Privacy Policy

1Information We Collect

We collect information you provide directly, the memory content you direct Echo to store, and information collected automatically.

1.1 Information you provide. Account and contact data (name, email, username, password); your representation that you are at least 18; and the content of your support requests and other messages to us.

Some surfaces, including Echo for Mac, sign you in with a one-time code sent to your email address instead of a password. If you create or join a Workspace, we also collect the Workspace profile information you provide or approve (such as your title and a summary of your responsibilities), the invitations you create or accept, and your role in the Workspace.

Payment data. If you purchase a paid plan on our website (including from Echo for Mac, which opens our website’s checkout), payment is processed by Stripe. Your payment card details are collected and processed directly by Stripe under its own terms and privacy policy; Echo does not receive or store your full card number. We receive limited billing and transaction information (such as confirmation of payment, amount, and a card reference) to manage your subscription.

1.2 Memory content. The Service stores the content you direct it to remember, including:

• Source content — raw conversations, uploaded files, notes, prompts, and outputs you or the Service capture. Echo stores raw source conversations as a standard part of the Service, to enable re-extraction, provenance, source references, and regenerating memories for your account.
• Extracted memories — the memories and summaries Echo generates from source content.
• Embeddings and indexes — vector representations and search indexes derived from your content to enable retrieval.
• Visibility and relationship data — whether a memory is private, friend-gated, or public, and friend relationships you establish.
• Associated metadata — timestamps, source linkage, the surface a memory came from, and similar contextual information.

You retain ownership of your memory content. We process it to provide the Service, as described in this Policy.

1.3 Information collected automatically. We and our service providers may collect technical and usage information, such as device and connection data (including IP address or a privacy-safe hash) and usage and event data (such as audit events for memory creation, update, deletion, export, sharing, and connector authorization). Raw conversations, secrets, private memories, and similar sensitive content are not written to standard logs, analytics, or error trackers; those receive redacted previews, hashes, identifiers, event type, surface, and status only. Echo for Mac also generates a random installation identifier and sends it, with the app version, macOS version, and device architecture, along with its product-analytics and setup events.

