Privacy Policy

Echo is made by Cockadoodle Branding Consulting FZCO, trading as Cockadoodle Studio, registered in the Dubai Integrated Economic Zones (IFZA), Licence No. 60173, at A1 IFZA Buildings, Dubai Silicon Oasis, Dubai, United Arab Emirates.

For anything about your personal data, write to support@echoforever.io with “Privacy” in the subject line. If we are required to appoint a representative in the European Union or the United Kingdom, their details will appear here.

The Echo app for iPhone and Android, the website echoforever.io including the pages where someone opens an echogram shared with them, the emails, text messages and notifications Echo sends, and the ways you contact us. It does not cover the App Store, Google Play or any other company’s service you reach through a link.

• Echogram — a collection of memories you create, with a name, an unlock date and the people it is for.
• Memory — a photo, video, voice recording, written message or document inside an echogram, including comments on it.
• Recipient — a person you choose to receive an echogram when it unlocks.
• Co-creator — a person you invite to add memories to one of your echograms.
• Keeper — a person you nominate to look after your Echo account if you die.
• Content — your memories, and the names, dates and settings that describe them.
• Account data — everything about you that is not content: your email, phone number, name, sign-in method, plan, settings and the people in your address book.

4.1 What you give us

Account details. Your email address or phone number, your first and last name, and how you sign in: a one-time code, a password, Sign in with Apple or Sign in with Google. With Apple we receive the name and email you choose to share, which may be a relay address. With Google we receive your name, email address and profile picture; we store the picture only if you accept it as your Echo photo.

Profile photo. Optional, and visible to the people you share and co-create with. Because it appears in emails and in the web viewer, it is stored at an unguessable web address that anyone holding the exact link can open. Earlier photos remain stored until you delete your account.

Date of birth. Optional, in Settings → Account. Only you see it; we use it for a birthday greeting and nothing else.

Your content. The memories you add and the details that describe each echogram: its name, dates and unlock date, the size and length of each memory, and whether you marked a memory private.

Sharing details. The recipients and co-creators you choose: their names, email addresses and phone numbers, an optional relationship label such as “daughter”, and an optional password for a share, which we store only as a one-way hash.

Your address book. The people you have saved to share with: names, emails, phone numbers, your notes, tags and groups. Section 8 explains what this means for those people.

Keepers. Until a Keeper accepts, we hold only the name or label you typed. Section 9 explains the rest.

Reports, blocks and feedback. The content you report and the reason you give; the people you block; votes and answers you give in Sparks; and anything you send us by email or through our support channels, including screenshots.

Invites. The invite code you used, who invited you, and the invites you send.

Purchases. Where paid plans are offered: the plan you bought, its status and renewal dates, and the transaction references Apple or Google send us so the purchase can be matched to your account. We never see your card number and we do not store prices.

4.2 What we collect automatically

Time zone and language. So that reminders and messages arrive at a sensible hour in your language.

Last active time. When you last used the app.

Push notification tokens. One per device, if you allow notifications. A notification’s text can include an echogram’s name and a person’s first name, and passes through Apple’s or Google’s notification service to reach your phone.

Usage analytics — only if you turn them on. Settings → Privacy & security → Usage analytics is off when you install Echo. When it is on, we record the screens you view, the features you use, performance timings and error details, linked to your account and to the session they belong to. Before anything is sent, the app removes email addresses, phone numbers and web-address details from the records. Analytics never include the contents of your memories.

Crash reports. The app sends error details and a trail of recent app activity, with web addresses cleaned, to our crash-reporting provider so that we can fix problems. The Crash reports switch in Settings → Privacy & security will control this from a coming update; until then crash reports are sent whatever its position.

Our servers’ own records. Separately from the two switches, our servers keep technical records of their own work: what ran, whether it succeeded, how long it took, and any error message. They contain no content, are kept for a short period, and do not depend on your settings; without them we could not see when the service fails.

Network addresses. Like every internet service, our hosting providers receive your IP address when your phone connects. We keep it only for a short time, and only to limit sign-in attempts and detect abuse.

