Privacy Policy

1. The short version

• Almost everything you put into Echo, like your habits, journal, moods, memories and conversations, is stored on your phone, not on our servers.
• To answer you, Echo sends what’s needed for that moment to our AI and voice providers. We don’t store those requests, and our providers don’t use them to train their models.
• An account is optional. If you sign in, we keep a backup of your Echo so you can restore it. You can delete it any time.
• No ads, no tracking across apps, no selling or renting your information, ever.
• Health information is read only with your permission, used only to make Echo work for you, and never used for advertising.

2. Information that stays on your phone

Echo stores the following in a private database on your device. It doesn’t leave your phone except as described in sections 3 and 4, or in your backup if you sign in (section 5):

• Your answers when you set up Echo, such as your name for Echo, your age range, gender, goals, main challenge and preferred tone
• Your habits, tasks, routines, check-offs, streaks, days off and challenges
• Mood check-ins and tags, journal pages and Echo’s replies, letters, adventures, mantras and stories
• What Echo remembers from your conversations (“memories”), and the text of your conversations
• Echo’s growth, XP, sparks, items, places, souvenirs and quests
• Your settings, reminders, alarm settings and the reference photo for the wake-up challenge
• Steps, sleep and workout summaries read from Apple Health or Health Connect

Deleting the app deletes this information from your phone. If you don’t have an account, we can’t recover it.

3. Information sent to provide a feature

Some features need a server to work. When you use them, the app sends only what that feature needs, through our server, to the provider that does the work. We don’t store the content of these requests. Our server logs only technical details, such as which feature was used, when, by which anonymous account, and how much text the AI produced, to keep the Service running, prevent abuse and control costs.

Talking with Echo (text or voice): what you said, your Echo’s name and personality, the time of day, today’s habits and progress, your current mood and energy, a few memories related to what you said, your recent steps and hours of sleep if you’ve connected health data, and your preferred tone.

Voice: while a voice conversation is open, your speech is streamed for real-time transcription, and Echo’s replies are turned into speech. Audio is processed to provide the feature and is not stored by us.

Journal: the page you wrote and your mood that day, so Echo can reply.

Weekly letter, evening adventure, daily mantra and morning note: a short summary of your week or day (such as habits completed and Echo’s mood) and a few memories, so Echo can write something personal.

Adding a habit by chat: what you wrote about the habit you want.

Wake-up challenge: the photo you take, and the reference photo if you set one, so AI can check it matches. Photos are checked and never stored on our servers.

Focus sessions: the session’s start and end time, how it appears on your lock screen, and a push token from Apple, so the Dynamic Island can count down while Echo is closed. This is deleted about a day after the session ends.

4. Information we keep on our servers

Anonymous identifier: when you first open Echo, our server gives your device a random anonymous ID so that features like talking with Echo, friends and focus sessions can work. It isn’t linked to your name or contact details unless you sign in.

Friends: if you use friends, we keep your friend code, your Echo’s name, look, growth stage and level, a number for how full Echo’s day is, the list of your friends and the good vibes you send and receive. Your friends see your Echo’s card; they never see your habits, moods, journal, memories or conversations.

Account: if you sign in with Apple or Google, we keep your account identifier and the email address the provider shares with us. With Sign in with Apple, you can choose to hide your email, and we then receive a private relay address.

Backup: if you’re signed in, we keep a copy of the information described in section 2, so you can restore your Echo on a new phone. It is updated from time to time while you use Echo and when you leave the app.

5. Information we don’t collect

• We don’t use advertising, ad identifiers or cross-app tracking, and we don’t show ads.
• We don’t use third-party analytics or profiling tools.
• We don’t access your location, contacts, photo library or calendar.
• We don’t receive or store your payment card details: Apple and Google handle all payments.
• We don’t record you outside a voice conversation you start.

6. Health information

If you choose to connect Apple Health (iPhone) or Health Connect (Android), Echo reads your step count, sleep and workouts. Echo never writes to them, and never reads other health records.

We use this information only to provide features to you: setting Echo’s energy, checking off matching habits and helping Echo talk about your day. A brief summary (steps and hours of sleep) is included when you talk with Echo, as described in section 3.

We never use health information for advertising, marketing or data mining, never sell it, and never share it with anyone except the providers that process it for us to run the feature. We don’t store it in iCloud. You can turn access off at any time in your phone’s Health or Health Connect settings.

7. Sensitive information

Mood check-ins, journal pages, conversations, memories and health information may reveal sensitive information about your health, wellbeing or personal life. Echo processes it only because you choose to share it, to provide the features you use, and you can stop at any time. Where the law requires explicit consent for this, you give it by choosing to use these features, and you can withdraw it by not using them, turning off health access or deleting your information.

Please don’t share other people’s sensitive information without their permission.

