Privacy Policy
Last updated: July 6, 2026
Echo is a journal. What you write in it is yours. This page explains exactly what we collect, where it goes, and how to delete it — in plain language, because you should actually be able to read this.
What Echo stores
- Your account — email address and login credentials (handled by Supabase, our database provider)
- Your journal — entries, conversations with Echo, and the mood scores and themes Echo derives from them to power your insights
- Your settings — preferences like notification times and toggles
What Echo doesn't store
- Your voice. When you speak to Echo, audio is sent transiently for transcription and then discarded. We keep the transcript — the words — not the recording. Echo's spoken replies are also never saved.
- Your location. If you turn on weather-aware notifications, your approximate location (rounded to about 1 km) is sent to a weather service (Open-Meteo) to fetch the forecast, used once, and never stored. Weather nudges are off by default.
- Anything for advertising. Echo contains no ads, no analytics, no trackers, and no crash-reporting SDKs. We don't sell or share your data with anyone for marketing. Full stop.
Who processes your data
Echo runs on a small set of services, each doing one job:
- Supabase (EU region) — stores your account and journal
- Anthropic — provides the AI that Echo uses to respond to your entries
- OpenAI — transcribes your voice and generates Echo's speech
- Vercel — hosts Echo's backend
- RevenueCat — handles subscriptions (Echo is currently free; this becomes relevant only if you subscribe to a paid tier in the future)
Echo's replies are generated by AI — a thoughtful one, but not a person and not a professional.
Your journal content is sent to Anthropic and OpenAI only to produce Echo's responses — it is not used to train their models. Each provider retains API data briefly for abuse monitoring (up to ~30 days) under their own policies, then deletes it.
Where your data lives
Echo operates in the European Union. Your journal is stored in Supabase's EU region.
How long we keep it
Until you delete it. When you delete your account, your account and all journal data are permanently deleted from our database. Standard database backups age out within about 30 days, after which no copy exists.
Deleting your account
You can delete your account and all your data from inside the app: You tab → Delete account. There's no retention trick — deletion is deletion.
Your rights
Under GDPR you can access, correct, export, or erase your data, and you can complain to your local data-protection authority. For any of this, or any question at all: hello@hiecho.app.
Legal basis, briefly
We process your data to provide Echo (contract), and where you opt in — like weather notifications — on your consent, which you can withdraw anytime by turning the feature off.
Age
Echo isn't intended for children under 16.
Changes
If this policy changes meaningfully, we'll say so in the app — not bury it.