What changes on October 14, 2026. A new optional setting in the iPhone app, Ad measurement with Meta, which is off unless you turn it on; a description of Apple's ad attribution reports and of the copies Apple sends us; and what we say about advertisers, which now says exactly when anything goes to one, and from which app. It also describes three things the apps already do that the earlier version left out: logging a deposit from a screenshot, signing up with a phone number, and what the Android app's record of a blocked attempt holds. Before that date the version effective October 2, 2026 applies, and the new setting is not offered or used for anyone. Those three, and this version's other descriptions of what the apps already do (your first name, your habits and what you say they cost you, the amounts product analytics records carry and the install ID they are kept with, your savings fund, how you found Amblee, the reason you can give when you delete your account, and what PostHog receives from the apps), apply now rather than from that date, and so do what it says PostHog receives from this website, that Cloudflare carries the traffic to our server, how and when a bank connection is cut, where the sites on your blocklist come from, what outlasts a deletion, and the email we send the person who gave you a gift, if you ask us to.
Amblee, operated by Amblee LLC, helps you block the apps and sites that cost you money, from gambling and prediction-market apps to shopping, food delivery, in-app purchases and time-wasting feeds, until you meet a savings or investing goal you set for yourself. Doing that requires some personal data, most notably a read-only view of activity in the bank accounts you choose to connect. This policy explains exactly what we collect, why, who touches it, and how to get it deleted. It applies to the Amblee iPhone app, the Amblee Android app (distributed through Google Play, and in testing there ahead of its public release), the web dashboard at amblee.co, the Amblee browser extension, and our creator program.
One thing to understand up front: Amblee is non-custodial. We never hold, move, or invest your money, we never see your bank password, and we never initiate transactions. Our bank connection is read-only and exists for one purpose, verifying that your own deposits happened so your locks can open.
Account details. The email address or mobile phone number you sign in with, and your password, or your Sign in with Apple or Google identity. If you sign up with a phone number, we text a one-time code to it to confirm it is yours, and another if you ask to reset your password. Twilio sends those texts (see Who touches your data, below).
Your first name. If you sign in to the iPhone app with Apple or Google, the app takes your first name from what Apple or Google shares with it and saves it to your account. We use it to greet you in the app, as the name shown on a passkey you add, and to make the start of your referral code. No other way of signing up asks for it, and neither does the Android app.
Your timezone. Used so monthly goals reset on your local calendar.
Goal settings. Your monthly minimum amount, goal type (savings or investing), and the accounts you designate for it.
Your savings fund. If you name a fund, such as a vacation fund, its name, the amount you are saving toward and, if you give one, the date you want to reach it by. With a date, we work out the monthly amount that would get you there, and you decide whether to make it your goal. In the iPhone app you can add a photo to your fund; the photo stays on your phone and is never sent to us.
Screenshot deposits. When you log a deposit from a screenshot of a transfer, the picture stays on your phone and is never sent to us. We receive the amount you type or confirm, a fingerprint of the picture (its SHA-256 hash, which lets us refuse the same screenshot if it is logged twice), and, when there is one, the photo picker's reference to the picture you chose. The Android app reads no amount or text off the picture. The iPhone app reads the amount off it on your phone; it also sends the date the picture was made, when the picture records one, and can send the text it read from the picture, so a disputed amount can be checked against your bank.
Your habits. Which habits you tell us cost you money, picked from a list during setup: shopping and impulse buys, food delivery, in-app purchases, time-wasting apps, betting and prediction apps, or something else. They reach us with the product analytics described below, and the iPhone app also saves them to your account so they come back when you sign in on a new phone. We use them to word the app around your own habits and to suggest apps to block. We also count them: how many members pick each habit, and, for each of our Apple Ads ad groups, how many of the members it brought picked each one (see How we use your data, below). Which apps you actually block is a separate choice, described below.
What your habits cost you. During setup the app asks roughly what the habits you picked cost you a month, one habit at a time, and suggests a monthly goal from the total. Time-wasting apps are the exception: the iPhone app asks about them in hours a day instead of money, and the Android app asks about them only when they are the only habit you picked. Your answers, and their total, reach us with the product analytics described below.
