Privacy Policy

Echo (“Echo”, “we”, “us”, “our”) is an iOS application operated by Nustream Digital Ltd, a company registered in England and Wales (company number 16079701, registered office First Floor, Swan Buildings, 20 Swan Street, Manchester M4 5JW).

For the purposes of UK data protection law, Nustream Digital Ltd is the data controller responsible for your personal data. If you have any questions about this policy or your data, contact us at support@askecho.app.

Account information

You can start using Echo without creating an account. In that case we assign you an account identifier and hold no email address for you until you choose to create an account. When you create an account we collect your email address and, where you sign in with Apple or Google, your name (if shared). We never receive your Apple or Google password.

Content you save — your library

This is the core of the service. When you save something, we collect and store what you save and what we derive from it: links and URLs, articles, social posts, videos, podcasts, images, screenshots, documents such as PDFs, voice or text notes, and any titles, tags or notes you add. For media, this includes extracted text, transcripts, thumbnails and metadata. You decide what goes into your library.

Usage information

We collect information about how you use Echo — saves created, searches and questions asked, chats, features used and screens viewed — to operate, debug and improve the app.

Device & technical information

We collect your device model, operating system and app version, language and region settings, and diagnostic or crash information. Your IP address is processed transiently to deliver the service and protect against abuse.

Subscription information

We collect your subscription status and purchase history. Payments are handled by Apple through the App Store — we never see or store your payment card details.

Notifications

If you enable notifications, we store a push token so we can deliver them — for example your weekly digest.

Under UK GDPR we must have a lawful basis for each use of your personal data. The table below sets out what we do and why.

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You can object to that processing — see Your rights.

Echo is an AI-native app, so it is important you understand this clearly.

When you save something, its content is sent to Anthropic PBC — the company behind the Claude AI models — so it can be summarised, tagged, classified and made searchable, and to power Ask and Chat with Bookmark. Anthropic processes this content on our behalf, as our processor.

• Anthropic returns the AI results to Echo and retains the content in its API logs for a limited period (up to around 30 days) for safety and abuse monitoring, then deletes it.
• Your saved content is not used to train Anthropic’s AI models.
• To make Ask work, a short summary card of each save — title, summary, key points and tags — and the questions you ask are sent to OpenAI to be turned into search vectors. OpenAI processes this on our behalf and does not use API data to train its models.
• AI processing is essential to how Echo works and cannot be switched off separately. If you do not want a particular item processed this way, do not save it; if you no longer want any AI processing, you can delete your account.
• A separate, optional setting — “Share anonymised usage” — lets you consent to anonymised prompts and responses being used to improve Echo’s own AI quality. It is off unless you turn it on, and you can withdraw consent at any time in the app.

You can read more about Anthropic’s practices in Anthropic’s privacy policy. Every provider that handles your saves is listed under Sub-processors below.

We do not sell your personal data, and we do not share it for advertising.

We share data with a small set of service providers (“sub-processors”) who help us run Echo. Each is bound by a contract that limits them to processing data on our instructions. They include providers of AI processing, content extraction, hosting and storage, subscription management, email delivery, notifications and sign-in. The full, current list — with each provider’s purpose — is set out below.

We may also disclose your data where we are required to by law or a valid legal request, to enforce our Terms of Use, or to protect the rights, safety and property of Echo, our users or the public. If Nustream Digital Ltd is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction; we will give you notice before your data becomes subject to a different privacy policy.

Sub-processors

The third-party service providers that help us run Echo. They act as our processors: they handle data only to perform a service for us, under a written contract, and they may not use it for their own purposes. None of these providers receive your data for advertising.

We may add or replace sub-processors as Echo evolves. When we do, we will update this list. If you have questions about any provider, email support@askecho.app.

Some of our service providers — including Anthropic, OpenAI, Supabase and Resend — are based in, or process data in, the United States and other countries outside the United Kingdom.

Where your personal data is transferred outside the UK, we make sure it is protected by appropriate safeguards — typically the UK International Data Transfer Agreement, or the International Data Transfer Addendum to the EU Standard Contractual Clauses, or transfer to a country covered by UK adequacy regulations. You can ask us for more detail about these safeguards using the contact details below.

• Your library and account data are kept for as long as your account is active.
• When you delete your account, your library and account data are removed from our live systems promptly, and from routine backups within 30 days.
• If you use Echo without creating an account and have no active subscription, your library is deleted once it has been inactive for 30 days.
• Content held by Anthropic in its API logs is deleted by Anthropic within approximately 30 days.
• Transaction and tax records are kept for as long as the law requires us to keep them, even after account closure.

You can delete individual saves at any time in the app, and you can export your library before deleting your account.

Under UK data protection law you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — ask us to correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your data (“right to be forgotten”).
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a portable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where we rely on consent, withdraw it at any time.

You can exercise many of these directly in the app: export your library or delete your whole account in Profile → Data & Account, and delete individual saves from the save itself. For anything else, email support@askecho.app and we will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to address your concern first.

Echo is not directed at children. You must be at least 18 years old to use Echo. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

We take the security of your data seriously. Data is encrypted in transit, access to our systems is restricted and logged, and your library is protected by per-user access controls so that one account cannot read another’s data. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We may update this policy from time to time. If we make a material change, we will let you know in the app or by email before it takes effect. The “last updated” date at the top of this page always reflects the current version.

For any privacy question or to exercise your rights:

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk.