Privacy policy

Summary

This policy covers Emberforge, our desktop writing app, and our website, www.xn3tech.com. Neither uses cookies, analytics or tracking.

Emberforge is a desktop app for writing and editing books. It is built so that your work stays with you:

• Your manuscripts, notes, AI review results, settings and API keys are stored on your computer. We do not receive, see or store them.
• There is no account to create, and no advertising, analytics, telemetry, crash reporting or tracking of any kind.
• The only connections Emberforge makes to us are the check for updates, which you can turn off, and, if you have entered an activation key, a daily check that the key has not been revoked. Users in the United States are served from Virginia; everyone else from Frankfurt, Germany, and they are asked before the app uses our US server.
• Optional AI features send the text you choose directly from your computer to the AI service you pick, using your own API key. That text never passes through us.
• Optional cloud sync, off unless you turn it on, keeps your books in step between your computers through your own Google Drive. Everything is encrypted on your computer, with a key protected by a password only you know, before it is sent. Google stores only data it cannot read, and nothing passes through us.
• If you buy the full version, we keep your name, email address and purchase record to issue and support your activation key. Payments are handled by our payment provider; we never see your card details.
• We do not sell or share personal information, and we do not use it for advertising or profiling.

Who we are

Emberforge is made by XN3 Technologies (“we”, “us”). For the limited personal information described in this policy, we are the “controller” under the EU and UK General Data Protection Regulation (GDPR) and the “business” under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).

Contact: info@xn3tech.com · https://www.xn3tech.com · 30 N Gould St, Suite 35070, Sheridan, WY 82801, USA

Our website (www.xn3tech.com)

Our website is a simple information page. It uses no cookies, analytics, advertising, tracking pixels, embedded third-party content or forms.

It is hosted by Amazon Web Services using AWS Amplify, which delivers the page through the Amazon CloudFront network from the AWS location nearest to you; that may be outside your country, including the United States. When you visit, your browser sends the standard information any website receives: your IP address, the date and time, the page requested, the referring page and your browser’s user agent.

AWS Amplify automatically keeps an access log of these requests for as long as the website is hosted there; this cannot be switched off. The log is stored by AWS on our behalf as our service provider (processor) and is available only to us. We look at it only when needed to investigate errors, abuse or security problems, never to identify or profile visitors, and we do not combine it with any other information.

Purpose and legal basis (GDPR): showing you the website and keeping it secure, based on our legitimate interest in operating it (Article 6(1)(f)). You can object to this processing or ask about entries relating to your IP address by contacting us.

When you download Emberforge from the website, the installer comes directly from our update server in the United States (Virginia) or Europe (Frankfurt), whichever link you choose. As with update checks, your browser sends the standard request information, and we do not log these requests.

If you email us, we use your email address and message only to answer you and to handle any request you make (Article 6(1)(b) and (f) GDPR).

Information that stays on your computer

Emberforge saves the following on your computer: in your bookshelf folder (where your books are), in the settings folder next to it and in the app’s data folder. None of it is sent to us.

• Your books: chapters, pictures, covers, sticky notes, book details (such as author names, ISBNs and contributors you enter), export history and Publisher Control Numbers.
• Results of AI Editor reviews and AI detection checks that you run.
• Your settings, including the API keys you enter for AI services. API keys are encrypted with Windows Data Protection (DPAPI), so they can only be read by your Windows user account.
• The dates of update checks and which version you last ran, so the app can remind you about updates and show what is new.
• The folders of the bookshelves you opened, so you can switch back to them.
• When your free trial started, and your activation key if you bought the full version (it contains your name, your email address and the date it is valid until), with the list of revoked key numbers last downloaded.
• If you use cloud sync: the email address of the Google account you signed in with, what was last synced, your Google sign-in token and, if you choose “Remember it on this computer”, the key that unlocks your cloud library. The token and the key are encrypted with Windows Data Protection (DPAPI).

