Privacy Policy

Effective Date: March 4, 2026 · Last Updated: March 4, 2026

1. Introduction

Welcome to Echoa ("we," "our," or "us"). Echoa Social Team operates the Echoa mobile application (the "App"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our App.

We are committed to protecting your privacy and handling your data with transparency. Please read this policy carefully. By using Echoa, you agree to the practices described herein.

2. Information We Collect

2.1 Account Information

• Phone number: Used for account registration and verification.
• Profile information: Display name, gender, bio, and avatar photo that you voluntarily provide.

2.2 User-Generated Content

• Card selections: Records of which metaphor cards you draw during sessions.
• Text responses: Your written projections and interpretations of metaphor cards.
• Chat messages: Messages exchanged with matched users.

2.3 Usage Data

• Interaction data: How you interact with the App, including session frequency and feature usage.
• Device information: Device type, operating system version, and app version for technical support purposes.

2.4 Information We Do NOT Collect

• We do not collect precise location data.
• We do not access your contacts, camera, or microphone without explicit action.
• We do not use tracking technologies for advertising purposes.

3. How We Use Your Information

We use the information we collect to:

• Provide the service: Create your account, enable card drawing, and facilitate matching and messaging.
• Generate AI resonance responses: Your card selections and text projections are processed through the Anthropic Claude API to generate personalized reflection responses. This data is sent to Anthropic's servers for processing and is subject to Anthropic's Usage Policy.
• Improve matching: Analyze your card interaction patterns across 8 psychological dimensions to connect you with compatible users.
• Maintain and improve the App: Diagnose technical issues and improve user experience.
• Ensure safety: Detect and prevent abuse, fraud, or violations of our Terms of Service.

4. AI Data Processing

Echoa uses the Anthropic Claude API to generate resonance responses based on your card projections. Important details:

• Your text projections are sent to Anthropic's API for processing.
• Anthropic processes this data according to their privacy and data handling policies.
• AI-generated responses are for self-reflection purposes only and do not constitute professional psychological advice.
• We do not use your projection data to train AI models.

5. Data Storage and Security

• Your data is stored on secure servers with industry-standard encryption in transit (TLS/SSL) and at rest.
• We implement access controls, regular security audits, and monitoring to protect against unauthorized access.
• Account credentials are hashed and salted; we never store plaintext passwords.
• We retain your data for as long as your account is active. Upon account deletion, your personal data will be removed within 30 days, except where retention is required by law.

6. Data Sharing

We do not sell your personal information. We may share data only in the following circumstances:

• AI processing: Text projections are processed via the Anthropic Claude API as described in Section 4.
• Matched users: Your display name, avatar, bio, gender, and card selections are visible to users you are matched with. Your full text projections are never shared with other users.
• Legal requirements: When required by law, regulation, or legal process.
• Safety: To protect the rights, safety, or property of our users or the public.

7. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate personal data.
• Deletion: Request deletion of your account and associated personal data.
• Data export: Request a portable copy of your data in a machine-readable format.
• Withdrawal of consent: Withdraw consent for data processing at any time (this may affect App functionality).
• Objection: Object to certain types of data processing.

To exercise any of these rights, contact us at echoahelp@proton.me. We will respond within 30 days.

8. GDPR Compliance (European Economic Area Users)

If you are located in the European Economic Area (EEA), the following applies:

• Legal basis: We process your data based on consent (account creation, AI processing), contract performance (providing the service), and legitimate interest (security, improvement).
• Data transfers: Data may be transferred to servers outside the EEA. We ensure adequate protection through standard contractual clauses or equivalent safeguards.
• Data Protection Officer: Contact us at echoahelp@proton.me for DPO-related inquiries.
• Supervisory authority: You have the right to lodge a complaint with your local data protection authority.

9. CCPA Compliance (California Users)

If you are a California resident, under the California Consumer Privacy Act (CCPA):

• Right to know: You may request details about the categories and specific pieces of personal information we collect.
• Right to delete: You may request deletion of your personal information.
• Right to opt-out: We do not sell personal information. No opt-out is necessary.
• Non-discrimination: We will not discriminate against you for exercising your CCPA rights.

10. Children's Privacy

Echoa is not intended for users under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or via email. The "Last Updated" date at the top reflects the most recent revision.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

Email: echoahelp@proton.me
Developer: Echoa Social Team