1.4 Surface-specific collection.

• Chrome Extension. When you connect a supported AI chat provider — ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google), DeepSeek, Grok (xAI), or Perplexity — the Extension uses your existing logged-in session with that provider to access your conversations on your behalf, including reading your conversation list (which may include your full conversation history with that provider) so you can select which conversations to extract. You connect each provider individually; you see an indicator when the Extension is active; access in incognito is off by default. The providers are independent of Echo, which is not affiliated with or endorsed by them; your use of each provider is governed by that provider’s own terms, for which you are responsible. Extension data is not used for advertising, data brokerage, creditworthiness or lending decisions, or unrelated profiling (Chrome Limited Use).
• MCP Server / npm Package. The Echo MCP server is a user-installed npm package that lets you and agents you authorize save conversations, create, retrieve, and search memories, manage visibility, and send or respond to friend requests. Memory writes default to private. On-demand tools can read the coding-session logs your local tools (for example, Codex or Claude Code) write to named directories on your machine so you can turn them into memories or compute a context-health score when you invoke them; core memory tools do not broadly scan your filesystem. Setup may modify local configuration or instruction files for the coding agents you choose to configure. The MCP server runs as a persistent local process while in use and performs standard npm registry version checks (which do not send your personal data). Product-analytics events from the MCP tools are sent to our analytics provider as described in the Cookies, Analytics, and Diagnostics section. A broader local “Agent Doctor” scan runs only after its own separate consent and is distinct from the on-demand tools above. The MCP server does not sign in to, or retrieve conversations from, any third-party provider account on your behalf.
• Echo Context HUD (local companion). The optional Context HUD is distributed with the MCP npm package and adds a local context-health display. Unlike the on-demand MCP tools, while it is running the Context HUD reads supported local Codex and Claude coding-session files continuously, including in the background while its window is hidden, and on macOS may observe which application is in the foreground to select the session you are viewing; this observation is used locally and is not itself uploaded. These files can contain source code, credentials, or secrets. Context-health scoring is performed on your device and does not by itself upload your session contents.
  • What the Context HUD sends to Echo. While its interface is open, the Context HUD makes authenticated requests to Echo (using your stored access token) for account/plan status and to check whether the active session already has a saved checkpoint; these do not send your transcript. If you choose to start a new session with context (renewal) or create a checkpoint, it sends the active session’s user and assistant text, with client/source, session type, conversation key, and title, to Echo for AI-assisted memory extraction and storage under your account. Tool calls, tool results, and thinking blocks are kept local and are not included. This renewal is designed to occur through a user action.
  • Context HUD local storage and controls. The Context HUD stores window and display preferences, recent-session metadata (including session identifiers, titles, project labels, and source-file paths), generated carryover/checkpoint text, checkpoint-status records, and the access token used for cloud calls; carryover and checkpoint caches are kept for a limited period, and other local files may persist until you remove them. You can skip the HUD, quit it, avoid transcript upload by not invoking renewal, disable launch at login, and omit optional coding-agent hooks. Hiding the HUD or the “only show when Codex/Claude is open” option affects visibility, not local scanning. Deleting your Echo account or logging out does not by itself remove these local files; remove them by quitting the HUD, disabling launch at login, and removing the local Echo files.
• Echo for Mac. Echo for Mac is a desktop application for macOS. While it is open, it works as follows.
  • Local AI session files. Echo for Mac reads session files that supported AI tools write on your Mac — currently Claude Code (in ~/.claude/projects), Codex (in ~/.codex/sessions), and Claude Desktop (in ~/Library/Application Support/Claude) — to list your sessions, link them to your memories and Workspace tickets, and recover links between saved memories and the sessions they came from. It rescans these files periodically in the background (about every 15 seconds) while it is running. Listing sessions does not upload their content; to show which sessions you have already imported, Echo for Mac sends Echo the identifiers of the sessions it finds and which tool created them, but not their content. These files can contain source code, credentials, or secrets.
  • Importing past sessions. If you choose to import sessions — including during onboarding, where recent sessions may be pre-selected up to your plan’s allowance and you can deselect any of them or skip import — Echo for Mac sends Echo the user and assistant text of each selected session (up to about 256 KB per session), a title based on the project folder name and first prompt, the session date, and your time zone, for AI-assisted memory extraction and storage under your account. Echo does not automatically remove secrets from that text.