How you found Amblee. A referral or creator code, if you enter one when you sign up. And if you answer the question in the app about how you heard of Amblee, the answer you pick and anything you write beside it, such as which creator or podcast. If what you write is a creator's or a member's code, it can credit them for your joining, the same as a code entered at sign-up.
Custom blocklist entries. Any domains on your blocklist beyond our seed lists: the sites you add yourself, in the iPhone app or on the web dashboard, and, if you switch on “Block their websites too” when you pick your apps during setup, the sites the iPhone app adds for the habits you picked.
Guardrail PIN. The 4-digit PIN that gates sensitive changes such as lowering your goal, removing blocklist entries, or unlinking a bank account.
Hardship reflections. The short private note you write when requesting a hardship unlock. These are visible only to you. We do not read them, analyze them, or use them for anything other than showing them back to you.
When you connect a bank or brokerage account, you do so through Plaid, a regulated financial data network. Through Plaid we receive:
Account metadata. Account names, masked numbers (the last few digits only), account types, and balances.
Sanitized transactions. Amount, date, transaction type, and counterparty name. We use these to count net confirmed deposits toward your goal, including subtracting withdrawals and reversed deposits.
The access tokens that authorize this connection are encrypted at rest with AES-256-GCM.
Lock states. Whether your blocks are currently active, and why (goal not yet met, hardship unlock in effect, and so on).
Device names. So you can see which of your devices are enrolled.
Audit events. A log of sensitive actions such as goal changes, blocklist removals, hardship unlocks, and account unlinking, so you can review what changed and when.
Product analytics. The apps send us a short record of steps you take in them, such as reaching a step of setup, turning blocking on, linking a bank or logging a deposit, with the time of each. Some records carry what you entered at that step: the habits you picked, the monthly spend you gave for each habit and figures worked out from those amounts, such as their total, the hours a day you gave for time-wasting apps in the iPhone app, and the amount of a deposit you logged from a screenshot. In the iPhone app they also carry the choices you make while setting up: whether your goal is saving or investing, whether you already have an account to send deposits to or need to open one, and which brokerage you picked from the list. Our server adds a record when your subscription starts and, for a subscription bought in the iPhone app or on our website, when it is first charged, with the plan but not the amount. Each record is kept with your account once you are signed in, and with a random ID the app makes for that install, so the steps you took before signing up join your account. The iPhone and Android apps each make that ID up themselves: it is not an advertising ID or any identifier of your phone. We delete each record 90 days after it is made. Those kept with your account go with the rest of your data if you delete your account before then. PostHog receives a reduced copy, with no account ID, described below.
On Android, blocking runs through Android's Accessibility permission, which you turn on in Settings after the app has shown you what it does. With it on, Android tells the service which app has come to the front. The service limits itself to the apps on your block list, so Android does not report the rest to it. It compares that app, on your phone, with your block list and your current lock state, and either does nothing or shows Amblee's block screen. It does not read what is on the screen, what you type, or any web address. The one thing it reads from the window itself is the name of the app in front. It does that when it reconnects after a restart or an update, so an app that is already open is not missed, and when it looks again at a blocked app that is still open, for example once the block screen closes.
What leaves your phone: when the block screen stops you opening an app, the app sends us a record with two fields, the time and the category of the one lock our server issues. Every app you pick is held under that one lock, so the category is the same for every app and says nothing about which app it was or what kind of app it is. Tries at the same app a few seconds apart count as one. The record is stored against your account for your block history and deleted after 180 days, or with your account if that comes first. The app also sends a product-analytics event when you accept the accessibility disclosure, carrying the version of the text you accepted. Which apps you chose to block, and the record of when protection was on or off, stay on your phone.
Your bank credentials. You enter them with Plaid, not with us. We never see your bank username or password.
Full account numbers. We receive masked numbers only.
Your Screen Time app picks. On iPhone, you choose which apps to block in Apple's own picker. Those selections stay on your device. Amblee records only that a selection exists, not which apps are in it.
