Privacy Policy
How we protect your voice and your trust.
Last Updated: March 29, 2026 · Effective: March 29, 2026
Echoes ("Echoes," "we," "us," or "our") is a product of Agentic Software Solutions, LLC, a California limited liability company. This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you use the Echoes mobile application (the "App"), our website at echoesmemoirs.com (the "Website"), and all related services (collectively, the "Service").
By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, you must not access or use the Service.
This Service is intended solely for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18.
1. Information We Collect
1.1 Information You Provide Directly
Account Information
When you create an account, we collect your email address, display name, and authentication credentials. If you sign in via Apple or Google, we receive your name and email address from those providers.
Storyteller Profile Information
When you set up a storyteller profile, we collect the storyteller's name, relationship to the account holder (e.g., "grandmother," "father"), optional nickname, optional hometown, and optional birth year.
Voice Recordings and Audio Data
When you use our recording features, we capture audio recordings of interview sessions via your device's microphone. These recordings contain your voice (or the storyteller's voice) and all spoken content, including personal stories, family histories, names of individuals, places, dates, and life events.
Transcripts
We generate text transcripts of all recorded interview sessions. These transcripts include the full text of everything spoken during the session by both the user and the AI interviewer.
Consent Preferences
We collect your explicit consent choices regarding voice recording, story content storage, third-party mentions, AI disclosure acknowledgment, therapy disclaimer acknowledgment, and your data retention preference (indefinite, three years, or one year).
Family and Gift Information
If you use family sharing features, we collect family group names, member names, email addresses, and roles (storyteller, listener, organizer). If you purchase or redeem a gift code, we collect the purchaser's name, personal message, and prefilled storyteller information.
Emotional Boundaries
You may set topics you prefer not to discuss. We store descriptions of these boundaries and associated keywords to ensure the AI interviewer respects them.
1.2 Information We Generate or Derive
Extracted Entities and Relationships
Our AI processes your transcripts to extract names of people, places, events, dates, relationships between entities (e.g., "married to," "worked at"), and recurring emotional themes. This information is stored as a "story graph."
Timeline Events
We extract and organize life events mentioned in your recordings, including approximate dates, ages, and seasons associated with those events.
Fact Ledger
We maintain a ledger of factual claims extracted from your interviews, including the source of each claim (user-stated, user-confirmed, or AI-inferred), confidence levels, and any contradictions between sessions.
Safety Events
Our system monitors interview sessions for signs of emotional distress or crisis. If detected, we log the severity tier, trigger type, response action taken, and crisis resources displayed. For the highest severity events (imminent danger indicators), the specific trigger content is anonymized before storage.
Usage Data
We track recording session duration, chapter progress, and cumulative usage time for purposes of enforcing free-tier limits and providing usage analytics.
1.3 Information Collected Automatically
We may collect device type, operating system version, app version, and unique device identifiers through Firebase SDK. We log product usage events such as session starts/completions, chapter completions, paywall views, purchase completions, and recording session cost estimates. We may collect crash logs and performance metrics through Firebase to maintain and improve the Service.
1.4 Information from Third Parties
If you sign in using Apple Sign-In or Google Sign-In, we receive your name and email from those providers. We use RevenueCat to manage in-app purchases; RevenueCat processes your payment information and provides us with purchase entitlements, product identifiers, and transaction status. We do not directly collect or store your payment card information.
2. How We Use Your Information
To Provide and Operate the Service. This includes facilitating AI-assisted voice interviews, generating transcripts, extracting entities and timeline events, creating audio stories, managing family sharing, and processing gift codes.
To Process Your Recordings Through AI. Your voice audio is streamed in real-time to OpenAI's servers for AI-assisted interview facilitation. Your transcripts, extracted entities, timeline events, emotional boundaries, and story graph data are included in AI system prompts to provide contextually relevant follow-up questions across sessions.
To Detect and Respond to Safety Concerns. We monitor interview content for indicators of emotional distress or crisis and provide appropriate crisis resources when detected.
To Process Payments and Manage Subscriptions. We use RevenueCat to verify purchase entitlements and manage access to premium features.
To Enforce Usage Limits. We track recording time to enforce free-tier limits and display upgrade prompts.
To Improve the Service. We use aggregated, de-identified analytics to understand product usage patterns, diagnose technical issues, and improve features.
To Comply with Legal Obligations. We may process your information as required by applicable law or in response to valid legal process.
4. Data Storage and Security
Where Your Data Is Stored
On Your Device. Story data, transcripts, profiles, and other content are stored locally on your device using Apple's SwiftData framework. Audio files are encrypted locally using AES-256 encryption before upload.
In the Cloud. Your data is synced to Google Cloud Firestore and Firebase Storage, hosted in the United States. All data at rest is encrypted by Google using AES-256 encryption.
At OpenAI. Voice audio is streamed to OpenAI's servers in real-time during active recording sessions via encrypted WebSocket connections (TLS 1.2+). We use ephemeral session tokens that expire after one hour. We do not control OpenAI's data retention practices; please review OpenAI's privacy policy for details.