8. Our service providers

We use carefully chosen providers who process information on our behalf, under contracts that limit their use of it to providing their service to us:

• Anthropic (United States): the Claude AI models that write Echo’s replies, letters, stories, mantras and notes, and check wake-up photos. Under Anthropic’s commercial terms, information sent through its API is not used to train its models, and is kept only for a limited time for safety and abuse monitoring, as described in Anthropic’s policies.
• ElevenLabs (United States or European Union): real-time speech-to-text and Echo’s voice. It processes audio and text to provide this service under its own terms and privacy policy.
• Supabase (servers in Singapore): our server, database and sign-in, which host the information described in section 4 and pass requests to the providers above.
• Apple and Google: sign-in, the app stores, payments, notifications and the Dynamic Island, under their own privacy policies.

We may also share information if the law requires it, to protect anyone’s safety, rights or property, to prevent fraud or abuse, or as part of a merger, acquisition or sale of assets, in which case this Policy will continue to protect it. We never sell your personal information or share it for cross-context behavioral advertising.

9. International transfers

Our providers process information in countries other than where you live, including the United States, Singapore and countries in the European Union, which may have different data protection laws. When we transfer personal information from the European Economic Area, the United Kingdom, Switzerland or Israel, we rely on appropriate safeguards, such as adequacy decisions or the European Commission’s Standard Contractual Clauses and their UK equivalent, and on our providers’ data processing terms.

10. Why we use your information (legal bases)

We use your information to provide and personalize Echo, to back it up and restore it if you ask, to run friends, reminders and focus sessions, to keep the Service secure and working, to answer you when you contact us, and to comply with the law.

If you’re in the European Economic Area, the United Kingdom or a similar jurisdiction, we rely on: performing our contract with you (providing the features you use); your consent, including explicit consent for health and other sensitive information, which you can withdraw at any time; our legitimate interests in keeping Echo secure, preventing abuse and improving it, balanced against your rights; and legal obligations.

Echo’s AI personalizes what Echo says, but it never makes decisions that have legal or similarly significant effects on you.

11. How long we keep information

• On your phone: until you delete it or the app.
• Feature requests (section 3): not stored by us; providers keep them only as their policies describe.
• Focus sessions: deleted about a day after the session ends.
• Anonymous identifier, friends and backup: until you delete your account, or after a long period of inactivity, after which we may delete them.
• Server logs: for a limited period, usually no more than 90 days.

When you delete your account in Settings, we delete your backup, friend profile, friendships, vibes and sign-in account right away. Copies may remain in our providers’ encrypted backups for a short period before they are overwritten.

12. Security

We protect information with encryption in transit (HTTPS), encryption at rest on our servers, access controls that let each account reach only its own data, and by keeping our provider keys on the server, never in the app. Your phone’s own security, such as a passcode, also protects what Echo stores on it. No system is perfectly secure, but we work to keep yours safe and will notify you and the authorities of a data breach where the law requires.

13. Your choices and rights

In the app, you can sign out, delete your account and everything we keep for it, turn off health access, notifications and the microphone or camera in your phone’s settings, remove friends, and delete the app to erase what’s on your phone.

Depending on where you live, you may have the right to access your personal information, correct it, delete it, receive a copy in a portable format, restrict or object to its processing, withdraw consent, and not be discriminated against for using these rights. This includes rights under the EU and UK General Data Protection Regulation, the Israeli Protection of Privacy Law, 5741-1981, and its regulations, the California Consumer Privacy Act and other U.S. state privacy laws.

To use any of these rights, email us at support@echotruecompanion.com. Because we know very little about you, we may ask for information that helps us find your data, such as your friend code or the email of your Apple or Google account, and to verify the request. We’ll answer within the time the law requires, usually within 30 days. You may also use an authorized agent where the law allows. If you’re not satisfied, you can complain to your data protection authority, such as the Israeli Privacy Protection Authority or your local authority in the EU or UK.

14. Consumer health data (U.S. states)

Some U.S. state laws, such as Washington’s My Health My Data Act and similar laws in Nevada and Connecticut, protect “consumer health data”. Mood check-ins, journal entries, conversations about your wellbeing, and steps, sleep and workout information may count as consumer health data.

We collect this data from you and from Apple Health or Health Connect, with your permission, only to provide the features you ask for, as described in sections 3, 4 and 6. We share it only with the service providers in section 8 who process it for us. We never sell it. You can access or delete it, and withdraw your consent, as described in section 13, and we will not discriminate against you for doing so.

15. Children

Echo is not meant for children under 13, and we don’t knowingly collect personal information from them. Teenagers under 18 may use Echo with a parent’s or guardian’s permission. If you believe a child under 13, or under the age of digital consent where you live, has used Echo without a parent’s consent, contact us and we’ll delete their information.

16. Changes to this Policy

We’ll update this Policy when Echo changes what it uses or sends, and show the latest date at the top. For material changes we’ll tell you in the app before they take effect, and ask for your consent where the law requires.

17. Contact

Hen David, the developer of Echo, is responsible for your information. Email: support@echotruecompanion.com