Which Android app you were blocked from opening. The accessibility service makes that comparison on your phone. The record it sends us holds the time and the one lock's category, which is the same for every app you pick; never the app, never what kind of app it is, and never a website.
The screenshots you log deposits from. The picture stays on your phone. We receive only what Screenshot deposits, above, lists.
Advertising identifiers. The iPhone app and this website contain no ad-tracking SDKs and no third-party advertising pixels, and the iPhone app never asks to track you across other companies' apps. The Android app, as it is today, does not read your phone's advertising ID, and nothing from it goes to Meta or any other ad network; if that changes, this policy will say so before it does. The site's only analytics is PostHog, listed below. When you create an account, the iPhone app asks Apple's own attribution service whether an Apple Ads ad in the App Store led to your install. It sends us a one-time token from Apple that carries no advertising identifier; our server exchanges it with Apple and keeps only Apple's answer: whether an Apple ad led to the install, Apple's numbers for the campaign, ad group, keyword and ad, whether you tapped the ad or only saw it, and whether it was a first download or a redownload. We use it to see which ads work and to decide which offers we show you. It never goes to our analytics provider, and it is deleted with your account.
Running the product. Matching deposits in your designated accounts against your monthly minimum, and computing whether your blocks should be locked or open. This is the core of Amblee and the reason the bank connection exists.
Enforcing your own guardrails. Verifying your PIN before sensitive changes, applying the hardship unlock delay and monthly limit, and keeping the audit log accurate.
Improving the product. Using the product analytics described above to see how people get through the apps, such as which step of setup they stop at, and to decide what to change. This includes counting how many members pick each habit and each brokerage.
Support. Answering your emails and troubleshooting your account when you ask us to.
Measuring our ads. Seeing which of our ads lead to installs, signups, setup, trials and payments, from Apple's answer about Apple Ads (above), Apple's ad attribution reports, and, only if you turn it on, the reports described in Ad measurement with Meta (both below). This includes counting, for each of our Apple Ads ad groups, how many of the members it brought to the iPhone app picked each habit, beside the same count for members no ad brought, so we can see which ads reach which habits.
Legal obligations. Complying with applicable law and responding to valid legal process.
We do not use what the iPhone app, the browser extension or this website collects to build advertising profiles, and we do not use your hardship reflections or transaction history for marketing.
This is a setting in the Amblee iPhone app. It is off unless you turn it on, it is offered only from October 14, 2026, and nothing in Amblee changes whether it is on or off. We ask once, right after you start a free trial, and you can change your answer at any time in Account, Privacy.
While it is on, our server sends Meta Platforms, the company behind Facebook and Instagram, up to three short reports: that you created your account, that you started a free trial, and that you were first charged for your subscription, with the amount and currency of that charge. A report says which of those happened and the hour it happened, the Amblee app's version, your iPhone's iOS version without the last number (for example 18.6), and a random number we make up when you turn the setting on. We send each kind of report at most once, within about a week of the event, and never for a renewal after your first charge, a refund, or a purchase in Apple's test environment.
A report never includes your name, email address, phone number or account ID, any advertising or device identifier, your IP address, your device's model or settings, or anything about your habits, goals, bank, savings or blocks. Your iPhone never contacts Meta: our server sends the reports. We mark every report with Meta's Limited Data Use option, which Meta applies only in the US states it lists and only where it can tell which state applies. All the reports sent while the setting stays on carry the same random number, so Meta can tell they came from one person. That makes them pseudonymous, not anonymous.
Meta uses the reports, together with Apple's ad attribution reports below, to show us how many signups, trials and payments came from our Facebook and Instagram ads and to help deliver those ads. Meta uses them under its own terms and its privacy policy at facebook.com/privacy/policy. We have no way to take back a report once Meta has received it, so deleting your account does not delete reports already sent; Meta keeps them under its own terms. While the setting is on we keep the random number with your account, so that all of your reports carry the same one. We delete it when you turn the setting off or delete your account, and after that nothing we keep connects those reports to you.