  • Saving and carrying over sessions. When you save a session or create a carry-over from the Echo for Mac overlay, it sends that session’s user and assistant text to Echo in the same way.
  • Search, Deep Search, and Workspaces. Your search queries are sent to Echo. Deep Search also sends the text of the memories it selects as candidates (decrypted on your Mac, if you use encryption), your name, and your time zone, so Echo can compose an answer. Workspace features send the text or files you add to a Workspace library, and Workspace briefings send your name and time zone.
  • macOS permissions and on-device signals. If you use features that switch to, or open new windows in, other AI apps, Echo for Mac asks for macOS Accessibility permission. With that permission, it reads the window titles of supported AI apps and of the frontmost window, brings windows forward, and can send a keyboard shortcut to open a new window. It reads the position (not the content or title) of on-screen windows to hide its overlay over full-screen apps, and it identifies running AI tools by their process names and launch arguments. This information is used on your Mac and is not uploaded. Echo for Mac does not use your camera, microphone, screen recording, contacts, calendar, or location.
  • Clipboard. Echo for Mac does not read your clipboard. It copies text to your clipboard only when you ask it to, such as an invite link or a session hand-off. Version 1.0.31 and earlier checked the clipboard during onboarding for text shaped like an Echo invite code and sent that text to Echo to look it up; later versions removed this.
  • Software and configuration it installs. If you set up the Echo MCP server from Echo for Mac, it copies a bundled Node.js runtime and the Echo MCP package to ~/Library/Application Support/Echo/MCP. It adds an “echomem” entry to the configuration of the AI tools you connect (Claude Code, Claude Desktop, Codex, and Cursor); adds start-up hooks to Claude Code and Codex that link each new session to your Echo account; and adds rules to Claude Code’s settings that let Echo’s tools run without a separate prompt each time. It keeps backups of configuration files it repairs in ~/Library/Application Support/Echo/Recovery. The uninstall control in Echo for Mac removes these entries, hooks, and rules.
  • Updates. Echo for Mac checks for app updates about every 6 hours using a signed update feed hosted on GitHub, and checks the public npm registry for new versions of the Echo MCP server. These checks send standard request information (such as your IP address and the app version) to those hosts, not your account data or memories. Updates install when you choose.
  • Sending content to other apps. When you continue a session in another AI tool or start work from a Workspace ticket, Echo for Mac opens Codex, Claude, Cursor, or Terminal and passes the content you selected, which may include your memories and Workspace content shared by other members. Once that content is in another app, it is handled under that provider’s terms and privacy policy.
  • Stored on your Mac. Your device credential and, if you use encryption, your encryption key are stored in the macOS Keychain on this device only. A copy of both is stored in ~/.echomem/credentials.json, which only your macOS user account can read, so that the Echo MCP server can act on your behalf. Encrypted caches of your memories and Workspace data are stored in ~/Library/Caches/com.echomem.desktop; an index of memories saved from your sessions, including their text, is stored in ~/Library/Application Support/EchoDesktop; and app preferences and session-sharing choices are stored in the app’s preferences.
  • Signing out, deleting your account, and removing Echo for Mac. Signing out removes your device credential and encryption key from the Keychain, removes the credentials file when it belongs to the same account, and clears the caches. Locking your vault removes the encryption key from your Mac. Deleting your account from Echo for Mac also removes the session-memory index. Other local files — including the Echo MCP runtime, configuration entries in other apps, and preferences — remain until you use the uninstall control or delete them, as described in Section 7.5.
• Workspaces. If you join a Workspace, other members can see your Workspace profile (your name, avatar, title, responsibility summary, role, join date, and the number of memories you have shared), the memories and library sources you publish, your activity on Workspace tickets, and which of your AI sessions are linked to Workspace tickets, including the AI tool used and when the session started. Memories you publish — directly, by turning on sharing for a session, or through an agent you authorize — are copied to the Workspace. Workspace briefings and team search are generated with AI from content published to the Workspace. Other members cannot see your private memories.
• Echo Chat. Uses your memories to personalize responses and may create or update memories from your conversations with it.
• EchoMem web platform. Stores your source conversations, extracted memories, visibility settings, relationships, audit events, and account controls, and provides a privacy dashboard to manage them.