Information inside your files. When the Echo app prepares a photo for upload it removes the information your camera embedded in it, including where it was taken. Videos, audio files, documents and photos added on the web keep whatever their creator embedded, which can include location.

Location. We do not ask for your location and the app requests no location permission.

Contacts. If you tap “Pick from contacts”, your phone shows its contact list and you choose one person. Echo reads only that person’s name, email address and phone number and saves them to your address book when you save. Echo never reads the rest of your contacts and never uploads your contact list.

4.3 What we receive from other people

When someone shares an echogram with you, invites you as a co-creator or nominates you as a Keeper, we receive your name and the email address or phone number they entered, and we record what they shared with you and when you viewed it. Section 8 explains your choices.

The bases named here are those of the GDPR and the UK GDPR; under the UAE Personal Data Protection Law and India’s Digital Personal Data Protection Act the same uses rest on your consent, on what is necessary to provide the service you asked for, and on legal duties. Where a use rests on consent you can withdraw it at any time in the app or by email, without affecting what was done before. We will not use your personal data for a new purpose without telling you first.

We do not sell your personal data. We do not share it with advertisers. The app and the website contain no advertising or third-party analytics code. We do not use your memories to train artificial-intelligence models, and the contents of your memories are never sent to an AI provider.

Encrypted before it leaves your phone. Your memories are encrypted on your device before upload and stay encrypted while they are stored. Each echogram has its own key, and the keys are held in a managed key service that releases them only through our servers, only to someone our access checks allow.

Echo looks after the encryption keys for you. That is what lets an echogram be delivered on a date years ahead, and what means nobody loses their memories by forgetting a password or losing a phone. Because Echo holds the keys, Echo is not end-to-end encrypted, and our systems can access content where needed to run the service. We do not look at your echograms, and our tools and procedures are built around that rule.

Who can open an echogram. Our servers check every request. Only you, the co-creators you have added, and recipients after the echogram has unlocked for them and they have entered the code we sent, can view a memory.

Private memories. A memory you mark private can be opened only by you and by the recipients it unlocks for. Co-creators can see that it exists and a heavily blurred preview, but cannot open it. The echogram’s owner can still delete it.

What is not encrypted. Echogram names, dates and settings; the contact details of your recipients and co-creators; profile photos; the small, heavily blurred preview images used in share emails and lists, which sit at unguessable web addresses that anyone holding the exact link can open; documents uploaded with a Keeper claim; attachments to messages you send us.

Copies on your phone. So your memories open quickly, even offline, the app keeps copies of media you have already viewed in its own private storage on your phone. These copies are protected by your phone’s own security, such as your passcode and the device’s built-in encryption, and are never included in cloud backups. To remove them, go to Settings → App settings → Cached media.

When you remove someone’s access. They can no longer open the echogram through Echo, and content added afterwards is locked with a new key. We cannot take back anything they viewed, saved or downloaded while they had access, and a viewing link they already held keeps working for a short time until it expires. A share link itself stays valid until you remove that person’s access; every view still requires the code we send.

Who at Echo can see what. Our support staff use an internal tool that shows account details such as email addresses, echogram names, recipients’ contact details and sharing status, reports, the messages you send us, and Keeper claims including any uploaded document. It cannot decrypt memories. Staff actions on accounts are logged.

Security measures. Encrypted connections, access rules enforced inside the database for every record, one-way hashes for passwords, codes that expire quickly and allow only a few attempts, limits on repeated requests, key rotation when access is removed, and two-factor sign-in for our staff. No system is perfectly secure; section 18 says what we do if something goes wrong.

Your switches. Settings → Privacy & security holds Usage analytics, which is off until you turn it on, and Crash reports (section 4.2). The choices are saved on your phone; they reset if you reinstall Echo or change phones, and you can set them again. Analytics go to our analytics provider and to our own analytics database; crash reports go to our crash-reporting provider.