To turn it off, go to Account, Privacy in the app and switch off Ad measurement with Meta, or email support@amblee.co. From then on nothing more is sent, and any report still waiting to be sent is deleted. When you answer, we record your answer, when you gave it, and the version of this policy, so we can show what you agreed to. This setting is separate from Apple's Allow Apps to Request to Track setting, and the iPhone app never asks to track you.
The iPhone app tells Apple's SKAdNetwork, as a number, how far an install has got: opened, account created, first goal set, app blocking turned on, a bank or brokerage account linked, the subscription screen reached, free trial started, first charge. The setup steps count only for an account created on that install. If an ad led to the install, Apple sends the ad network that showed it, such as Meta, a report Apple signs that carries that number and no other information about you or your device. Apple sends it after a delay, and how much detail it carries depends on how many installs share the same ad. The only meanings we give Meta for the number are a signup, a free trial and a payment. This is Apple's own system, it works the same for every install, and the Ad measurement with Meta setting does not change it.
Apple also sends us a copy of that report when an install came from an ad. Apple makes the copy and sends it, not the Amblee app, and like the report itself it carries no name, email address, account ID or device identifier. We store each copy without the IP address it was sent from or the country Apple sometimes includes, and nothing we keep links it to your account. We use the copies only as totals, to measure which of our ads bring members who sign up, get through setup, start a free trial or pay. We delete each copy 400 days after the day it arrived, and anything sent to us that we cannot confirm Apple signed after 30 days.
We use the following service providers, each with a narrow role:
Plaid connects your bank and brokerage accounts and transmits the account data described above. See plaid.com/legal for Plaid's own privacy practices.
Apple processes subscriptions bought in the Amblee iPhone app, through In-App Purchase, and, if you use it, Sign in with Apple. We never see your payment card details.
Google Play will process subscriptions bought in the Amblee Android app when we release it. This is Google acting as the store that takes the payment, which is a separate role from Google Workspace below and from signing in with Google. Your Android device sends Google your Amblee account ID with the purchase, so the subscription can be matched to your account, and you enter your payment details with Google, which we never see. Google tells us back what it knows about that subscription: the plan, whether it is active, when the current period ends, whether it is set to renew, the country Google recorded for the purchase, and Google's own ID and amount for each charge. If a charge is refunded or charged back, Google tells us which charge it was, when, and the reason it gives, such as a refund you asked for or a dispute with your bank. It does not tell us how much was given back; we reverse the commission we recorded for that charge. Google tells us again each time that changes, so a cancellation or a refund reaches your account without you doing anything. In this role Google receives nothing about your bank accounts, your goal, or what you block.
Railway hosts our servers and database.
Cloudflare carries the traffic to our server. Every request to our server at api.amblee.co passes through Cloudflare on its way to Railway, whether it comes from the apps, the browser extension or a page of this website (the web dashboard, signing in, resetting a password, buying or redeeming a gift, and the creator pages), and Cloudflare decrypts it to pass it on, so it sees your IP address and what each request contains. The pages themselves are served by Vercel, so loading a page does not pass through Cloudflare.
Google Workspace powers our email, including support conversations at support@amblee.co.
Vercel hosts and serves this website.
Postmark delivers transactional email such as password-reset links.
Twilio sends the one-time codes we text to a phone number, when you sign up or reset your password with one. It receives your phone number and the code, and nothing else about your account.
Stripe processes subscriptions bought on our website. It receives your email address, your Amblee account ID (so a payment can be matched to your account), and the card and billing address you enter on Stripe's own checkout page, which we never see. A subscription bought in one of our apps is billed through your Apple or Google Play account instead, and Stripe receives nothing about it. Stripe also processes gifts bought on our website, with the email address and card the buyer enters and nothing about an Amblee account. What stays with Stripe after you delete your account is under Retention and deletion below. Creators are paid through Stripe too; see the creator section below.
