Privacy Policy
Last updated:
Eckoa is built to ask for as little about you as possible. This policy explains, in plain language, what we collect when you use the Eckoa app and this website, why, who else handles it, how long we keep it, and what you can do about it.
Who is responsible
Eckoa (“Eckoa”, “we”, “us”) is the controller of the personal data described here and operates the Eckoa app and the website at eckoa.app.
You can reach us at wzcortex@gmail.com for anything about your data. This policy follows, among others, the Brazilian General Data Protection Law (LGPD), the EU and UK GDPR, and applicable US state privacy laws.
What we collect
We collect only what is needed to run Eckoa:
| Data | What it includes | Why we need it |
|---|---|---|
| Account | Email address; a password (stored only as a protected hash); whether your email is verified. | To create your account, sign you in, and let you recover access. |
| What you write | Your echoes (text, language, date and the reflection they answer), suggestions you send, and reports you make. | To publish your echoes, run the service and review reports. |
| Likes | Which echoes and reflections you liked. The likes you give are never shown to anyone. | To show likes correctly and prevent duplicates. |
| Moderation records | When an echo is blocked: its text, the reason, a score and the date. | To protect the community, prevent abuse and handle appeals. |
| Technical data | IP address, device type, operating system, app version and timestamps, in server logs. | Security, abuse prevention, fixing errors. |
| On your device only | Your language choice and daily reminder settings. The reminder is a local notification scheduled on your phone. | To work the way you set it. This stays on your device. |
We do not use advertising identifiers, advertising or analytics SDKs, or third-party trackers in the app. We do not ask for your name, phone number, contacts, photos or location.
Why we use your data and our legal bases
We use personal data to run the service (create accounts, publish and show echoes, translate on request), to keep it safe (automatic moderation, rate limits, abuse prevention) and to meet legal obligations.
Depending on where you live, our legal bases are: performing our contract with you (providing the app); our legitimate interests in security, moderation and improving the service, balanced against your rights; compliance with legal obligations; and your consent where it is required, for example for the notification permission, which you can withdraw in your phone settings at any time.
We do not use your data for advertising, we do not build advertising profiles, and we do not sell personal data.
Automatic moderation and translation (AI)
Before an echo is published, its text is sent to an artificial-intelligence moderation service (OpenAI) that checks for content that is not allowed. If the check cannot be completed, the echo is not published.
When a person taps Translate, the text of that echo or reflection is sent to an AI language model (OpenAI) to be translated. The result is stored so it can be reused for other readers.
These providers receive the text only: not your email, account identifier or any other personal profile. They process it under their own terms, which may include keeping it for a limited period (currently up to 30 days) to detect abuse. Under their standard API terms, data sent through the API is not used to train their models.
Moderation is automated and can make mistakes. If you think an echo was blocked unfairly, write to wzcortex@gmail.com and a person will review it. Translations are machine-generated and may be inaccurate.
What other people can see
Other users see the text of your echoes, their language, and when they were written: never your name, email or account. Likes work the same way: only the author sees how many likes an echo received, and nobody sees who liked it.
Echoes can be read, and translated, by anyone using Eckoa anywhere in the world, so please do not write information that identifies you or other people.
Who handles data on our behalf
We do not sell personal data. We share it only with the service providers that help us run Eckoa, under contracts that limit their use of it:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database and sign-in (authentication). | United States (AWS us-east-1) |
| Google Cloud (Cloud Run) | Runs the moderation and translation service. | United States (us-central1) |
| OpenAI | Automatic moderation and on-request translation of text. | United States |
| Cloudflare | Delivers and protects this website. | Global network |
| Google Play | Distributes the Android app. | Global |
We may also disclose data when the law requires it, to respond to valid legal requests, or to protect people’s safety and our rights. If Eckoa is ever merged with or acquired by another organization, we will tell you and this policy will continue to apply to your data until you are told otherwise.
International transfers
Our providers process data mainly in the United States, which may have different data protection rules from your country. Where the law requires it, we rely on safeguards such as the standard contractual clauses offered by our providers. You can ask us for more information at wzcortex@gmail.com.
How long we keep data
| Data | Kept for |
|---|---|
| Account (email, sign-in) | While your account exists. Deleted when you delete it. |
| Likes you gave, suggestions you sent | While your account exists. Deleted when you delete it. |
| Echoes | Until you delete them. If you delete your account without deleting an echo first, the echo stays but is permanently disconnected from you. See Delete your account. |
| Translations of an echo | Removed together with the echo they translate. |
| Moderation records | Kept for safety and abuse prevention. After you delete your account they are disconnected from you. |
| Server logs | A limited period, typically up to 30 days, unless needed to investigate abuse or a security incident. |
We may keep some data longer when the law requires it or to establish, exercise or defend legal claims.
Your rights
Depending on where you live, you may have the right to: confirm that we process your data and get a copy; correct it; delete it; limit or object to some processing; receive it in a portable format; withdraw consent; ask about who it is shared with; and ask for a person to review an automated decision.
In California and other US states with privacy laws, you also have the right to know, delete and correct your personal information and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising.
To exercise a right, use the options in the app (you can delete your echoes and your account from the settings) or email wzcortex@gmail.com from the address of your account so we can verify it is you. We reply within 30 days, and sooner where the law requires.
You can also complain to your data protection authority, such as the ANPD in Brazil, your national authority in the EU or EEA, the ICO in the UK, or your state attorney general in the US.
Security
Data travels over encrypted connections. Passwords are never stored in readable form. Access to the database is restricted by account-level rules, and access to our systems is limited to what is needed to operate them. No system is perfectly secure, so if a breach affecting you occurs, we will notify you and the authorities as the law requires.
Children
Eckoa is not for children. You must be at least 16 years old (or the minimum age of digital consent in your country, if higher) to create an account. If we learn that someone under that age has an account, we will delete it. If you believe this has happened, write to wzcortex@gmail.com.
This website
This website does not use advertising or analytics cookies. When you choose a language, we store one functional cookie (eckoa_lang) for up to one year to remember that choice. Cloudflare, which delivers the site, processes IP addresses and request data to deliver and protect it.
Changes to this policy
We will update this page when something changes and show the date at the top. If a change is significant, we will also tell you inside the app before it takes effect.
Contact
Questions, requests or complaints about privacy: wzcortex@gmail.com.