1.5 Information about others. Your memory content may include information about other people. You are responsible for having the rights and lawful bases needed to provide that content, as described in our Terms.

2Prohibited and Sensitive Data

You may not use Echo to store or process personal information from or about anyone under 18. This is a strict condition of use. Unless expressly supported under a separate written agreement, you also may not store or process protected health information, payment card data, passwords or secrets, government identifiers, biometric data, or precise geolocation. Echo may block, quarantine, redact, or decline to process content it identifies as restricted.

3How We Use Information

We use information to:

• Provide and operate the Service — hosting, storing, extracting, indexing, retrieving, and synchronizing memories at your direction, and enabling sharing you initiate.
• Operate Workspaces you join — showing your Workspace profile and the content you publish to other members, and generating Workspace briefings and team search from content published to the Workspace.
• Personalize your experience — recalling your memories and preferences, and in Echo Chat using memories to personalize responses.
• Maintain, secure, and support — authentication, abuse prevention, incident response, troubleshooting, and responding to requests.
• Improve the Service — using aggregated, de-identified, or operational data, consistent with applicable law.
• Communicate with you — service announcements, security alerts, and administrative messages.
• Comply with law and protect rights.

3.1 No training of general-purpose models by default. Unless you separately and affirmatively agree, Echo does not use your raw conversations or extracted memories to train, fine-tune, or benchmark general-purpose AI models. A no-training default applies across your account, sources, and memories. We may use aggregated, de-identified, or operational data to maintain, secure, analyze, and improve the Service.

3.2 No sale; no memory-based targeted advertising. Echo does not sell your memory data and does not use your memory data for targeted advertising. We do not use tracking pixels or advertising cookies, and we do not share personal information for cross-context behavioral advertising.

4Third-Party AI Processing

To create, extract, and organize memories, content you direct Echo to process is transmitted to third-party AI providers and processed by them in readable form. This is a core part of how the Service works. We use OpenAI for embedding generation and Google (Gemini / Vertex AI) for memory extraction, related structured generation, and AI-generated answers and summaries such as Deep Search results and Workspace briefings. These providers process your content under their own terms and privacy policies.

Because content is processed in readable form by these providers, the Service is not end-to-end encrypted. We describe our encryption practices in the Security section below.

OpenAI (embeddings). OpenAI processes text you submit to return embeddings. OpenAI states that data submitted to its embeddings API is not used to train its models and has no application-state retention, and may be retained for abuse monitoring for up to 30 days unless different approved controls apply or longer retention is legally required.

Google Gemini / Vertex AI (memory extraction). Google processes prompts, context, and generated outputs to extract and structure memories. We use paid Gemini / Vertex AI services. Google states that, for paid services, it does not use prompts or responses to train its models, but may retain prompts, context, and outputs for up to 55 days for abuse monitoring, policy enforcement, and required legal disclosures, and that flagged content may be reviewed by authorized Google personnel. We do not route your content through unpaid Gemini quota or free AI Studio services.

No training on your content. Based on the terms of the services and tiers we use, neither OpenAI (embeddings) nor Google (paid Gemini / Vertex AI) uses your content to train their general-purpose models, and Echo does not use your content to train models by default (see Section 3.1).

5Sharing and Disclosure

We share personal information only as described below.

• At your direction (sharing memories). Memories are private by default. If you make a memory public or friend-gated, or publish it to a Workspace (directly, by turning on sharing for a session, or through an agent you authorize), it may be viewed, copied, or used by those who can see it. Content you choose to send to another application — for example, through Echo for Mac’s carry-over or Workspace ticket features — is disclosed to that application’s provider. Reversing sharing is subject to technical and legal limits.
• Service providers and subprocessors — vendors that help us operate the Service, including hosting and infrastructure providers; PostHog for server-side product analytics, product analytics in Echo for Mac, cookieless anonymous website measurement, and consent-based persistent website analytics and session replay; Amplitude for product analytics on our Chrome Extension, MCP tools, and Echo Chat while those surfaces complete their migration; our crash-diagnostics provider (Google Firebase Crashlytics, for Echo Chat); and our payment processor (Stripe, for paid plans), each acting as a processor/service provider under a data-processing agreement and under obligations to protect the information. See our Subprocessor List.
• Third-party AI providers — as described in Section 4.
• Software distribution — GitHub hosts Echo for Mac downloads and its update feed, and the npm registry hosts the Echo MCP server package. When you download or update this software, those services receive standard request information such as your IP address, as described in our Subprocessor List.
• Legal and safety — to comply with law, respond to lawful requests, enforce our Terms, or protect rights, safety, and property.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, or in insolvency or similar proceedings.

