Privacy policy

What we collect

• Account info — your email address, a password (stored securely, we never see it in plain text), your username, display name, bio, and profile photo if you add one.
• What you share — the articles, posts, and books you save; your reviews, comments, private journal entries, and in-article notes; the groups you join and your reading streaks.
• Friends — who you’ve added as a friend inside echo. We never read your phone’s contacts.
• Push token — an anonymous device identifier so we can send you notifications (comments, likes, friend requests). Only if you allow notifications.

What we don’t collect

No advertising identifiers, no location, no analytics or tracking SDKs, no contact-list access. Book searches are sent to Google Books or Open Library to find matches — those queries aren’t tied to your account by us.

Who can see your content

echo is friends-only. Reviews and notes marked “friends” are visible to your accepted friends. Journal entries and private notes are visible only to you. Nothing is public on the open web.

Where it lives

Data is stored with Supabase on servers in the United States, protected by row-level security so each person can only read what they’re allowed to see.

Sharing

We don’t sell, rent, or share your personal data with anyone, except the service providers who run our infrastructure (Supabase for data, Expo for push delivery) and only as needed to run echo.

Deleting your data

Delete your account inside the app (Profile → Delete account) and everything — profile, posts, notes, friendships, groups you created — is permanently removed right away. You can also email us to request deletion.

Children

echo isn’t for children under 13, and we don’t knowingly collect their data.

Changes & contact

If this policy changes meaningfully we’ll note it here. Questions: jacksonbrooks0917@gmail.com.

Last updated July 16, 2026