Privacy Policy

Echo

Last updated: 2026-08-27

This Privacy Policy explains what information Echo (operated by Erebos Lab) collects, how it is used, who it is shared with, and the choices you have. By using Echo you agree to the practices described here.

Data-safety summary

At a glance, here is the data the app collects, whether it is linked to your identity, and whether it is used to track you across other companies’ apps and websites.

Data category	Linked to you	Used for tracking	Purpose
Contact Info	Yes	No	Optional account creation and cross-device sync. Echo is fully usable offline with no account.
User Content (Journal)	Yes	No	Sync your journal across devices and power AI reflections — but only when you are signed in. Journal entries are sensitive personal content and are treated as such.
Social (Optional)	Yes	No	Operate the optional social features when you choose to share a reflection.
Identifiers & Diagnostics	Yes	No	Deliver reminders and understand feature usage. Analytics is stored in our own server, not a third-party SDK.
Purchases	Yes	No	Manage premium subscriptions via Apple/Google through RevenueCat.

What we collect

Contact Info

• Email address and password (only if you create an account for cloud sync)

Optional account creation and cross-device sync. Echo is fully usable offline with no account.

User Content (Journal)

• Entry text/transcript, title, mood, tags, duration, favorites, and timestamps
• AI reflection and summary text
• “Ask your Journal” chat conversations

Sync your journal across devices and power AI reflections — but only when you are signed in. Journal entries are sensitive personal content and are treated as such.

Social (Optional)

• Profile display name and bio
• Follows, shared reflections, reactions, comments, and notifications

Operate the optional social features when you choose to share a reflection.

Identifiers & Diagnostics

• Push notification token
• First-party product/usage events (event name and properties)

Deliver reminders and understand feature usage. Analytics is stored in our own server, not a third-party SDK.

Purchases

• Subscription tier, status, expiry, and product identifier

Manage premium subscriptions via Apple/Google through RevenueCat.

What we do NOT do

• Your voice recordings and audio never leave your device — audio is never uploaded.
• Your photo attachments stay on your device and are never uploaded.
• Your App Lock PIN is hashed on your device and never transmitted.
• If you use your own AI key, it is stored in your device keychain and used only to call the provider directly.
• AI features are optional and do nothing without a key configured; we do not sell your data.

Third parties who process your data

We share data only with the processors below, each bound to use it only to provide their service to us. Items marked "unverified" are placeholders we must confirm and name before this policy is treated as final.

• Anthropic (Claude) — Generate AI reflections and answer “Ask your Journal” — your entry text is sent only when AI features are enabled
• RevenueCat — Subscription billing via Apple/Google in-app purchases
• Expo — Push notification delivery (via Apple/Google)

How we use your information

• Operate and personalize the app and its core features.
• Maintain your account, authenticate sessions, and provide support.
• Process payments and manage subscriptions/entitlements.
• Keep the service secure and prevent fraud and abuse.
• Comply with legal obligations and enforce our Terms of Service.
• Improve the product through aggregated, de-identified analytics.

Data retention

We keep personal information only as long as needed to provide the service. Account data is retained while your account is active and for a short recovery window after deletion, then deleted or anonymized. Billing records are retained as required by tax and accounting law. Backups are purged on a rolling basis.

Your rights and choices

Depending on your jurisdiction you may access, correct, export, or delete your personal data, object to or restrict certain processing, and withdraw consent. You can delete your account and its server-side data from within the app, or by emailing us. We respond within 30 days.

Children’s privacy

The app is not directed to children under 13 (under 16 in the EEA/UK) and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

Security

We use industry-standard safeguards including TLS in transit, encryption at rest for sensitive fields, hashed passwords, least-privilege access, and audit logging. No system is 100% secure; please use a strong, unique password.

Changes to this policy

We may update this policy. Material changes will be reflected by a new "Last updated" date and, where required, announced in the app.

Contact

Privacy questions? Email [email protected].