- Your files, their names and your folders are encrypted on your Mac before they leave it. We store them, but we can't open them. Neither can our storage provider.
- To run your account we keep your email, how you sign in, the names of your signed-in Macs and computers, how much you store, and (if you set them) a display name and photo. For teams, we also keep who's in which team and which drives they can open.
- Share links keep their key in the part of the link after
#, which browsers never send to us. - The Mac app has no analytics, no tracking and no crash reporting. It checks for updates.
- We don't sell your information or show you ads. Cloudflare, Stripe and Resend handle parts of it for us, in the United States and elsewhere.
- You can delete your account yourself in Settings → Account, and ask to see, correct or export what we hold about you. Email support@getempti.com.
Who we are
Empti is a Mac app and an online service that keeps your files in encrypted cloud storage and shows them in Finder. In this policy, "Empti", "we" and "us" mean Dylan Tazawa-Lim, trading as Empti, a sole trader in Australia, ABN 58 237 629 332.
This policy covers the Empti app for Mac, the empti command, the Empti service at api.getempti.com, share link pages, and this website. Under European and UK data protection law, we're the controller of the personal information described here.
What we can't see
Empti is end-to-end encrypted. Your Mac encrypts each file in 4 MiB pieces with AES-256-GCM before uploading it, using keys that come from your vault. The vault's master key is protected by your passphrase, and you get a recovery key at setup.
- File contents. Stored only as ciphertext. Files are stored under random identifiers, not their names.
- File names, folders and drive names. These live in file lists that are encrypted with a key derived from your master key.
- Your passphrase, master key and recovery key. They never leave your Mac in a form we can use. We store an encrypted copy of your vault so your other Macs can open your drive once you enter your passphrase. We can't unlock it.
- Team files and comments. A team's files, file lists, comments, reactions and activity are encrypted with the team's key. We only ever hold copies of that key that are locked to each member's own key.
- What's inside a share link. See Share links.
Because we can't read your files, we can't scan them, index them or recover them for you. If you lose both your passphrase and your recovery key, nobody can decrypt your files, including us.
We can see how many objects you store, roughly how big each one is, and when they were uploaded or changed. For teams we can see who is a member, which drives each person can open, and who commented or reacted on which item and when, but not what they said. How Empti's encryption works has the detail.
What we keep, and why
This is everything the Empti service stores about you. It's taken from the service's database and storage code, not from a template.
Your account
- Email address, as Apple or Google gives it to us when you sign in. With Sign in with Apple this may be a private relay address. We use it to show who you are, to match team invites, and to email you.
- How you sign in: the provider (Apple or Google) and the stable account identifier it gives us. We ask Apple only for your email, and Google only for your email and basic sign-in (
openid email). We don't get your contacts, files or anything else from either. - A random account ID and when the account was made.
- The invite code you used, if we invited you to test Empti before launch, and when.
- Display name and photo, if you set them in Settings. They're shown to people you share a team with. Unlike your files, they aren't encrypted, so the service can see them. The photo is a 256 px square the app makes from the picture you choose.
- Notification settings: whether you get email about team activity (all, mentions only, or none).
Email and password sign-in exists in the code but is switched off. If we turn it on, we'll store a salted, peppered hash of your password (never the password itself), and count wrong attempts for 15 minutes to slow down guessing.
Your Macs and other computers
- One sign-in record per Mac or computer: its name (for a Mac, the name set in macOS, often something like "Sam's MacBook Pro"), when it signed in and when it was last used. You see this list in Settings and can sign any of them out.
- Signing in a computer with a code. When a computer without a browser (a server, say) runs
empti login, we store the name it gives and its IP address, so you can check both before you approve the code from a device that's already signed in. We also keep the code, a hash of the computer's secret, and whether it was approved or declined. The record is deleted once the computer collects its sign-in or the request is declined; codes expire after 10 minutes and expired ones are cleared out the next time any computer asks for a code. - Folder access for agents. If you give an agent machine access to one folder, we store the label you give that access (as plain text, which is why we suggest one that isn't sensitive), whether it can read or also write, when it was made, when it expires and whether you've revoked it. We also store the agent machine's name and public keys, when it joined, locked copies of the folder's key that only that machine can open, and which of your encrypted objects it may read. We never see the folder's name, what's in it, or its key.
- A hashed sign-in token. We keep a hash, not the token, so a copy of our database can't be used to sign in as you.