Security Measures
We implement commercially reasonable technical and organizational measures to protect your personal information, including encrypted data transmission (HTTPS/TLS for all API calls, WSS for WebSocket connections), AES-256 encryption of audio files before upload, Firebase security rules restricting data access to authenticated account owners, rate limiting on API endpoints, and the OpenAI API key stored exclusively on our backend servers (never on client devices).
No Guarantee. Despite our efforts, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your personal information. You use the Service at your own risk.
5. Data Retention
Default Retention. We retain your personal information for as long as your account is active or as needed to provide the Service, unless you select a shorter retention period during consent.
Consent-Based Retention Preferences. During onboarding, you may select a data retention preference of indefinite, three years, or one year. We store this preference and will honor it; however, automated enforcement of retention windows is currently under development. Until automated deletion is implemented, you may contact us to request manual deletion of your data in accordance with your selected preference.
Account Deletion. You may delete your account through the App's settings. Account deletion removes your Firebase Authentication credentials. To request complete deletion of all cloud-stored data, please contact us at echoes-legal@agenticsoftwaresolutions.io.
Temporary Files. AI-generated audio segments stored in temporary directories are automatically deleted within 24 hours.
6. Your Rights and Choices
Access and Portability. You may request a copy of the personal information we hold about you.
Correction. You may request correction of inaccurate personal information.
Deletion. You may request deletion of your personal information, subject to certain exceptions (e.g., legal compliance obligations).
Consent Withdrawal. You may withdraw consent for voice recording and story processing at any time by ceasing use of the recording features. Previously recorded data will be retained in accordance with your retention preference unless you request deletion.
Microphone Access. You may revoke microphone permission at any time through your device's iOS Settings. The recording features will not function without this permission.
7. California Residents — CCPA/CPRA Rights
If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"):
Right to Know. You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom it was shared.
Right to Delete. You have the right to request deletion of your personal information, subject to certain exceptions.
Right to Correct. You have the right to request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing. We do not sell your personal information or share it for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information. We collect sensitive personal information (voice recordings, account credentials). We use this information only as necessary to provide the Service. You may request that we limit the use of your sensitive personal information.
Right to Non-Discrimination. We will not discriminate against you for exercising your CCPA rights.
Categories of Personal Information Collected (preceding 12 months): Identifiers (name, email, user ID); audio/electronic/visual information (voice recordings); internet or electronic network activity (analytics events, device info); inferences drawn from the above (extracted entities, timeline events, fact ledger, narrative threads, safety events); and sensitive personal information (account login credentials, voice recordings).
To Exercise Your Rights. Submit a verifiable request to echoes-legal@agenticsoftwaresolutions.io. Include "CCPA Request" in the subject line. We will respond within 45 days, with a possible 45-day extension if reasonably necessary.
8. International Data Transfers
The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to such transfer.
9. Children's Privacy
The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information promptly. If you believe we have collected information from a person under 18, please contact us at echoes-legal@agenticsoftwaresolutions.io.
While the account holder must be 18 or older, the storyteller being interviewed may be of any age. The account holder is responsible for obtaining any necessary consent for storytellers who participate in interviews.
10. Third-Party Links and Services
The Service may contain links to third-party websites or services (e.g., crisis hotlines, OpenAI). We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you interact with.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Website and/or within the App, updating the "Last Updated" date, and, where required by law, providing additional notice. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.
12. Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us at:
Agentic Software Solutions, LLC
For CCPA-specific requests, please include "CCPA Request" in the subject line.
13. Additional Disclosures
OpenAI Data Processing
When you use the recording features, your voice audio is transmitted in real-time to OpenAI via an encrypted WebSocket connection. Additionally, contextual information about the storyteller — including their name, relationship, previously extracted entities and relationships, timeline events and gaps, emotional boundaries and trigger keywords, and prior session summaries — is included in the system prompt sent to OpenAI. We use ephemeral session tokens valid for one hour. The OpenAI API key is never exposed to the client device.
We do not control how OpenAI processes, stores, or retains data received through its API. We recommend reviewing OpenAI's API data usage policies for the most current information.
Crisis Resource Data
If our safety monitoring system detects indicators of emotional distress or imminent danger during an interview, we may display crisis resources including the 988 Suicide & Crisis Lifeline, the Crisis Text Line (text HOME to 741741), and Adult Protective Services (1-800-677-1116). The occurrence and severity tier of safety events are logged. For the highest severity events, trigger content is anonymized before storage.
Data Processing for AI Context
To provide a coherent multi-session interview experience, we compile and send to OpenAI an evolving context that includes all previously extracted entities, relationships, narrative threads, timeline events, detected chronological gaps, emotional boundaries, and session summaries. Information disclosed in earlier sessions may be referenced in later sessions. If you wish to prevent certain information from being used in future AI context, you may set emotional boundaries within the App or contact us to request modification of your stored data.
Do Not Track
The Service does not respond to "Do Not Track" browser signals.
This Privacy Policy is provided for informational purposes and does not constitute legal advice. We recommend consulting with a qualified attorney for legal guidance specific to your situation.