Privacy Policy

Last updated: August 18, 2026

Echoed is a journaling app for reflecting on conversations. This policy explains what it collects, why, and what you can do about it. It is written to be read, not to be survived.

Who is responsible for your data

Echoed is operated by Mathieu Bergevin, an individual based in Quebec, Canada.

Privacy Officer: Mathieu Bergevin
Email: hello@echoed.app
Mail: 3214-900 rue Saint-Jacques
Montreal, Quebec
Canada

For the purposes of Quebec's Law 25 and the EU General Data Protection Regulation, Mathieu Bergevin is the person responsible for the protection of personal information, and the data controller.

What Echoed collects

Information you give us

Your email address, used to create your account, sign you in, and reset your password.
Your display name, if you choose to set one. Optional and only used to greet you inside the app.
Your entries, meaning everything you write in Echoed: what happened, what could be improved, the rating you assign, and the date. This is the most sensitive information Echoed holds and it is treated accordingly.

Information collected automatically

Technical data required to run the service, including your IP address and timestamps of requests, logged by our hosting provider for security and abuse prevention.

Information Echoed does not collect

No advertising identifiers.
No location data.
No contacts, photos, microphone, or camera access.
No analytics or behavioural tracking. There is no analytics SDK in the app and no tracking on this website.
No crash reporting or error tracking service.
No payment card details. Purchases are handled entirely by Apple, and Apple does not share your payment information with us.

Why Echoed uses your information

What	Why	Legal basis under GDPR
Email and password	To create and secure your account	Performance of a contract
Display name	To personalise the app	Performance of a contract
Your entries	To store, sync, and display your own writing back to you	Performance of a contract
IP address and request logs	To keep the service secure and prevent abuse	Legitimate interest
Email address	To send essential service messages such as password resets	Performance of a contract

Echoed does not send marketing email. If that ever changes, it will be opt-in and separately consented to.

What Echoed never does with your entries

Your entries are never sold, rented, or shared with advertisers.
Your entries are never used to train artificial intelligence models, ours or anyone else's.
Your entries are never read by a human at Echoed except in the rare case where you explicitly ask for help with a specific entry and give permission in writing.
Your entries are never shared with any third party except the infrastructure provider described below, which stores them on our behalf and does not access their contents.

Who else touches your data

Echoed uses two sub-processors:

Supabase provides database hosting, authentication, and sync. Your account information and entries are stored on Supabase infrastructure located in Canada. Supabase processes this data solely on our instructions and does not use it for its own purposes. Their privacy commitments are at supabase.com/privacy.

Resend handles transactional email delivery such as password resets and account confirmations. Email delivery is processed in the United States, covered by the standard contractual protections offered by that provider.

Separately, Apple handles all payments and subscriptions as an independent data controller, not as a sub-processor. Apple does not give us your name, payment method, or billing address. We receive only an anonymous confirmation that a subscription is active.

That is the complete list.

Where your data is stored, and international transfers

Your data is stored in Canada. If you are located outside Canada, your information is transferred to and stored in Canada.

For transfers from the EEA and the UK, this transfer relies on Standard Contractual Clauses in place with our infrastructure provider, and Canada is recognised by the UK as providing an adequate level of data protection for commercial organisations. For users in Quebec, your data stays in Canada.

How long your data is kept

Your entries and account information are kept for as long as your account exists.
When you delete your account, your account record and all entries are permanently deleted from our active systems immediately, and purged from encrypted backups within 30 days.
Server logs containing IP addresses are retained for 30 days, then deleted.
Deletion is permanent. There is no recovery period and no way to restore a deleted account. Export your entries first if you want a copy.

Security

Your data is encrypted in transit using TLS and encrypted at rest by our infrastructure provider. Access to production systems is restricted to the operator of Echoed and protected by multi-factor authentication. Database-level access rules ensure that no account can read another account's entries.

No system is perfectly secure. If a breach occurs that presents a risk of serious injury, you will be notified and the relevant authorities informed, as required under Law 25 and the GDPR.

Your rights

Wherever you live, you can:

Access the personal information Echoed holds about you.
Correct anything inaccurate.
Delete your account and all associated data, directly in the app under You, then Settings, then Delete Account. No request needed and no reason required.
Export your entries in a portable format, directly in the app.
Withdraw consent and stop using the service at any time.

If you are in the EEA or UK, you additionally have the right to restrict or object to processing, and the right to lodge a complaint with your national supervisory authority.

If you are in Quebec, you have the right to submit a complaint to the Commission d'accès à l'information du Québec, and the right to be informed of and contest any decision based solely on automated processing. Echoed does not make automated decisions about you.

To exercise any right that is not already available in the app, email hello@echoed.app. We will respond within 30 days.

Children

Echoed is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has created an account, email hello@echoed.app and it will be deleted.

Changes to this policy

If this policy changes in a way that materially affects your rights, you will be notified by email and in the app before the change takes effect. Minor clarifications will be published here with an updated date at the top.

Contact

hello@echoed.app
Mathieu Bergevin, Privacy Officer
3214-900 rue Saint-Jacques
Montreal, Quebec
Canada