy Control (GPC) in your browser, we treat it as an opt-out request.
• Email hello+privacy@donewithember.org with “Do Not Sell or Share” and we’ll apply it.
• Opt out at the source: Google Ads settings and Meta ad settings.

How long we keep it

We keep your email address while you’re signed up. If you unsubscribe, we keep the address marked as unsubscribed, with the page and dates of your sign-up, so we never email you again. Ask us to delete it and we will. We keep anonymous analytics data for a limited time to spot trends.

Children

This site is meant for the adults who run nonprofits. It is not directed to children, and we don’t knowingly collect their information.

Changes to this policy

If we update this policy, we’ll change the date at the top. If the changes are significant, we’ll do our best to let subscribers know.

Contact us

Questions about privacy? Email hello+privacy@donewithember.org and we’ll help.