Privacy Policy
Echo
This Privacy Policy explains what information Echo (operated by Erebos Lab) collects, how it is used, who it is shared with, and the choices you have. By using Echo you agree to the practices described here.
Data-safety summary
At a glance, here is the data the app collects, whether it is linked to your identity, and whether it is used to track you across other companies’ apps and websites.
| Data category | Linked to you | Used for tracking | Purpose |
|---|---|---|---|
| Contact Info | Yes | No | Account creation and cross-device sync — Echo is cloud-backed, so your journal is backed up to your account by default. You can also continue offline as a fallback (entries then live only on that device until you sign in). |
| User Content (Journal) | Yes | No | Your journal is stored securely on our servers to sync across your devices and power AI reflections. Journal entries are sensitive personal content and are treated as such. |
| User Content (Media backup) | Yes | No | When you are signed in, the photos and voice recordings attached to your entries are uploaded to and stored on Echo’s servers as an encrypted-in-transit media backup, so you can sync and restore them across your devices. Free accounts include a small backup quota; Echo Pro raises it to 2 GB. Media backup is tied to being signed in — signed out, attachments stay only on that device. |
| Social (Optional) | Yes | No | Operate the optional social features when you choose to share a reflection. |
| Identifiers & Diagnostics | Yes | No | Deliver reminders and understand feature usage. Analytics is stored in our own server, not a third-party SDK. |
| Purchases | Yes | No | Manage premium subscriptions via Apple/Google through RevenueCat. |
What we collect
Contact Info
- Email address and password (only if you create an account for cloud sync)
Account creation and cross-device sync — Echo is cloud-backed, so your journal is backed up to your account by default. You can also continue offline as a fallback (entries then live only on that device until you sign in).
User Content (Journal)
- Entry text/transcript, title, mood, tags, duration, favorites, and timestamps
- AI reflection and summary text
- “Ask your Journal” chat conversations
Your journal is stored securely on our servers to sync across your devices and power AI reflections. Journal entries are sensitive personal content and are treated as such.
User Content (Media backup)
- Photo attachments you add to an entry
- Voice recordings / audio notes attached to an entry
When you are signed in, the photos and voice recordings attached to your entries are uploaded to and stored on Echo’s servers as an encrypted-in-transit media backup, so you can sync and restore them across your devices. Free accounts include a small backup quota; Echo Pro raises it to 2 GB. Media backup is tied to being signed in — signed out, attachments stay only on that device.
Social (Optional)
- Profile display name and bio
- Follows, shared reflections, reactions, comments, and notifications
Operate the optional social features when you choose to share a reflection.
Identifiers & Diagnostics
- Push notification token
- First-party product/usage events (event name and properties)
Deliver reminders and understand feature usage. Analytics is stored in our own server, not a third-party SDK.
Purchases
- Subscription tier, status, expiry, and product identifier
Manage premium subscriptions via Apple/Google through RevenueCat.
What we do NOT do
- Photo and voice attachments are uploaded only when you are signed in (media backup). Signed out, they stay on your device; you can delete backed-up media, which removes it from your account.
- Your App Lock PIN is hashed on your device and never transmitted.
- If you use your own AI key, it is stored in your device keychain and used only to call the provider directly.
- AI features are optional and do nothing without a key configured; we do not sell your data.
Third parties who process your data
We share data only with the processors below, each bound to use it only to provide their service to us. Items marked "unverified" are placeholders we must confirm and name before this policy is treated as final.
- Anthropic (Claude) — Generate AI reflections and answer “Ask your Journal” — your entry text is sent only when AI features are enabled
- RevenueCat — Subscription billing via Apple/Google in-app purchases
- Expo — Push notification delivery (via Apple/Google)
How we use your information
- Operate and personalize the app and its core features.
- Maintain your account, authenticate sessions, and provide support.
- Process payments and manage subscriptions/entitlements.
- Keep the service secure and prevent fraud and abuse.
- Comply with legal obligations and enforce our Terms of Service.
- Improve the product through aggregated, de-identified analytics.
Data retention
We keep personal information only as long as needed to provide the service. Account data is retained while your account is active and for a short recovery window after deletion, then deleted or anonymized. Billing records are retained as required by tax and accounting law. Backups are purged on a rolling basis.
Your rights and choices
Depending on your jurisdiction you may access, correct, export, or delete your personal data, object to or restrict certain processing, and withdraw consent. You can delete your account and its server-side data from within the app, or by emailing us. We respond within 30 days.
Children’s privacy
The app is not directed to children under 13 (under 16 in the EEA/UK) and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.
Security
We use industry-standard safeguards including TLS in transit, encryption at rest for sensitive fields, hashed passwords, least-privilege access, and audit logging. No system is 100% secure; please use a strong, unique password.
Changes to this policy
We may update this policy. Material changes will be reflected by a new "Last updated" date and, where required, announced in the app.
Contact
Privacy questions? Email caelum0x42@gmail.com.