EchoX — Privacy Policy

This is not legal advice — consider a quick professional check given it is public on an app store.

Effective date: 26 September 2026 App: EchoX (part of EchoPersona) Operated by: Peter Wood (EchoPersona), Australia Contact: peter@echopersona.social

Who we are

EchoX ("we", "us") is an app for AI conversations. It is operated by Peter Wood (EchoPersona) in Australia. This policy explains what data we collect, how we use it, and who processes it on our behalf.

What we collect

Account details. Your email address and authentication credentials, used to create and secure your account.
Content you create. The messages you send, the content you create or customise, your conversation history, and any sources you attach.
Technical data. Standard log and device information (e.g. app version, approximate request metadata) needed to operate and secure the service.

We do not show advertising, and we do not sell your personal data.

How we use it

To provide the core service — generating persona responses and saving your conversations so you can return to them.
To authenticate you and keep your account secure.
To maintain, debug, and improve the app.

Who processes your data (sub-processors)

We use trusted third parties to run EchoX. Your data is shared with them only to provide the service:

Anthropic — the messages and persona context needed to generate a reply are sent to Anthropic's Claude API, which produces the AI response. Please do not share sensitive personal information in your messages.
Supabase — authentication and database hosting; your account and content are stored here.
Vercel — application hosting and delivery.
Stripe (only if you subscribe) — if you choose a paid plan, payment is handled by Stripe; we do not store your full card details.

Each processor handles data under its own privacy and security terms.

Data retention

We keep your account and content until you delete it or ask us to delete your account. You can delete individual conversations and personas in the app at any time.

When you delete a conversation, the message content you see is removed. Some of our AI personas include a boundary-checking feature that keeps an internal audit record of that check (for example, whether a claim a persona made was flagged for review). Deleting a conversation anonymises this internal record — any quoted or generated text in it is permanently redacted — but the record of what was checked and what was decided is retained, so the feature remains independently verifiable. This retained record contains no identifying information about you.

Public share links you create expire automatically 90 days after creation.

Your rights

You can request access to, correction of, or deletion of your personal data by contacting us at peter@echopersona.social. You can also delete your content in-app. You have rights under the Australian Privacy Act 1988 (Cth), and — if you are located there — under laws such as the EU/UK GDPR.

Security

We use industry-standard measures (encrypted connections, access controls, managed infrastructure) to protect your data. No method of transmission or storage is perfectly secure, but we work to protect your information.

Children

EchoX is not directed to children under 16. We do not knowingly collect personal data from children under 16; if you believe a child has provided us data, contact us and we will delete it.

International transfers

Our processors may store and process data in countries other than Australia (for example, the United States). By using EchoX you consent to such transfers, which are carried out with appropriate safeguards.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by a new effective date at the top of this page.

Contact

Questions or requests: peter@echopersona.social