Echo — Privacy Policy

Last updated: 2026-08-02 Contact: canthou.echo@gmail.com

The short version

Echo records what you say, sends that recording to Google to turn it into a reminder, and gets an answer back. We do not keep the recording, and we do not keep the reminder. Both stay on your phone. What our server keeps is the minimum needed to know who you are and how many captures you have used today.

We have no analytics, no advertising, no crash-reporting SDK, and no tracking of any kind. This is verifiable: pubspec.yaml contains no analytics, Firebase, Crashlytics, Sentry or similar dependency.

1. What stays on your phone, and never leaves it

These never reach our server:

Data	Where
Your voice recordings	App storage (`recordings/`). Kept so a reminder can play back in your own voice.
Your reminders — titles, text, times, categories	App storage (`reminders.json`)
Diagnostic logs	App storage (`logs/echo.log`), capped at ~6 MB and rotated. Only ever leaves your phone if you copy and send it.
Your settings	Android `SharedPreferences`

If Android's system backup is enabled on your device, Google may include your reminders and settings in your own Google account backup. That is Android's backup, not ours — we never see it. Recordings are excluded from it.

Deleting the app deletes all of the above.

2. What we send to Google (Gemini), and what happens to it

When you record a reminder, the audio is sent — over HTTPS — to our server, which immediately forwards it to Google's Gemini API to be transcribed and turned into a structured reminder. The result comes straight back to your phone.

Our server does not store the audio or the transcript. It holds them in memory only for the duration of the request. This is not a policy claim you have to trust: the database schema in server/db.py has no column for audio, transcripts or reminder text, and server/gemini.py writes nothing to disk.

Google processes this audio under the paid Gemini API terms. Echo runs on a paid Gemini plan, under which Google does not use this data to train or improve their models. That is the single most important sentence in this policy, and it is only true because the account is paid — the free tier carries no such guarantee.

The terms are Google's Gemini API Additional Terms of Service, which say of paid services: "Google doesn't use your prompts … or responses to improve our products." The unpaid tier says the opposite in the same document — so if the billing plan ever changes, the paragraph above becomes false and must change with it. (Link and wording verified 2026-08-02.)

We never send your recordings anywhere else, to anyone else, for any purpose.

3. What our server stores about you

The complete list, from the schema:

Data	Why	Table
Your Google account ID (an opaque identifier)	To recognise you across sign-ins	`users.google_sub`
Your email address	To contact you about the waitlist or your account	`users.email`
Account status and tier	Waitlist and access control	`users.status`, `users.tier`
Account creation date	Waitlist ordering	`users.created_at`
How many captures you made each day — a number only	To enforce the daily allowance	`usage_daily`
Which days you tapped "claim free captures"	So the bonus cannot be claimed twice a day	`daily_claims`
Who invited you / whom you invited	The referral bonus	`referrals`
Your invite code	So it stays the same each time you open the screen	`users.invite_code`
Bonus captures you have spent — a number	So a one-time bonus is not granted twice	`users.bonus_spent`
Your lifetime capture and active-day counts — two numbers	Decides when a friend's invite has earned its bonus; shown to you on the invite screen	`users.lifetime_captures`, `users.lifetime_days`

That is the complete list of what we store about your account. No reminder content, no transcripts, no audio, no location, no contacts, no device identifiers, no advertising ID.

Server logs

Like essentially every website, our server keeps short-lived technical logs of the requests it receives. Each line records the IP address the request came from, the time, which endpoint was called and whether it succeeded — never the audio, the transcript or anything you said.

They exist so we can tell a real outage from an attack and fix things when they break, and we keep them no longer than needed for that. We do not use them to build a profile of you, and we do not combine them with your account record.

An IP address counts as personal data under GDPR, which is why it is named here rather than filed under "technical details". Our lawful basis is legitimate interest in keeping the service running and secure (§5).

We also keep two anonymous tables — how many people used Echo on a given day, and how long each signup group kept using it. They carry no account id, no email and nothing else that could point back to a person, which is why they are kept after the per-person rows are deleted. See §4.

We never sell your data, never share it with advertisers, and never use it to build a profile of you.

4. Retention — how long we keep things

Recordings and reminders: kept on your phone until you delete them or uninstall Echo. We never had a copy, so we cannot delete one for you.
Audio sent for transcription: not retained by us at any point. Google's retention is governed by their API terms (see §2).
Account record (email, Google ID): kept until you ask us to delete it, then removed within 30 days. We do not delete accounts automatically for inactivity.
Daily usage counts: kept for 90 days, then deleted. Before deletion they are rolled into anonymous totals that carry no user id — how many people used Echo on a given day, and how long each signup group kept using it. Those totals are not personal data and are kept indefinitely. The same 90-day limit applies to the record of which days you claimed your free captures.
Server logs (IP address, time, endpoint): kept at most 30 days, then deleted automatically. Both sinks are bounded — the systemd journal by MaxRetentionSec=30d, and nginx by daily rotation with maxage 30.
Referral records: deleted along with the account that asks to be removed. The other person keeps any bonus already granted — users.bonus_spent is a plain counter, so nothing breaks when the referral row goes.

5. Your rights

You can, at any time:

See what we hold — Settings → Account shows your email and today's usage.
Delete everything on your phone — uninstall Echo.
Delete your account and everything we hold — Settings → Account → Delete account. It removes your account record, your usage counts, your invite code and your referral links immediately, not on a queue. If you have already uninstalled Echo, use https://echo.canthou.dev/delete-account or email us, and we act within 30 days.
Withdraw consent — stop using voice capture; typed reminders never involve Google at all.

Our lawful basis for processing (GDPR Art. 6)

Your voice recordings and what we do with them: consent. You give it by choosing to record; you withdraw it by not recording. Typed reminders never involve Google at all, so withdrawing costs you the voice feature and nothing else.
Your account record — email, Google ID, capture counts: contract. We cannot give you an account, a place in the waitlist, or a daily allowance without keeping these. They are the service, not an extra.
The anonymous daily and cohort totals: legitimate interest in knowing whether Echo works well enough to keep building. They carry no identifier, so there is nothing in them to object to — but the basis is named for completeness.

6. Children

Echo is not directed at anyone under 16, and we do not knowingly collect their data. If you believe a child under 16 has given us data, contact us and we will delete it.

7. Changes

If this policy changes materially — especially anything in §2 or §4 — we will say so in the app before the change takes effect, not only by editing this page.