- The Empti build number each Mac reports, so we can tell a team when someone needs to update.
Your storage
- Your encrypted files and file lists, in Cloudflare R2.
- An index of the objects you store: each one's random identifier, size and when it changed. We use it to count your storage against your plan.
- Uploads in progress and the size they'll take, until they finish or are cancelled.
- Your encrypted vault, its version, and the name of the Mac that last changed it.
Teams
- Each team's name, its owner, and when it was made. Team names aren't encrypted, because invites and emails show them.
- Members and their roles (owner, admin, member or viewer), when they joined, and a history of joins, leaves and role changes.
- Public keys for each person, and a signed log of membership and key changes that every member's Mac checks.
- Who can open which private drive, and locked copies of each drive's key.
- Ownership handovers: when an owner offers a team to an admin, who offered it to whom, when, when the offer expires, and the admin's signed acceptance.
- Invites: the invitee's email, the role offered, who sent it, and when it was sent, accepted or used. To limit abuse we also record each invite email we send (team, address and time).
- An index of comments: who wrote a comment, on which random item ID, when, whether it was a reply, who it mentions, and who reacted to it. Not the text, the emoji or the file's name.
- Notifications: who did what kind of thing (mentioned you, replied, joined), in which team, when, and whether you've read it or been emailed about it.
- Encrypted activity: a daily record of changes each person's Mac writes, sealed with the team's key. We see how many there are and their size, not what changed.
Billing
- Stripe takes your card and billing details on its own pages. We never see or store your card number.
- We keep your Stripe customer ID, and for each subscription: the plan, monthly or yearly, seats, storage add-ons, its status, trial and renewal dates, when it ended, and which reminder emails we've sent.
- We record whether you've had a free trial and the first-payment refund, so each is used once.
- We give Stripe your email and your Empti account ID, so Stripe and our records refer to the same person.
Security and abuse prevention
- We limit how often an IP address can try share links, invite pages and sign-in codes, using Cloudflare's rate limiting. Apart from the code sign-in described under Your Macs and other computers, we don't store IP addresses in our database.
- We count wrong attempts at a share link's password, and at an invite, for 15 minutes.
- When the service hits an unexpected error, it writes the error to Cloudflare's logs. These don't contain your files or keys.
Share links
A share link looks like https://api.getempti.com/s/<id>#<secret>. The secret after # is made on your Mac. Browsers never send that part to any server, and everything needed to decrypt the shared files is locked under it.
| Kept in the link (and, if set, the password) | Stored by Empti |
|---|---|
| The key that decrypts the shared files and their names | The link's random ID and which encrypted objects it may reach |
| The password, which you send separately | A hash that proves a visitor has the secret (and password), not the secret itself. For password links, the salt used to check it |
| File names, sizes and folders | The list of shared files, encrypted under the link's secret, and a copy encrypted for you so your list of links can show them |
| When it was made, when it expires (at most 30 days), whether you turned it off, any download limit, the number of files and their total size, and how many times it was viewed and downloaded |
We don't record who opened a link: no names, email addresses or IP addresses go into our database. A visit is remembered for an hour so its download can be counted once. The share page loads nothing from other sites, sends no referrer, and tells Cloudflare not to add its analytics script.
When you turn a link off, its encrypted file list, the objects it could reach and its visits are removed from it at once. Expired and turned-off links are deleted in the next nightly clean-up. If you delete or replace a file that a live link still reaches, we keep that encrypted object until no live link needs it.
If you received a link to something that shouldn't be shared, see reporting a share link. Because we can't see what's inside, we act on the link, not its contents.
What the Mac app sends
The Empti app and the empti command talk to:
- The Empti service (
api.getempti.com), for your account, storage links, teams and share links. - Cloudflare R2, to upload and download your encrypted files with short-lived links the service signs.
- Apple or Google, when you sign in with them.
- Stripe, when you open checkout or manage billing (once paid plans are on).
- Our update feed (
updates.getempti.com), to check for new versions with Sparkle. The request includes the app's version, like any web request. We don't ask Sparkle to send a profile of your Mac.
There's no analytics, no usage tracking, no advertising code and no crash reporting in the app. If you've told macOS to share crash data with app developers, Apple may pass crash reports to us; that's Apple's setting, and you can change it in System Settings → Privacy & Security → Analytics & Improvements.