PostHog receives product analytics. From this website: which of its public pages you visit, how long you stay on each and how far down you scroll, and what you click or change on them (which button or field, never what you type into it). With those it receives what your browser tells any website it visits: your IP address and the rough location PostHog works out from it, your browser and device, including its screen size, language and time zone, and the website or link that sent you here. PostHog's script keeps a random ID in a cookie on amblee.co and in your browser's local storage, so that one browser's visits count as one visitor; nothing on this website tells PostHog who you are. The public pages are the ones about Amblee and its prices, the help and legal pages, the creator program's pages for people thinking of applying, and the gift page. It records nothing on any other page, such as the web dashboard you sign in to (the pages under amblee.co/app), the sign-in pages, a creator's dashboard, earnings page and payout setup link, a creator's code page, the pages that show or redeem a gift code, the password reset page, or our own admin site: it is not loaded on those pages, and if you move to one from a public page, anything it captures there is dropped before it is sent. It never records your screen. From the apps: a reduced copy of the product analytics records described above, which our server makes. Each copy says which step or action it was, when, and a few facts about the app itself, such as how you signed in, which step of setup you reached, or whether you allowed notifications. It is keyed to an ID our server works out from the app's random install ID, never to your account ID, and our server sends PostHog nothing that joins the two. It leaves out the habits you picked, every amount of money and every figure worked out from one, whether you are saving or investing, where your deposits go and which brokerage you use, the plan you chose, whether you were offered a free trial, anything you typed and any code. Records that only some members produce, because of the habits they picked, whether they are saving or investing, the plan they chose, or whether they were offered a free trial, are not sent at all, so which records an install sent does not give those away either. PostHog does receive the time of each record, and we do not change it. The time between two records depends partly on which screens you saw (in the iPhone app, for example, a member offered a free trial reads one more screen before the paywall than a member who is not; the Android app shows a free trial on the paywall itself), so the times can hint at what the records leave out, though no record says it. Of our server's records about subscriptions, PostHog receives only that a subscription started and the store it came through, tied to no person or install. It does not receive our record of a subscription's first charge, because that record comes moments after the start when there is no free trial and about a trial's length later when there is one, so its time would say which. PostHog also receives our server's error reports, with account IDs, email addresses, phone numbers and payment IDs taken out. It receives them without selling or advertising use.
Meta Platforms receives the reports described in Ad measurement with Meta above, and only for members who turn that setting on. Meta is not acting on our instructions: it uses the reports under its own terms, which is why the reports from the iPhone app carry no name, contact details, account ID or device identifier, only a random number.
We never sell your personal data, and we never share it with data brokers. Ever. We share nothing about you with an advertising company unless you turn on Ad measurement with Meta, a setting only the iPhone app has today, and then only the reports described above, which carry no name, contact details, account ID or device identifier. The other parties that touch your data are the service providers above, acting only on our instructions to run the product. We update this list as our providers change.
If you redeem a gift and tick the box to tell the person who gave it to you that it arrived, we send one email to the address they paid with, if we still have it, saying only that the gift was redeemed and on what date; we tell them nothing else about you or your account, and we send them nothing if you leave the box unticked.
We may also disclose data if required by law, or as part of a merger or acquisition, in which case this policy would continue to apply to data collected under it.
Plaid is the bridge between Amblee and your financial institution. When you link an account, you authenticate directly with Plaid, and Plaid provides Amblee a read-only feed of the account metadata and sanitized transactions described above. Plaid has its own end-user privacy policy governing how it handles your data, available at plaid.com/legal. Unlinking an account in Amblee, or deleting your Amblee account, severs our access: we stop reading it and tell Plaid to remove the connection, and if Plaid cannot be reached, we ask again every day until it has.
If your subscription or free trial ends, Amblee disconnects your banks at Plaid in the same way: we stop reading them and tell Plaid to remove each connection. That happens about a week after your access to Amblee ends, or after you connected the bank if that was later, and never sooner than 7 days. A period you already paid for, a gift and free days you earned all count as access. We do not email or notify you when this happens. What we already recorded stays, and you can connect your banks again at any time; the app asks you to when you come back.
Encryption at rest. Bank access tokens are encrypted with AES-256-GCM.
Encryption in transit. All traffic between your devices, our servers, and our processors uses TLS.
Ask twice. Sensitive operations, including lowering your goal, removing blocklist entries, and unlinking accounts, require your 4-digit guardrail PIN or your account password before they take effect.