You are in full control of this information. You can view, copy, change or delete it at any time with Emberforge or File Explorer. Uninstalling the app leaves your books and settings in place. To remove them, delete your bookshelf folder (Book_Editor in your Documents folder, unless you chose another) and the folder next to it named after it with .config at the end (for example Book_Editor.config; for a bookshelf at the root of a drive, the _Emberforge.config folder inside it), which holds your settings, API keys and added fonts; do this for each bookshelf you used. Then delete the app’s data folder, %APPDATA%\Emberforge, which holds your activation key, this computer’s settings, your trial and cloud sync records, the list of bookshelves you opened and, if a book folder could not take them, copies of edits that could not be saved. If you used a version before 1.8.5, also delete any files in your Documents folder whose names start with Book_Editor_Settings.

Update checks

To keep the app working and secure, Emberforge checks for a new version when it starts (as often as you choose in Settings → Updates: every start, daily, weekly, monthly or never). It also contacts the update server when you choose “Check for updates now”, download an update, or open the full release notes.

We run two identical update servers, both hosted by Amazon Web Services (AWS): one in Frankfurt, Germany (European Union), and one in Virginia, United States.

• If you are in the United States or one of its territories, the app uses the US server.
• Everywhere else, including the European Union, the rest of the European Economic Area, Switzerland and the United Kingdom, the app uses the Frankfurt server.
• The app works this out on your computer from the Windows region setting (or, if that is not set, the time zone; if neither tells it, it uses the Frankfurt server). Nothing is sent anywhere to decide it. You can choose the server yourself in Settings → Updates.
• Whatever your location, when an update is offered you can choose to download it from either server, Frankfurt or the United States. The release notes shown with the update come from the server you choose, and the download comes from the same server.
• The full list of release notes (About → Release notes → All versions) is read from your update server as set in Settings → Updates. The notes shown after an update are included in the app and need no connection.
• If the Frankfurt server cannot be reached, or a download from it fails, the app tells you and asks before using the US server. You can choose instead to always use the US server in that case, or never to use it.

Like any request on the internet, each request to an update server reveals:

• your IP address,
• the date and time,
• the file requested (for example the latest version number or the installer), and
• technical information about the app and Windows version (the “user agent”).

No account, device identifier, name, email address or any of your writing is sent. We do not use these requests to identify you. Request logging is switched off on both update servers, so we do not keep records of them; for the Frankfurt server our release process checks this and will not publish while logging is on. AWS processes them on our behalf as our service provider (processor) and may keep short-lived operational and security logs under its own practices.

Purpose and legal basis (GDPR): delivering updates and security fixes, based on our legitimate interest in keeping the software secure and working (Article 6(1)(f)). You can object at any time by setting update checks to “Never”. When you are outside the United States, a request goes to the US server only when you choose it (for this update, in Settings, or when you agree after the Frankfurt server failed).

Buying the full version

Emberforge includes a free trial; afterwards it can be used free of charge in Basic mode, or with every feature by buying an annual activation key.

If you buy the full version, we receive your name, your email address and the details of your purchase (what you bought, when, the amount and an order reference) from our payment provider, and we create an activation key for you and email it to you. We use this information only to deliver and support your license, to answer your questions and to keep the business and tax records the law requires.

This happens automatically, usually within minutes: our payment provider notifies our license service, which runs on Amazon Web Services in the United States (Virginia). It creates your key, emails it to you with Amazon Simple Email Service, and keeps a record of your name, email address, key number, end date and purchase reference for as long as tax and accounting law requires (see “How long information is kept”). AWS processes this for us as our service provider under its Data Processing Addendum. If you renew, the record lets us add the new year to the end of your current license.

Payments are processed by our payment provider, which is named at checkout. Your card or bank details go directly to the provider; we never see or store them. The provider’s own privacy policy applies to that processing.

Your activation key contains your name, the email address you used to buy it and the date it is valid until. Emberforge checks it on your computer.

