Ember
Phone home
No analytics, no telemetry, no silent updates. The network stays closed until you open it.
Security
Private by construction.
Ember is private because nothing leaves your machine by default — and you can read the ledger that proves it.
Zero-egress by default
The network starts closed.
Ember opens no connections on its own. The internet is reachable only through a capability you grant — and each grant is scoped to exactly what you allowed, written to the audit log, and revocable at any time.
- Default-deny: no outbound connections
- Internet only via a capability you grant
- Every grant is scoped, audited, revocable
third-party requests0
bytes sent off this machine0 B
network capabilityclosed
ports on your networknone · app↔engine is localhost-only
You can read everything
Nothing happens in the dark.
Every action Ember takes is sandboxed and written to a log you can read. Every capability is visible and can be toggled off. And your memory stays where it was made — on the disk in front of you.
- Full audit log of every action
- Every capability visible and toggleable
- Memory lives only on this machine
audit logcomplete
actionssandboxed + logged
data locationthis machine
telemetrynone
09:14:02GRANT network → api.local (scoped, 1 host)
09:14:48READ memory/notes.db
09:15:10DENY outbound → telemetry.* (default-closed)
Guarantees
What Ember will never do.
Hide from you
No covert behavior. Everything it does is visible, logged, and reversible.
Resist removal
One owner switch deletes it completely. A virus resists removal; Ember leaves the instant you ask.
Always on
The floor that can't be lowered.
The minor-safety floor
Runs in every mode. No theme, persona, or capability grant can weaken it — the one control you cannot turn down.
The Guardian explains, you decide
Above that floor the Guardian is advisory: it tells you what's happening and helps you decide. It informs your judgment — it never replaces your own security tools.
Prove it yourself
Don't trust this page. Run the commands.
Every claim above is checkable from your own terminal. No cloud assistant can print these three.
$ sha256sum Ember-Studio-0.1.0.AppImage
1250d3001fa89f26e331ecfe81fc761c
e8f724443cdf8b810c5e93f27aec49aa
e8f724443cdf8b810c5e93f27aec49aa
✓ matches the published checksum
$ nmcli networking off
$ ./Ember-Studio-0.1.0.AppImage
✓ it runs — a model ships inside the download
$ ss -tnp | grep -i ember
127.0.0.1 ↔ 127.0.0.1 — the app talking to its engine
✓ nothing leaves the machine
Trust the math, not the marketing.
Every claim here is something you can verify on your own disk — the network log, the capability ledger, the one-click removal. Privacy you can audit, not a promise you have to trust.
Download Ember →