Marlo

Echo – Privacy Policy

Effective Date: [DATE] Last Updated: [DATE]

1. Who We Are

Echo is operated by [YOUR LLC NAME] ("Echo," "we," "us," "our"), a [STATE] LLC. Contact: [SUPPORT EMAIL].

2. What This Policy Covers

How we collect, use, share, and protect personal data when you use Echo (web app, iOS app, and related services).

3. Information We Collect

Information you provide

  • Account info: name, email, password (hashed), Sign in with Apple/Google identifiers
  • Profile and personalization: nickname, persona choice, style preferences, sample writings
  • Audio recordings you create
  • Transcripts and journal entries generated from your audio
  • Saved recipients (names, email, phone numbers you add)
  • Payment info: handled by Stripe and/or Apple — we do not store card numbers
  • Support communications

Information collected automatically

  • Device info: model, OS version, app version, language, timezone
  • Usage data: features used, recording minutes, errors, crash reports
  • Log data: IP address, timestamps
  • Cookies and similar technologies (web only)

We do not use third-party advertising trackers and do not sell personal information.

4. How We Use Your Information

  • Provide, operate, and improve the Service
  • Transcribe and refine your audio (via OpenAI and Anthropic APIs)
  • Generate journal recaps, summaries, and companion responses
  • Process subscriptions and billing
  • Authenticate you and secure your account
  • Send transactional emails (verification, billing, security)
  • Respond to support requests
  • Comply with legal obligations
  • Detect fraud and abuse

5. AI Processing — Important

When you record audio:

  1. The audio is sent to OpenAI (Whisper API) for transcription
  2. The transcript is sent to Anthropic (Claude API) for cleanup, recaps, and companion responses

These providers process your content as data processors under contract. They are not permitted to train models on your content as of the Effective Date. We will update this policy if providers or terms change.

You can delete any recording or transcript at any time, which removes it from our systems.

6. How We Share Information

We share data only with:

  • Service providers acting on our behalf (Supabase – hosting/database, OpenAI – transcription, Anthropic – AI, Stripe – payments, RevenueCat – subscription management, Resend – email, Apple/Google – authentication, PostHog – analytics)
  • Legal authorities when required by law, subpoena, or to protect rights and safety
  • Successors in the event of a merger, acquisition, or asset sale (you will be notified)

We do not sell or rent personal information.

7. Data Retention

  • Account data and Your Content: retained while your account is active
  • Deleted content: removed from production systems within 30 days; backups purged within 90 days
  • Account deletion: available in-app at any time
  • Billing records: retained as required by law (typically 7 years)

8. Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your data ("right to be forgotten")
  • Export your data in a portable format
  • Restrict or object to certain processing
  • Withdraw consent
  • Lodge a complaint with a supervisory authority (e.g., EU DPA, UK ICO, California AG)

Exercise these rights in-app (Settings → Privacy) or by emailing [SUPPORT EMAIL]. We will respond within 30 days.

California residents (CCPA/CPRA): you have the right to know, delete, correct, and limit use of sensitive personal information, and to opt out of "sharing" for cross-context behavioral advertising (we do not engage in such sharing).

EU/UK residents (GDPR): legal bases for processing include performance of contract, legitimate interests, consent, and legal obligations.

9. Children's Privacy

Echo is not intended for users under 17. We do not knowingly collect data from children under 13 (or 16 in the EU). If you believe a child has provided us data, contact [SUPPORT EMAIL] and we will delete it.

10. Security

We use industry-standard safeguards: TLS in transit, encryption at rest, access controls, audit logging, and regular security review. No system is 100% secure; we cannot guarantee absolute security.

11. International Transfers

Data may be processed in the United States and other countries. For EU/UK users, we rely on Standard Contractual Clauses or equivalent safeguards.

12. Third-Party Authentication

If you sign in with Apple or Google, those providers share limited profile information with us per their policies. We do not receive your password.

13. Changes to This Policy

We may update this policy. Material changes will be communicated via email or in-app notice. The "Last Updated" date reflects the latest revision.

14. Contact

[YOUR LLC NAME] [ADDRESS] Privacy: [PRIVACY EMAIL] Support: [SUPPORT EMAIL]