While an activation key is entered, Emberforge checks once a day, and when you enter a key, whether the key has been revoked (for example after a refund or misuse). It does this by downloading our list of revoked key numbers from your update server (see “Update checks”) and comparing it on your computer: your key, name and email address are never sent. Like any web request, the download reveals your IP address. If the list cannot be reached, nothing changes. A revoked key is removed and Emberforge continues in Basic mode; your work is not affected.

Legal basis (GDPR): performing our contract with you (Article 6(1)(b)) and our legal obligation to keep tax and accounting records (Article 6(1)(c)).

AI features you choose to use

AI features are optional and only work after you add your own API key. When you use Rephrase, the AI Editor or the AI index, Emberforge sends the text you chose (a selection, a chapter or, for the index, the whole book), your instructions and your API key directly from your computer to the AI service you selected: Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini), xAI (Grok), OpenRouter and DeepSeek. Testing a key or loading the list of models also contacts that service.

When you run an AI detection check, the selected text is sent directly to the detection service you set up: Pangram Labs, Originality.AI, GPTZero and Copyleaks.

XN3 Technologies does not receive, see or store this text or the responses. You use these services under your own account and agreement with them, and their privacy policies apply, including how long they keep data and whether they use it to train models. They may process data outside your country (for example in the United States, or in China for DeepSeek). Check each service’s settings and terms before sending text you consider confidential, and do not send other people’s personal information unless you are entitled to.

Cloud sync with Google Drive (optional)

Cloud sync is off unless you turn it on in Settings → Cloud sync (full version and free trial). It backs up your books to your own Google Drive and keeps them in step between your computers, for example a desktop and a laptop. Emberforge connects directly from your computer to Google; XN3 Technologies does not receive, see or store anything you sync, your password or your Google sign-in.

• What is synced: your books (chapters, book details, pictures, covers, sticky notes, AI review results and export settings) and the custom fonts you added. Never synced: your API keys, your activation key and your Emberforge settings.
• Encryption: every file is encrypted on your computer with AES-256-GCM before it is sent. The key is protected by your sync password (stretched with scrypt) and by a recovery key that you save at setup. File names in the cloud are random-looking codes, so they do not reveal titles. Your password and recovery key never leave your computer, so we cannot recover them for you.
• Google sign-in: you sign in to Google in your web browser and allow Emberforge to use its own private app folder in your Google Drive (the “drive.appdata” permission). Emberforge cannot see, open or change any of your other Google Drive files. We read your Google account’s email address only to show which account is connected.
• What Google can see: that your account stores encrypted files for this app, how many there are, their sizes and when they change. Google stores them under your own Google account and its privacy policy and terms; it cannot read their contents.
• Working on two computers: while sync is on, each computer also stores, encrypted, the name you gave it and which book is open, so Emberforge can warn you before you edit the same book in two places.
• Emberforge’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Emberforge uses its Google Drive access only to store and sync your encrypted library for you; the data is not used for advertising, is not sold or transferred to anyone, and is not read by people.

To stop: Settings → Cloud sync → “Turn off on this computer” stops syncing there; “Delete cloud library” deletes every encrypted file from your Google Drive. You can also remove the app’s access at any time in your Google Account (Security → Third-party apps), and delete its hidden data in Google Drive (Settings → Manage apps).

Links and other websites

Links in the app (such as our website, email address and the pages where AI services issue API keys) open in your web browser or email program. Those websites have their own privacy policies.

What we do not do

• We do not sell personal information, and we do not “share” it for cross-context behavioral advertising (as those terms are defined in the CCPA).
• We do not collect or use sensitive personal information.
• We do not use cookies, advertising identifiers, analytics or tracking in the app.
• We do not make decisions about you by automated means or build profiles of you.
• We never receive your cloud sync password, your recovery key, your Google sign-in or the books you sync.

