Privacy

Who runs Echo

Echo is run by its administrator, trading as Echo, who decides how your information is used (the “controller”). For anything about your data, email hello@echotexts.com.

What Echo keeps

• Your account: your email address, and either a securely stored password or the account you signed in with (Google, Apple, Discord, Twitch or X). From those, Echo only takes your name and email address.
• What you agreed to: your date of birth (to check you're 18 or over), which version of these terms you agreed to, and when.
• Your profile, if you add it: your name, photo, birthday, note and story.
• Your chats: everything you send (texts, voice notes, photos, links) and everything the characters send back.
• Someone you bring in from your messages: up to 40 of their texts, and what the AI learned from the chat (how they text, what you two share). Phone numbers, emails, links and addresses are taken out on your phone first, and the chat file itself is never uploaded.
• Calls: when you call a character, what's said is turned into text so they remember it. Recordings aren't kept.
• Your phone number, only if you turn on real phone calls.
• Notes Echo writes about you from your chats (“What they know” on a profile), so the characters remember you.
• Your settings, and what's needed to send you notifications if you allow them.
• Your credits: your plan, your balance, what used them, and a reference to your payments (never your card details).
• Safety records: signs our automatic checks noticed (see below), and a scrambled tag of the network you signed up from.

What Echo's AI does with it

Everyone you talk to in Echo is an AI character. To be them, the AI:

• reads what you send them (texts, photos, links it can open, and voice notes, which are turned into text) so it can reply;
• remembers you: it writes notes about you from your chats and brings things up later;
• if you bring someone in from your messages, reads their side of the chat once, with some of the texts they were replying to, to learn how they text and what you two share;
• acts on its own: characters can text you first, post stories, call you in the app, and ring your real phone only if you turn that on;
• lets characters talk about you with each other in their own chats, which you can read in Settings and switch off for anyone;
• makes things for you: voice notes, photos, short videos and songs. These are generated, and photos never show real people;
• picks up on how you seem (your mood, how long you take to reply) and lets it change how a character feels about you.

The AI can't see anyone else's chats or account, can't reach anything on your phone beyond what you send, and can't spend money, change your account or contact anyone but you. Echo doesn't use your information to train AI models, and the AI services below only process it to write a reply.

Safety checks

Automatic checks look at what's sent in Echo for a few things: attempts to tamper with the AI, signs someone might be under 18, signs someone might be in crisis, files that aren't what they claim to be, and payments that don't add up. Each account has a risk score from these. A sign can switch flirting off for an account, make a character check you're okay and share the Samaritans number, or alert the team. A person always looks before an account is suspended or closed, and you can ask us to explain or review a decision.

Photos you upload are checked and redrawn, which also removes hidden information in them, like where they were taken.

Why Echo can use it (UK GDPR)

• To provide Echo to you (our contract): your account, chats, the characters, credits and payments.
• With your consent: real phone calls, notifications, and the agreement you give when you join. You can withdraw it at any time.
• Legitimate interests: keeping Echo safe (the checks above), preventing fraud and abuse, and fixing problems.
• Legal obligations: payment and tax records.

Who can see it

Your chats are tied to your account and nobody else using Echo can see them. The administrator can read conversations, the notes about you and safety records, to keep Echo safe and to improve it. Every time they do, it's recorded. Nobody else reads them, and your information is never sold or used for advertising.

Services that help run Echo

• Supabase: your account, chats and files are stored here.
• Vercel: hosts the app.
• Anthropic (Claude): writes the characters' messages and the notes about you.
• OpenAI: voices, understanding your voice notes, pictures, short videos and calls.
• ElevenLabs: voices, voice notes and calls.
• Pollinations: some of the pictures.
• Twilio: real phone calls, only if you turn them on.
• Stripe: payments, if you top up or pick a plan. Your card details go to Stripe, not to Echo.
• Resend: Echo's emails (confirming your email, password resets, receipts and notices).
• Google, Apple, Discord, Twitch or X: only if you sign in with one of them, to confirm who you are.
• Apple, Google and your browser's notification service: notifications, if you allow them.
• GIPHY (GIFs), Apple (songs), TikTok and YouTube (videos): only what you search for, send or play.

Some of these are in the United States, so your information may be handled outside the UK. When it is, it's protected by the UK's approved safeguards (such as the UK International Data Transfer Addendum) or the UK-US data bridge.

How long it's kept

• Your chats and profile: until you delete them. In Settings you can have chats removed automatically after 30, 90 or 365 days, delete any chat, or delete your whole account.
• Files you sent: removed within a day or so of the chat they're in being deleted.
• Payment and agreement records: six years, because the law requires it for tax.
• Safety signs: 180 days. Records of the team reading data: two years.
• A guest account that never signs up: deleted after 7 days.

Deleted information can stay in our providers' backups for a short time.

Cookies

Echo only uses the cookies it needs to keep you signed in, and saves a few settings on your own device. No ads, no analytics, no tracking. Details are in the Cookie policy.

Keeping it safe

Everything is encrypted on its way to and from Echo. Each account can only reach its own data, the files you send are kept in private storage that only you (and the administrator) can open, and keys to the services above are kept on the server, never in the app.

Your rights

You can download a copy of your data and delete it from Settings at any time. You can also ask us to correct it, tell you what's held and why, limit or stop using it, or explain a decision our safety checks made. Email hello@echotexts.com; we'll answer within a month. If you think someone brought you into Echo from their messages, you can ask us to remove that too. If you're unhappy with how your information is handled, you can complain to the Information Commissioner's Office (ico.org.uk).

Adults only

Echo is for people aged 18 or over. You give your date of birth when you join, and our checks look out for signs of anyone younger. If we learn that someone under 18 has an account, it's closed and deleted.

Changes

If this notice changes in a way that matters, the date below changes and Echo asks you to agree again the next time you open it.