Privacy

The short version

We collect the minimum needed to make the app work: your phone number (for sign-in), the latitude and longitude you pin Echoes to, and any media you choose to attach (photos, video, voice, 360s, written reflections). That’s it.

We don’t sell your data. We don’t train AI models on it. We don’t show ads. We don’t analyze your Echoes to recommend things back to you.

Location

Location is the whole product, so the app does ask for it. The rules:

• Location is used to pin Echoes at the spot you chose, to surface Echoes near you on your map, and to trigger whisper notifications when you walk past one.
• Live-location sharing is off by default. You can turn it on per group — family, climbing crew, etc. — and only members of that specific group will see your current location, and only while you have it toggled on. Other users, other groups, and the public never see your live position. Turn it off and the sharing stops immediately.
• Quiet zones let you blank-list a radius around home, your workplace, or any address. Echoes pinned inside a quiet zone are hidden from your own map and never whispered.
• You can use the app without granting precise-location permission; you just won’t be able to leave Echoes from the in-the-moment flow until you do.

Your media

Photos, videos, voice memos, and 360s you attach to an Echo are stored on our servers and served back only to you and the audience you chose. Database rows (titles, captions, group memberships, pin coordinates) are protected so the database itself refuses to return another user’s rows — sharing rules are enforced at the data layer, not just in the app.

Anything you delete from your account is removed from both the database and storage. There is no shadow copy.

Who sees what

Every Echo has an audience you set when you leave it:

• Private — only you. Default for most Echoes.
• Group — only the specific group you pick (family, climbing crew, etc.). Members of other groups don’t see it.
• Public — anyone with the app can see it on the map. Reserved for things meant to be left for strangers.

Sealed Echoes (with a time-lock) are completely invisible — even to you — until the unlock date. We can’t preview the contents during the seal.

AI

Optional “helpers” (whisper prompts, rewrite suggestions) call an AI model on your behalf. When you use them, the text and, if relevant, the image are sent to a model provider under an agreement that prohibits using your content to train their models. We log the request enough to debug failures and bill correctly, nothing more.

The AI is never invoked silently. You always tap a button to start it, and you choose whether to apply its suggestion.

Phone numbers

Sign-in is phone-only, via a one-time SMS code. We store your number, no password. Numbers are visible to other users only when you explicitly add them to a group you both belong to.

What we don't do

• No third-party trackers, no ad SDKs, no analytics fingerprinting.
• No selling, renting, or sharing of personal data.
• No training AI on your photos, voice memos, or reflections.
• No public feed. Your Echoes are not surfaced to strangers unless you explicitly mark one Public.

The covenant

If we ever shut down, you get your stuff. The Downloadable Echo Viewer (see The promise) packages every Echo you’ve made into a single self-contained folder that plays without us, on any computer, forever. That artifact, once delivered, cannot be taken back.

Questions

Reply to the text message that brought you here. There isn’t a support team — there’s one developer who reads everything.