6Data Retention

We retain personal information for as long as needed to provide the Service and for the purposes in this Policy, subject to the controls in Section 7. Different categories of data are retained on different schedules:

• Active production systems — when you delete your account or make a verified deletion request, we act on it promptly and remove your User Content, memory data, embeddings, and associated account records from our active production systems without undue delay, except where limited retention is required for legal, security, fraud-prevention, dispute-resolution, or compliance reasons. We respond to and act on deletion requests within the timeframe required by applicable law.
• Database backups — deleted data may persist in encrypted database backups until those backups expire. Our database provider (Supabase) retains daily backups for 7 days on our current plan.
• Server logs — our hosting provider (Vercel) retains runtime logs for approximately 1 day on our current plan. We design our systems so that raw User Content and memory data are not written to logs, build logs, or deployment artifacts.
• Public-memory matching indexes — if you revoke public status or delete public memory, cached or indexed copies used for matching may take up to 30 days to be fully removed.
• AI-provider abuse-monitoring logs — content sent to AI providers may be retained by them for abuse monitoring: OpenAI retains embeddings-API data for up to 30 days; Google retains paid Gemini/Vertex prompts, context, and outputs for up to 55 days. See Section 4.
• Security and audit logs — these record events (such as memory actions, sharing, and connector authorizations) using identifiers and event metadata rather than your memory content, and are retained as long as necessary for security, fraud prevention, and legal compliance.
• Data on your device — files that Echo for Mac, the Echo MCP server, or the Context HUD store on your device remain until you remove them, as described in Section 7.5.

7Your Privacy Controls and Rights

7.1 Controls in the Service. Through the EchoMem privacy dashboard, Echo for Mac, and related controls, you can, where supported, view and search your memories, see each memory’s visibility, correct or edit memories, delete memories, export memories, and manage sharing and connectors.

7.2 Deletion. Echo stores source content, extracted memories, embeddings, indexes, visibility records, and logs separately, so a given deletion action does not remove every related item:

• Deleting a memory removes that memory and the embeddings and indexes derived from it. Because a single source conversation may relate to multiple memories, deleting a memory does not delete the source conversation it was extracted from.
• Deleting your account runs a cascaded deletion process that removes, from active production systems, the data we hold about you, including your source conversations, extracted memories, embeddings and indexes, derived data, and sharing and visibility records.
• Content you shared with others — deleting your account does not delete messages or memories you previously shared with or sent to other users, including memories you published to a Workspace; that content may remain in their accounts after your deletion.
• Deleting a specific source. To delete an individual source conversation without deleting your whole account, contact us at [email protected] and we will delete it within the timeframe required by applicable law (generally within 45 days).
• Backups and logs. Residual copies may persist in backups, and security and audit logs follow separate schedules (Section 6).

7.3 Export. You can export your memories, and where applicable your source content and settings, in a machine-readable format.

7.4 Your U.S. state privacy rights. Depending on your state of residence, you may have some or all of the following rights regarding your personal information. We honor these rights for residents of states that provide them.

• Access / know — to confirm whether we process your personal information and to obtain a copy of it, along with information about how we use and share it.
• Correct — to correct inaccurate personal information.
• Delete — to request deletion of your personal information, subject to legal exceptions.
• Portability — to obtain a copy of your personal information in a portable, machine-readable format.
• Opt out — to opt out of the “sale” or “sharing” of your personal information and of targeted advertising. As described in Section 3, Echo does not sell or share your personal information or use it for targeted advertising, so there is nothing for you to opt out of in this respect.
• Limit use of sensitive information — where applicable, to limit the use of sensitive personal information to what is necessary to provide the Service.
• Non-discrimination — we will not discriminate or retaliate against you for exercising any of these rights.

How to exercise your rights. You can exercise many of these rights directly through the in-product privacy controls (Section 7.1). You may also submit a request by contacting us at [email protected] or at the mailing address in the Contact section. We will verify your identity before acting on your request, and we may decline or limit a request as permitted by law.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. We will ask the agent to provide proof that you authorized them to act for you (such as written, signed permission), and we may also ask you to verify your own identity directly with us and to confirm that you gave the agent permission. This helps us protect your account against unauthorized requests.

Appeals. If we decline your request, you may appeal by emailing us at [email protected] with the subject line “Privacy Appeal.” We will review your appeal and respond within the time required by applicable law, and in any event within 45 days, explaining the outcome. If your appeal is denied, we will also tell you how to contact your state attorney general if you wish to raise a concern.

