Privacy Policy

Echoes · Last updated 4 July 2026

Echoes ("Echoes", "we", "us") is a personal reflection and AI-companion app. This policy explains what we collect, why, who we share it with, and the choices you have. We built Echoes to be a private space, and we keep the data we collect to what the app needs to work.

Echoes is not a medical, therapy, or crisis service. It is a self-reflection tool and does not provide medical or mental-health advice. If you are in crisis or may harm yourself, contact your local emergency number or a crisis helpline. In-app, Echoes surfaces local helpline resources when it detects you may be at risk.

1. Information we collect

Category	Examples
Account	Email address (used for one-time-code sign-in), optional display name, or a Google / Apple sign-in identifier. You can also use the app as an anonymous guest.
Content you create	Your written reflections ("echoes"), messages you send to the AI, saved "memories" (facts you tell it about yourself), mood/emotion labels, highlights, guided-session answers, and any images you choose to attach.
Voice (optional)	If you use voice mode, your audio is streamed to a speech-to-text provider to transcribe it. We do not retain the audio recording; the resulting text is treated like any other message.
Usage & technical	Message counts and limits, subscription/plan status, streaks and progress, app language, a device push-notification token (if you enable notifications), and IP address (used transiently for security/rate-limiting). Basic diagnostic logs.
Purchases	Subscription and purchase status. Payments are processed by Google Play Billing (via RevenueCat); we do not receive or store your card details.

2. How we use your information

To provide the core experience — journaling, AI conversations, weekly summaries, memory/personalization, insights, and progress.
To generate AI responses and summaries by sending your messages/reflections to AI model providers (see Section 3).
For safety — automated classification to detect harmful content and possible self-harm, so we can respond appropriately (including showing crisis resources) and prevent abuse.
To operate accounts, enforce plan limits, process subscriptions, and send notifications you have enabled.
To maintain, secure, and improve the service.

We do not sell your personal information, and we do not use your reflections to serve ads.

3. Service providers (sub-processors)

We share data only with providers that help us run Echoes, and only as needed to deliver the service:

Provider	Purpose
Supabase	Database, authentication, storage, and server functions — hosts your account and content.
AI model providers (e.g. Hugging Face / Together, Groq, ElevenLabs)	Process your messages, reflections, audio, and prompts to generate AI text, transcribe speech, and produce spoken replies.
RevenueCat & Google Play	Process and validate subscriptions and in-app purchases.
Expo / Google (push)	Deliver the notifications you opt into.

These providers may process data in the United States, the EU, or other regions. We rely on their contractual and technical safeguards for such transfers.

4. AI processing

Echoes is an AI product. When you chat, reflect, or use voice, the relevant content is sent to third-party AI models to generate a response, a summary, or a transcription. Please avoid sharing information you would not want processed by an AI service. AI output can be inaccurate and should not be relied on as professional advice.

5. Data retention & deletion

We keep your content until you delete it or delete your account. You can:

Delete your data from within the app (Profile → Delete data) — removes your reflections, memories, and history while keeping your account.
Delete your account from within the app (Profile → Delete account) — permanently removes your account and all associated content.
Request deletion by email — see our Account & Data Deletion page.

6. Security

Data is encrypted in transit using TLS. Your session is stored encrypted on your device. Access to stored data is protected by row-level security and access controls. No method of transmission or storage is completely secure, but we work to protect your information.

7. Your rights

Depending on where you live (including under the GDPR and CCPA/CPRA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise deletion in-app, or contact us using the details below. We will not discriminate against you for exercising these rights.

8. Children

Echoes is not directed to children under 13 (or under the minimum age required in your country, such as 16 in parts of the EU). We do not knowingly collect data from children below that age. If you believe a child has provided us data, contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, an in-app notice.

10. Contact

Questions or requests: privacy@echoesinteractive.com.