The app keeps a log on your Mac of what the drive and uploader did, for when you ask us for help. It contains no keys or file contents. It can include file and folder names, so if you send it to us we'll see those. It stays on your Mac unless you choose to send it to us.
This website
This site has no analytics, advertising or tracking scripts and sets no cookies. Its pages load fonts from Google Fonts, so Google receives your IP address and browser details when you visit; see Google's privacy policy. The site is hosted by Cloudflare, which processes visitors' IP addresses to deliver it.
If you join the launch list, we keep your email address, the date, which form you used and the country Cloudflare guesses from your connection (not the IP address itself). We use it only to send one email when Empti is ready to download. To be removed, email support@getempti.com.
If you email us, we keep the email and our reply for as long as we need them to help you.
Emails we send
We only send email that's part of using Empti:
- Team invites, when someone invites you by email. They include the team's name and the inviter's name or email, and a plain link. Never a key or a file name.
- Notification digests, at most one an hour, saying who mentioned you, replied or joined, and in which team. No comment text or file names. You can turn these off or limit them to mentions in Settings → Notifications.
- The launch email, once, if you joined the launch list on this site.
- Plan ending notices, after a paid plan ends, on day 1, 7 and 21, saying when the files will be deleted.
Our emails have no tracking pixels and no rewritten links, and open and click tracking are off. We don't send marketing email.
Why we use your information
We use the information above only to run Empti: to sign you in, store and serve your encrypted files, count your storage, run teams and share links, bill you, send the emails listed above, keep the service secure, and help you when you ask. We don't sell it, rent it, use it for advertising, or use it to train AI models. We make no automated decisions about you that have legal or similar effects.
For people in the EU and UK, the legal bases are:
- Contract: running your account, storage, teams, share links, billing and service emails.
- Legitimate interests: rate limiting, preventing abuse, fixing errors, and keeping the service secure. We've weighed these against your interests, and they involve as little information as we can manage.
- Legal obligation: keeping billing and tax records.
- Consent: none of what we do today relies on consent. If that changes, we'll ask first, and you can withdraw it at any time.
Who else handles your information
We use a small number of service providers. They process information on our behalf and only for these purposes.
| Provider | What they do | What they handle |
|---|---|---|
| Cloudflare, Inc. (US) | Runs the Empti service (Workers), its database (D1), file storage (R2) and our update feed | Everything the service stores, listed above. Your files are encrypted before they reach Cloudflare. Cloudflare also sees IP addresses as part of delivering traffic |
| Stripe, Inc. (US) and its affiliates | Payments, subscriptions, invoices and the billing portal | Your email, Empti account ID, card and billing details, and payment history |
| Resend (US) | Sends our emails | Your email address and the content of the emails listed above |
| Apple and Google | Sign in with Apple and Google | They confirm who you are and tell us your email. They know you signed in to Empti, under their own privacy policies |
| Google Fonts | Fonts on this website | Visitors' IP addresses and browser details |
We may also disclose information if the law requires it, for example under a valid court order. Because your files are encrypted with keys we don't have, we can only ever hand over ciphertext and the account information described here. We'd tell you about a request unless the law stops us. If Empti is sold or merged, your information would move to the new owner under this policy, and we'd tell you first.
Information outside Australia
Cloudflare, Stripe and Resend are based in the United States, and Cloudflare runs its network in many countries. Your information may be stored or processed in the United States and other countries where they operate. Cloudflare chooses where our database and file storage are kept, and that may be outside Australia; we don't promise a particular region.
Before sending your information overseas we take reasonable steps to make sure it's protected to the standard of the Australian Privacy Principles. For information from the EU and UK, we rely on each provider's standard data processing terms, including the European Commission's Standard Contractual Clauses and the UK addendum, or their certification under the EU–US Data Privacy Framework and its UK extension, where they have one. You can ask us for a copy of the relevant safeguards.