Daily automated analysis. Once a day our systems take the screen and event names, never content, from a small number of recent sessions that showed errors or signs of difficulty, and have an AI model write short summaries that help us find bugs. The summaries are linked to your account, kept for 90 days, and may be used by Echo Assist to answer your questions. Because this uses analytics events, it covers you only if Usage analytics is on.

Echo Assist. An optional helper in Settings → Help & FAQs that answers questions about using Echo. Each message you type is sent, with the recent messages of that conversation, to our AI provider to produce the reply, so do not type anything you would not want processed this way. If you turn on Echo Assist in Settings → Privacy & security, we also send facts about your use of the app so the answers fit your situation: the screens you were on, your plan and app version, how many echograms you have and their state, and the summaries described above. Names, email addresses, phone numbers and the names of your echograms are removed before sending. The contents of your memories are never sent. Our AI provider processes your messages only to produce the reply, under terms that limit its use and retention of them. Your conversations are saved only on your phone; delete one at any time, or all of them with “Clear my chats”, and signing out clears them. Echo keeps no copy.

Automatic help. If a message suggests someone may be in danger, Echo Assist shows a short line pointing to local emergency services and a person to talk to. We wrote that line, not the AI, and it never affects your account.

Automated limits. To protect the service we apply automatic limits, for example a temporary cool-down of Echo Assist after repeated misuse. They affect only features of Echo, never your content or your account standing, and you can ask a person to review any of them by email.

When you share an echogram, invite a co-creator or name a recipient, you give us another person’s name and email address or phone number. Do this only when you are allowed to. We use those details to send the invitation or notice by email or text message, including your name and the echogram’s name; to let the person verify themselves with a code before viewing a share on the web; to connect the share to their Echo account if they later sign up with the same email or phone; and to record whether and when they viewed it.

If you received something from Echo and do not want us to hold your details, email support@echoforever.io from the address the message reached. We remove your name, email address and phone number from the sender’s address book and shares within 30 days and tell the sender that you asked. Anything shared with you stops being deliverable to you.

You can nominate up to three Keepers in Settings → Your Keeper.

Before they accept. We hold only the name or label you typed. You give each Keeper their key yourself; we never send it.

Claims. A Keeper uses their key to ask Echo to begin. They may upload a document such as a death certificate; it is stored privately, our staff can see it, and no one at Echo approves or rejects a claim on the strength of it.

The 30-day wait. When a claim is made we tell you by every way you gave us to reach you, and nothing is released for 30 days. During that time, opening the Echo app or using the link in our message closes the claim. If neither happens, the claim takes effect automatically after 30 days. One claim can be made per Keeper in any 12-month period.

What a Keeper receives depends on the access level you chose. The default shows only counts, such as how many echograms are scheduled and whether your plan is active, and opens nothing. A reading level you choose explicitly lets the Keeper open only the echograms you selected. A Keeper never learns who your echograms are for unless you chose to show them.

Delays. Once a claim has taken effect, that Keeper can delay a scheduled delivery that has not happened yet, by up to 30 days. They can never cancel one or bring one forward.

Removal. Change a Keeper’s access or remove them at any time; they are not told. Blocking someone also removes them as your Keeper.

Documents. A document uploaded with a claim is kept privately for as long as the claim is open; the Keeper who uploaded it, or you, can ask us to delete it at any time by email.

We share personal data only with providers that help us run Echo, each receiving only what its job needs and bound by contract to use it for nothing else. They fall into these groups:

• hosting, database and file-storage providers (in the European Union, with file storage on a global content network);
• the managed key service that protects your encryption keys;
• email, text-message and push-notification delivery services;
• the App Store and Google Play, which handle payments and sign-in with Apple or Google;
• crash-reporting and analytics providers, only when your switches are on;
• the AI provider that produces Echo Assist replies and the daily summaries;
• the tools we use to run support, which hold the messages you send us.

Beyond that, we share personal data only when the law requires it, to protect someone’s safety, or, if Echo is ever sold or merged, with the new owner under this policy. The current list of providers is available on request.