Timing. We respond to and act on your request within the timeframe required by applicable law (generally within 45 days, extendable when reasonably necessary, with notice to you). Deletion requests are acted on promptly; residual copies in backups and logs expire on the schedules described in Section 6.

7.5 Removing Echo from your Mac. In Echo for Mac, use the uninstall control for the Echo MCP server to remove the Echo MCP runtime and Echo’s entries, hooks, and permission rules from connected AI tools. Then quit and delete the Echo for Mac application and, if you wish, delete ~/.echomem, ~/Library/Application Support/EchoDesktop, ~/Library/Application Support/Echo, and ~/Library/Caches/com.echomem.desktop. Deleting your Echo account does not by itself remove these local files.

8Cookies, Analytics, and Diagnostics

Essential cookies. Echo uses cookies that are necessary for the Service to function, including authentication and session cookies (provided through our infrastructure provider) and a functional token cookie used to protect our media assets from unauthorized use. These do not require consent and are not used to track you.

Cookieless website analytics and consent-based replay. We use PostHog's cookieless mode to measure page views and a limited set of acquisition, download, pricing, and setup interactions across our production website without storing a PostHog cookie, local-storage identifier, or session-storage identifier. PostHog processes the IP address, user agent, hostname, a project identifier, and a rotating daily salt to derive a privacy-preserving daily hash; the source IP address is stripped before the event is stored. We do not use this mode to identify you or create a persistent profile. If you consent, we enable first-party identifiers, authenticated product analytics, click autocapture, and session replay on selected public marketing, documentation, and research pages. Login, onboarding, booking, meeting, account, memory, dashboard, company, API-key, checkout, invitation, and shared-content pages are excluded from replay. Inputs are masked, network headers and bodies are not recorded, and URL query strings and user-controlled route identifiers are removed. If you decline or do not choose, anonymous cookieless measurement continues, but persistent identifiers, user identification, autocapture, and session replay remain disabled. Global Privacy Control or Do Not Track disables all PostHog browser analytics.

Product analytics and diagnostics. We use PostHog for the web platform and Echo for Mac, and Amplitude for product analytics on our Chrome Extension, npm/MCP tools, and Echo Chat while those surfaces complete their migration. In Echo for Mac, PostHog receives app-usage events (such as the app opening, onboarding steps, sign-in errors, plan selection, and import counts) with a random installation identifier, the app and macOS versions, and, after you sign in, your Echo user identifier. Echo for Mac also sends Echo setup diagnostics for the Echo MCP server (such as which supported AI tools were detected, setup outcomes, and error codes). These events do not include your email address, memory content, session titles, file paths, or search queries. Cookieless browser events provide anonymous aggregate website measurement; consented browser events provide persistent product analytics and replay on selected public pages. Separately, Echo records limited server-side operational events when requested workflows occur, such as billing lifecycle changes, completed imports, or memory-processing outcomes; these events do not use browser analytics cookies or session replay. In Echo Chat we also use Google Firebase Crashlytics to collect crash and error diagnostics and improve stability; Crashlytics receives crash/diagnostic data only (no memory content or precise identifiers) and retains it for approximately 90 days (Firebase default). Our public memory-graph features use first-party presence and interaction data to show activity on shared graphs; this information stays within Echo and is not shared with third-party advertisers. These analytics and diagnostics receive usage and diagnostic metadata only, not your memory content.

Cloudflare infrastructure and cookieless analytics. We use Cloudflare to provide domain name services, security, content delivery, reverse-proxy services, traffic analysis, and website performance analytics. Because Cloudflare operates as a reverse proxy in front of our application, it may process network and request information such as IP addresses, request headers, requested URLs and paths, timestamps, browser and device information, and security signals, as well as content transmitted through proxied endpoints. Cloudflare Web Analytics uses a JavaScript beacon to collect aggregated page-view and performance metrics without analytics cookies or local storage and without tracking visitors over time. Cloudflare's cookieless analytics is separate from the PostHog analytics described above. Cloudflare processes this information as a service provider under a data-processing agreement.