No system is perfectly secure. If we learn of a breach affecting your personal data, we will notify you as required by law.
We keep your data while your account is active. Your bank connections end sooner if your subscription or free trial ends: we disconnect them at Plaid about a week after your access ends, or after you connected the bank if that was later (never sooner than 7 days), as Plaid's role above describes, and keep what we already recorded. When you delete your account, your bank and brokerage connections are severed immediately (we stop reading them and tell Plaid to remove each one, as Plaid's role above describes), and your personal data is hard deleted from our database within 30 days, with one exception, below. During that window the data is retained so you can recover from an accidental deletion and so we can send the one message described below, and for nothing else; after it, the data is gone from our database.
The one message after a deletion: we may send a single email to the address on the account confirming that the deletion has been made, and that email may carry an optional link to tell us why you left. It is sent once and it is the only thing we send you after a deletion: no reminder, no second request, no marketing, no offer to come back. Answering is optional and changes nothing about the deletion, which has already happened. Anything you tell us is kept without your name, your email address or your account ID, so it is not linked back to you.
The exception: if you joined with a creator's code, we record the commission your payments earn that creator. Each of those records is an accounting and tax record of money owed to someone else, so we keep it for seven years after the end of the year it relates to, with your account ID and your subscription's ID replaced by a one-way pseudonym. It keeps the amounts, the dates, the plan, the country the store recorded if there is one, and Apple's, Google's or Stripe's ID for the payment, which we need to match a later refund. Because of that ID the record is pseudonymous, not anonymous.
If you have applied to or joined our creator program, what we keep about you as an applicant or a creator does not go with your account: it follows the creator section below.
Some copies outlast the deletion. Our server writes a log line for each request it receives, with the address of the Cloudflare server that passed the request on rather than yours, and some lines include your account ID or email address. Railway, which hosts our server, keeps these logs for up to 90 days, and we cannot delete them sooner. Railway's backup copies of our database can hold your data for up to 90 days after it is deleted. If you paid through Stripe's checkout page, for a subscription or a gift, Stripe keeps its record of each payment: the invoice or receipt and the card payment, with the email address and name you paid with and, for a subscription, your account ID. Those records stay in our Stripe account, and Stripe keeps them under its own legal obligations, as its privacy policy describes. When the 30 days are up we delete each customer record you have in Stripe, with the contact details and card saved on it, and cancel at once, with no refund, any subscription on it that is somehow still running. If a refund or a dispute about one of your payments is still open then, we delete the record once that is settled. If Stripe cannot be reached that day, we delete the records once it can, and find any that our own records do not name by checking our Stripe account for records of accounts that no longer exist. That check is also how we delete the records of accounts whose 30 days ended before October 7, 2026, when we started deleting them. If Plaid still has not removed one of your bank connections when the 30 days are up, we keep only what Plaid needs to remove it (the connection's encrypted key and Plaid's ID for it), and nothing else about you, and ask again every day until it has; then those are deleted too. Emails you sent us stay in our mailbox for up to 24 months. If you gave us your email address for our waitlist, it was never part of an account, so it stays until you ask; email support@amblee.co and we will delete it.
Some data never said who you are, so it is not part of your account, and deleting your account leaves it as it is. It is not an exception to the deletion above, which is about data that identifies you. There are two kinds.
Why you left, if you tell us in the app: when you delete your account in the iPhone or Android app, you can pick a reason and add a note of up to 280 characters. Both are optional and change nothing about the deletion. We save your answer on its own, without your name, email address or account ID, together with a few broad facts our server adds about the account: how many days it was open, whether a bank was linked, whether you had added any websites to your blocklist or chosen apps to block on iPhone, a range for your goal rather than its amount, whether your blocks were locked at the time and why, and the kind of device it was last used on. Nothing in it says who wrote it. A person at Amblee reads these, so please leave out anything that identifies you.
Analytics kept with the app's install ID rather than your account: any records an app sent us while no one was signed in, and PostHog's copy of the product analytics records, which is keyed to an ID worked out from the install ID. Once the records kept with your account are deleted, nothing we keep links that install ID, or the ID worked out from it, to you. We delete our own records 90 days after they are made.