Our database and servers are in Germany. Some providers are in the United States, and the key service operates globally. When your data leaves your country we rely on the protections each law provides: for the UAE, transfers to countries with adequate protection or under contractual safeguards as the Personal Data Protection Law allows; for the EU and UK, the European Commission’s Standard Contractual Clauses and the UK Addendum, or a provider’s certification under the EU-US Data Privacy Framework; for India, transfers to countries not restricted by the Government of India. You can ask us for a copy of the safeguards that apply to you.

The website sets only the cookies it needs: one that remembers you verified a code to view a shared echogram, one that lets you take part in a survey you opened from a link, and sign-in cookies for our staff. None are for advertising or analytics. The app keeps your settings, privacy choices, Echo Assist history, cached media and a local error log on your phone.

When you delete your account, analytics and error records already collected stay linked to your user identifier until their period ends.

In the app. Edit your profile (Settings → Account). Turn analytics, crash reports and Echo Assist on or off (Settings → Privacy & security). Manage recipients (Settings → Recipients). Remove someone’s access from an echogram’s sharing screen. Block someone (Settings → Privacy & security → Blocked people): their shares to you are removed, their pending co-creator invitations are declined, they are removed as your Keeper, and their comments and notifications stop. Delete any memory, echogram or your account.

By email. Write to support@echoforever.io from the address on your account to ask for a copy of the personal data we hold, to correct it, to delete it, to restrict or object to a use, or to withdraw a consent. We answer within 30 days. A full data export is not yet available in the app; you can save memories to your phone, and we provide other personal data by email.

Your rights by law. Depending on where you live you have rights of access, correction, erasure, restriction, objection (including to direct marketing) and portability, and the right to complain to a data-protection authority: the UAE Data Office; your supervisory authority in the EU or the UK Information Commissioner’s Office; the Data Protection Board of India, whose law also lets you nominate a person to exercise your rights if you die or are incapacitated (see also section 16). Echo makes no decision about you based solely on automated processing that has a legal or similarly significant effect. We honour these rights for everyone, wherever they live, and may ask you to confirm your identity first by a code sent to the address on your account.

Settings → Account → Delete account. Deletion is immediate and permanent. There is no grace period.

• We delete your profile, your echograms and their files, your shares, your address book, your comments, your Keeper setup and your subscription records.
• Echograms you shared disappear for the people you shared them with, including deliveries that have not happened yet.
• Memories you added to someone else’s echogram as a co-creator stay in that echogram, no longer linked to you. Delete them first if you do not want them kept.
• We keep the purchase records described in section 13, which hold transaction references but not your name or email.
• Deleting your account does not cancel an App Store or Google Play subscription. Cancel it in your store account.

If you cannot sign in, email support@echoforever.io from the address on your account with “Delete my account” in the subject; we verify with a code sent to that address and delete within 30 days.

Echo is built so your echograms reach the people you chose on the schedule you set, including after you are gone. Scheduled shares are delivered as you set them unless you cancel them or delete your account first. If you have Keepers, section 9 applies.

If you have no Keeper and we are told that you have died, an executor or an immediate family member may ask us to delete your account by sending a death certificate and proof of their authority to support@echoforever.io. We do not grant anyone access to your content unless you chose them while you were alive. Scheduled deliveries continue unless a verified executor asks us to stop them.

Echo is for people aged 16 and over, or older where the law where you live sets a higher age. By creating an account you confirm that you are old enough; we do not otherwise verify age. We do not knowingly collect personal data from children; if you believe a child has an account, email us and we will delete it. Memories about children, such as a message for a child’s eighteenth birthday, are content you create and control, and this policy applies to them like any other content.

If a security incident affects your personal data, we tell the authorities and the people the law requires us to tell, within the time the law sets, and we tell you directly where there is a risk to you.

If we make a material change we tell you in the app or by email before it takes effect. The date at the top shows the current version; earlier versions are available on request.

support@echoforever.io Cockadoodle Branding Consulting FZCO (trading as Cockadoodle Studio) A1 IFZA Buildings, Dubai Silicon Oasis, Dubai, United Arab Emirates