How long we keep it
| What | How long |
|---|---|
| Your account, profile and sign-in methods | Until you delete your account |
| Your files | Until you delete them, your plan ends (see below), or you delete your account |
| Earlier versions and deleted files | 30 days (at most 20 versions of a file), then deleted. Your Mac applies this the next time it syncs the drive |
| A Mac's or computer's sign-in | Until you sign it out. It stops working after 90 days without use |
| A sign-in code request (computer name and IP address) | Deleted when the computer collects its sign-in or the request is declined. Codes expire after 10 minutes; expired ones are cleared the next time any computer asks for a code |
| Folder access for an agent | Until it expires or you revoke it. Then the agent's sessions, its copies of the folder key and its list of readable objects are deleted at once. The label, dates and the agent machine's name and public keys stay in your history until you delete your account |
| A team ownership offer | Removed when the handover completes, or the offer is withdrawn or declined. An offer stops working after 7 days; an expired one stays until a new offer for that team replaces it or the team is deleted |
| Launch list email address | Until we send the launch email, then 30 days, or sooner if you ask |
| Share links | At most 30 days. Removed in the nightly clean-up after they expire or you turn them off. Visits: one hour |
| Team activity and notifications | 90 days |
| Comment index and membership history | For the life of the team. A deleted comment's text is removed; the record that a comment was there stays |
| Invites | Unused invites are removed 7 days after they expire. An accepted invite that isn't approved is removed after 30 days. Invite email records: 7 days |
| A deleted team | Gone for everyone at once. Its files are kept 30 days, then deleted with the team |
| Wrong-password and rate-limit counters | 15 minutes |
| Billing records | 5 years, as Australian tax law requires |
When a paid plan ends
If you cancel, or a payment fails and isn't sorted out, the plan ends. If a payment fails, we'll retry your card and email you, and uploads keep working for 7 days. Once the plan has ended, your drive is read-only for 30 days: you can still open and download everything, and paying again restores it. We email you on day 1, 7 and 21. On day 30 the files the plan held are deleted from storage. Your account, vault and team memberships stay, so you can start a plan again later.
Deleting your account
Go to Settings → Account → Delete account… in the Empti app. It happens straight away, in this order: every plan you pay for ends in Stripe; your stored files are deleted, including the files of every team you own; you leave the teams you're a member of; then the teams you own, your account, sign-ins (including agents' folder access), profile, vault, share links, notifications and plans are deleted.
If a team you own has other people in it, Empti lists those teams and asks you to confirm first, because deleting your account deletes them for everyone, at once, without the usual 30 days. To keep a team going, hand it to one of its admins before you delete your account.
If you can't use the app, email support@getempti.com from the address on your account and we'll do it for you within 30 days.
Some things stay: in teams you were a member of but didn't own, the comments you wrote remain, encrypted with the team's key and attributed to you, as in any shared document, and so does the team's history of who joined and left. Stripe keeps payment records it's legally required to keep, and so do we. Cloudflare keeps restore points of our database for up to 30 days, so a copy can last that long in backups before it expires.
Your rights
Wherever you live, you can ask us to:
- Access: get a copy of the personal information we hold about you.
- Correct it. You can change your display name and photo yourself in Settings → Account. Your email comes from Apple or Google.
- Delete it, as described above.
- Export it. Your files are always yours to copy out of the drive in Finder. For your account information, we'll send it in a machine-readable format (JSON).
- Object to or restrict how we use it, where we rely on legitimate interests.
- Complain to us or to a regulator (see below).
Email support@getempti.com. We'll answer within 30 days and won't charge you. We may need to confirm the request comes from you, usually by replying from the email on your account. We can't decrypt your files for you, because we don't have the keys.
In Australia
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). You can use Empti under a pseudonym: your display name can be anything, and Sign in with Apple lets you hide your email. If you're not happy with how we've handled a complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
In the EU and UK
Under the GDPR and UK GDPR you have the rights listed above, plus data portability for information you gave us. You can complain to the data protection authority where you live, work, or where you think a breach happened; in the UK, that's the Information Commissioner's Office at ico.org.uk. We haven't appointed a representative in the EU or UK. If you're in the EU or UK, contact us at support@getempti.com.
Security
The strongest protection is that we can't read your files. Beyond that, sign-in tokens are short-lived and stored only as hashes, the links your Mac uses to reach storage expire within an hour and open only your own files (or your team's), and team keys are checked by every member's Mac against a signed log. If a breach is likely to cause you serious harm, we'll tell you and the regulator as the law requires. Security explains the encryption in full.
Children
Empti isn't for anyone under 18, and we don't knowingly collect information from them. If you think a child has an account, email us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects how we use information we already hold, we'll email you before it takes effect.
Contact
Questions about privacy, or a request about your information: support@getempti.com.
Empti is run by Dylan Tazawa-Lim, trading as Empti. We don't have a postal address for notices; send them by email to support@getempti.com.
For help with the app, see Contact support.