Ad measurement with Meta: your answer and our record of which reports were sent are kept while your account exists, and deleted as soon as you delete your account rather than after the 30 days. The random number is kept only while the setting is on: it is deleted when you turn the setting off or delete your account. A report waiting to be sent is deleted once it is sent, when you turn the setting off, or when it is too old to send, about a week after the event. A report Meta refused is kept 8 days so we can see why, and then deleted. We cannot delete reports Meta has already received, and once the random number is gone nothing we keep connects them to you.
Apple's copies of its ad attribution reports (described above) are not linked to any account, so deleting your account does not change them. We delete each one 400 days after the day it arrived, or after 30 days if we cannot confirm Apple signed it.
Creators tell people about Amblee and are paid commission under the Creator Program Agreement. This section says what we keep about you as an applicant or a creator, and for how long.
Your application. Your name, email address, the social handles you give us, your follower count, whether you use Amblee, what you tell us about your audience, anything you send again on the same address before we answer, and the version of the agreement you accepted, and when. We delete a declined application 90 days after we decline it, and one we never answer 180 days after you last applied, but never more than 365 days after you first applied. An approved application stays with your creator record.
Your creator record. Your name, email address, code and commission rate, whether your code is active, paused or ended, and each version of the agreement you accepted, and when. If your creator email matches the verified email on an Amblee account, we link the two, to show your figures in the app and to stop your code crediting your own subscription. The link is removed when that account is erased.
Our notes. Notes we keep on your record, such as when we contacted you and why, and our reasons for any decision about your code or your commission.
Sign-in codes and sessions. You sign in with a one-time code we email you. We store each code only as a one-way hash, with the address it went to, and a record of each signed-in session. Both are deleted 30 days after they stop working: a code once it is used, replaced or expired, a session once it expires or you sign out.
Your figures. Your counts and money figures are worked out once a day, and each day's copy is deleted after 14 days.
Stripe. We pay creators only through Stripe. Stripe collects your legal name, date of birth, address, taxpayer ID and bank details on its own form, under its own privacy policy, and we don't store them. We keep your Stripe account ID and whether Stripe can pay you. Stripe shows us some details of your account, such as your name, but never your full bank account number or full taxpayer ID.
Commission, payout and tax records. Every commission line, payout and clawback we record for you, and our records of a payout held or released, commission kept after a breach and why, and your agreement ending. They are our accounting and tax records, and we keep them, with your creator record and our notes on it, for seven years after the end of the year they relate to.
If you joined Amblee with a creator's code, we never give that creator your name, email address, account ID or anything else that identifies you. They see counts of the people who joined with their code, rounded so that no count is ever one person and updated once a day, and the commission they are owed. Money is exact, because it is owed, so a creator with only one or two paying members may be able to work out something about one of them from their own balance. The agreement forbids creators from trying to work out who anyone is.
To ask what we keep about you as an applicant or a creator, or to ask us to delete it, email creators@amblee.co. Commission, payout and tax records stay for the seven years above, whatever else is deleted.
You can access, correct, or delete your personal data at any time. Most of it is visible and editable directly in the app and dashboard. For anything else, email support@amblee.co and we will handle your request.
California residents: Amblee does not sell personal information, and the iPhone app, the browser extension, this website and, today, the Android app do not share personal information for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. The optional Ad measurement with Meta reports from the iPhone app carry no name, contact details, account ID or device identifier, only a random number, and we delete our copy of it when you turn them off, which you can do at any time. You have the right to know what personal information we hold about you, to request its deletion, and to not be discriminated against for exercising those rights. Contact support@amblee.co to exercise them.
Amblee is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18, and we will delete any such data we discover.
If we make material changes to this policy, we will update the effective date above and notify you by email or in the app before the changes take effect. Continued use of Amblee after the effective date means the updated policy applies.
Questions about privacy? Email support@amblee.co.
If gambling is causing you harm right now, free confidential help is available at 1-800-MY-RESET (1-800-697-3738) and ncpgambling.org. Amblee is a commitment tool, not medical care or addiction treatment.