International transfers

If you are outside the United States (including in the European Economic Area, Switzerland or the United Kingdom), your update requests go to our Frankfurt server and stay in the European Union, unless you choose the US server: for a particular update, in Settings, or when you agree to use it because the Frankfurt server is unavailable. Requests to the US server, and our use of AWS generally, are covered by AWS’s Data Processing Addendum, which includes the European Commission’s Standard Contractual Clauses (and the UK Addendum).

The AI services you choose to use may transfer data outside your country under their own terms (see “AI features you choose to use”).

If you turn on cloud sync, Google stores your encrypted files in your own Google account under your agreement with Google, possibly in the United States or other countries. They are encrypted on your computer first, so Google cannot read them.

How long information is kept

Information on your computer is kept until you delete it. We do not keep records of update requests. Website requests are kept in AWS Amplify’s access log for as long as the website is hosted there (see “Our website”). Emails you send us are kept only as long as needed to answer you and to meet legal obligations, and then deleted. Purchase records and the list of activation keys we have issued are kept for as long as tax and accounting law requires (generally up to seven years), and then deleted. Cloud sync copies stay in your Google Drive until you delete them (Settings → Cloud sync → “Delete cloud library”); old encrypted versions of changed or deleted files are removed automatically about a week later.

Security

Update checks, downloads and AI requests use encrypted HTTPS connections. Downloaded updates are checked against a SHA-512 checksum before they are installed. API keys are stored encrypted on your computer. Cloud sync encrypts every file on your computer (AES-256-GCM, with a key protected by your sync password) before it is sent to Google over HTTPS. No method of storage or transmission is completely secure, so please also protect your computer, your API keys and your sync password.

Your rights (EEA, UK and Switzerland)

Under the GDPR you have the right to:

• access the personal information we hold about you and receive a copy;
• have it corrected or erased;
• restrict or object to its processing, including processing based on our legitimate interests;
• data portability;
• withdraw any consent you have given, without affecting earlier processing; and
• lodge a complaint with your local data protection supervisory authority.

Because we keep almost no information about you, most of these rights are exercised directly on your computer (see “Information that stays on your computer”). For anything else, email info@xn3tech.com. We answer within one month.

Notice to California residents (CCPA)

We collect the following categories of personal information, only as described above:

• Identifiers: IP address (update requests and website visits); name and email address (if you buy the full version or email us).
• Internet or other electronic network activity: the update request or page requested, its time, the referring page and the app’s or browser’s user-agent string.
• Commercial information: records of full-version purchases.
• If you email us: anything you choose to write.

Sources: your device, you, and our payment provider. Purposes: providing updates and the website and keeping them secure; issuing and supporting activation keys; answering emails; keeping legally required records. Disclosed for a business purpose to our service providers: Amazon Web Services (update servers and website hosting; California residents use the US server unless they choose otherwise) and our payment provider. Retention: update requests are not stored by us (see “Update checks”); website requests are kept in our hosting provider’s access log while the website is hosted there (see “Our website”); purchase records as described in “How long information is kept”. We have not sold or shared personal information, we do not use sensitive personal information, and we do not knowingly sell or share the personal information of anyone under 16.

You have the right to know what personal information we collect, use and disclose; to access it; to have it deleted or corrected; to opt out of its sale or sharing (we do neither, and we honor Global Privacy Control signals in any case); to limit the use of sensitive personal information (we do not use any); and not to be discriminated against for exercising these rights.

To make a request, email info@xn3tech.com. We may ask for information needed to verify your request, and we answer within 45 days. You may use an authorized agent; we may ask the agent for proof of your written permission and ask you to confirm your identity. We do not offer financial incentives in exchange for personal information.

Children

Emberforge is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, contact us and we will delete it.

Changes to this policy

If we change this policy, we will update the effective date below, describe the change in the release notes, and show you a notice in Emberforge the next time you open it.

Contact us

Questions or requests about privacy: info@xn3tech.com

XN3 Technologies · 30 N Gould St, Suite 35070, Sheridan, WY 82801, USA · https://www.xn3tech.com