No advertising trackers. Echo does not use advertising or marketing pixels or advertising cookies on any surface, and does not use analytics or diagnostics data for cross-context behavioral advertising. We use Google Fonts and search-engine site-verification tags for site functionality and SEO; these are not used to track you.

Your choices. You can accept, decline, or later change persistent website analytics and session replay through the consent banner or the persistent Privacy choices control. Declining or withdrawing consent keeps browser analytics in anonymous cookieless mode and stops persistent identifiers, identification, autocapture, and replay. Global Privacy Control or Do Not Track disables all PostHog browser analytics. Blocking essential cookies may affect how the Service works.

9Security

Echo uses administrative, technical, and organizational measures designed to protect personal information, including encryption of your content in transit, access controls and least-privilege principles, audit logging, secure credential handling, incident response, and vendor management.

Encryption and readable processing. Any at-rest encryption feature protects stored content in our database; it is not end-to-end encryption. To create memories, content you direct Echo to process — including a coding session’s user and assistant text uploaded through Context HUD renewal or imported or saved in Echo for Mac — is processed in readable form by Echo and by third-party AI providers.

Encryption at rest is optional. Your memories and source conversations are stored in our secured database, which uses access controls and other protections. You can also enable optional encryption for an additional layer of protection. If you turn it on, you set a passphrase, and your device derives an encryption key from it. Your passphrase is not sent to Echo. To read and write your encrypted content, your device sends the derived key to Echo with each request that needs it; Echo uses the key in memory to process those requests and does not write it to its database or logs. With encryption on, the text of your memories and the source conversations they come from is encrypted at rest. Other information is not encrypted, including memory titles, labels, dates, and locations; conversation titles and file paths; names of people and other entities Echo identifies in your content; images from your conversations; the search indexes (embeddings) derived from your content; and memories you publish to a Workspace, which are stored so that the Workspace’s members can read them. Echo cannot recover your passphrase, and if you lose it you may permanently lose access to your encrypted content. Encryption is not enabled by default, so you need to turn it on to use it. Enabling encryption does not prevent Echo or third-party AI providers from processing your content in readable form to provide the Service. Because the derived key is also stored on your devices — in Echo for Mac, in the macOS Keychain and in a local credentials file that the Echo MCP server uses — anyone who can access your device user account may be able to use it. Locking your vault or signing out of Echo for Mac removes the key from that Mac.

As described in Section 4, your content is processed in readable form by Echo and by third-party AI providers in order to create and organize memories. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a security incident affecting your personal information, we will take reasonable steps to identify the cause, mitigate harm, and prevent recurrence, and will provide any notifications required by applicable law.

10US-Directed Service

Echo is based in the United States and the Service is directed to and intended for users located in the United States. We and our service providers process information in the United States. We do not offer or direct the Service to users in the European Economic Area, the United Kingdom, or other regions outside the United States, and the Service is not intended for use by individuals located there.

If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law, and your information will be transferred to and processed in the United States, where privacy laws may differ from those in your location.

11Children’s Privacy

The Service is intended only for adults at least 18 years old. We do not knowingly collect personal information from anyone under 18, and you may not use Echo to store, process, or share personal information from or about anyone under 18. If we obtain actual knowledge that a user is under 18, we may suspend the account and initiate deletion of associated data. If you believe someone under 18 has provided us personal information, please contact us.

12Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the date above and posting the revised Policy or by other appropriate means. Your continued use of the Service after the effective date indicates your acknowledgment of the changes.

13How to Contact Us

Contact. Iditor, Inc. (d/b/a Echo). Email: [email protected]. Mailing address: 39 Bruton Street, Apt 705, San Francisco, CA 94130, USA. You can reach us at this email or address for privacy questions and to exercise your rights.