Privacy Policy

The short version: Echo never stores what you write. Your selected text is sent, encrypted, to our backend and an AI provider for the seconds it takes to generate your result, and is never logged or kept. Your history lives only on your Mac. Our cloud database physically has no columns for text.

Who we are

Echo is a macOS application operated by Echo ("Echo", "we"). For anything in this policy, contact us at [email protected].

What we process, and where it goes

Your selected text and results. When you run a tool, the text you selected (plus any instruction you typed) is sent over HTTPS to our backend, which forwards it to our AI provider to generate the result. It is processed transiently: our backend does not store it and does not write it to logs (we log only request status and text length). Results return to your Mac and exist server-side only for the duration of the request.

Your history. The app saves your prompts and results in a local database on your Mac, so you can revisit them. This history is never synced or uploaded. You can delete entries in the app at any time, or remove everything by deleting the folder ~/Library/Application Support/Echo/.

Account data. If you sign in, we hold your email address, name, and an account identifier (via Google sign-in or an email sign-in link).

Usage metadata. For each request by a signed-in user we record which tool was used, input/output word counts, and a timestamp — never the content. Our database schema contains no text columns, so message content cannot be stored even by mistake.

A device identifier. The app generates one random identifier per installation, used solely to count requests. It is not derived from your hardware and identifies nothing but itself.

Payments. Purchases are processed by Lemon Squeezy as merchant of record. Card details go to Lemon Squeezy, never to us; we receive only your subscription status.

Website. We run no analytics or tracking scripts and set no marketing cookies. The account page stores your sign-in session in your browser's local storage.

Service providers

We rely on a small number of service providers to run Echo, each processing only what its role requires: cloud infrastructure running our backend, authentication, and database (metadata only); an AI provider that generates your results (these requests carry no account identity — only the text and instruction needed for the result); a payment provider (Lemon Squeezy, as merchant of record); and website hosting. We share nothing with anyone else.

Retention and deletion

Text: not retained by us — it lives on your device, under your control. Account data and usage metadata: kept while your account exists; deleting your account removes them (associated rows are deleted with it). To delete your account, contact [email protected].

Legal bases

We process the data above to provide the service you asked for (performance of contract) and to protect the service from abuse (legitimate interest). We do not sell personal data, run advertising, or use your text to train AI models.

Security

All traffic is encrypted in transit (HTTPS). AI credentials exist only server-side, never in the app. Database access is restricted per-user at the row level. No user content appears in logs.

Your rights

Depending on where you live (including under the GDPR), you may have rights to access, correct, delete, or export your personal data, and to object to processing. Write to [email protected] and we will act on it. You also have the right to complain to your local data-protection authority.

Children

Echo is not directed at children under 16, and we do not knowingly process their data.

Changes

If this policy changes materially, we will update this page and note the new date above.