Privacy Policy

Last Updated: July 8, 2026

1. Information We Collect

Account Information:

• Email address (from Google Sign-In)
• Name and profile picture (optional, from Google)
• Account creation date

Voice Notes and Content:

• Audio recordings of your voice notes
• Transcriptions of your voice notes
• AI-generated titles, tags, and insights
• Note metadata (creation date, classification)

Usage Data:

• App interactions and feature usage
• Device type and operating system version
• Session logs and error reports
• Subscription status and purchase history

Photos (Pro feature):

• Photos you attach to voice notes are uploaded to and stored on our servers to display within the app
• Photos are only uploaded when you explicitly attach them to a note
• Photos are deleted when the associated note is deleted or your account is deleted

We Do NOT Collect:

• Precise geolocation or GPS coordinates
• Contacts or calendar data
• Photos from your device library without your explicit action
• Browsing history or data from other apps

2. How We Use Your Information

We use your data to:

• Provide the Service: Transcribe voice notes, generate AI insights, sync across devices
• Improve Echo: Analyze usage patterns to enhance features (anonymized data only)
• Communicate: Send important updates, subscription notifications, and support responses
• Prevent Abuse: Detect fraudulent accounts and enforce our Terms of Service

3. Third-Party Services

Echo uses the following third-party services to operate:

Google OAuth (Authentication): We use Google Sign-In to verify your identity. Google may collect login data according to their Privacy Policy.

OpenAI (Transcription & Insights): Your voice notes are sent to OpenAI's API for transcription and AI analysis. OpenAI processes data according to their privacy policy and does not retain your data after processing.

RevenueCat (Subscriptions): Manages in-app purchases and subscriptions. RevenueCat collects subscription status and purchase events. See RevenueCat Privacy Policy.

Neon Database (Storage): Your data is stored on Neon's secure PostgreSQL servers (AWS US region). See Neon Privacy Policy.

Vercel (Hosting): Our backend API runs on Vercel's infrastructure. See Vercel Privacy Policy.

4. Data Retention

• Active Accounts: We retain your data as long as your account is active
• Deleted Accounts: In-app deletion is immediate and permanent. Email-based deletion requests are processed within 30 days.
• Subscription Data: Purchase history retained for 7 years for tax compliance
• Backups: Deleted data may persist in encrypted backups for up to 90 days

5. Data Security

We protect your data using industry-standard security measures:

• HTTPS encryption for all data in transit
• AES-256 encryption for data at rest
• Secure authentication tokens (OAuth 2.0)
• Regular security audits and updates
• Access controls limiting employee access to user data

However, no method of transmission or storage is 100% secure. You use Echo at your own risk.

6. Your Rights

You have the right to:

• Access Your Data: Request a copy of your data via email
• Delete Your Data: Delete your account and all associated data from Profile settings in the app, or visit our account deletion page for instructions
• Correct Your Data: Edit or update your voice notes at any time
• Export Your Data: Request a data export in JSON format
• Opt-Out: Disable analytics or marketing emails in settings

For GDPR (EU) or CCPA (California) requests, contact privacy@serpmonk.app

7. Children's Privacy

Echo is NOT intended for children under 13 years old. We do not knowingly collect data from children. If we discover a child's account, we will delete it immediately. Parents: if you believe your child has created an account, contact us at privacy@serpmonk.app.

8. International Users

Echo is operated in the United States. If you are located outside the U.S., your data will be transferred to and processed in the United States. By using Echo, you consent to this transfer.

9. California Privacy Rights (CCPA)

California residents have additional rights:

• Request disclosure of data collected, used, and shared
• Request deletion of personal information
• Opt-out of data "sales" (Note: we do not sell your data)

To exercise these rights, email privacy@serpmonk.app with "CCPA Request" in the subject line.

10. European Privacy Rights (GDPR)

EU residents have rights under GDPR:

• Right to access, rectify, or erase personal data
• Right to data portability
• Right to object to processing
• Right to withdraw consent

To exercise these rights, email privacy@serpmonk.app with "GDPR Request" in the subject line.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via email or in-app notification. Continued use after changes constitutes acceptance.

12. Contact Us

For privacy questions or concerns, contact us:

• Email: privacy@serpmonk.app
• Support: support@serpmonk.app

© 2026 Echo. All rights reserved.