Privacy Policy

2. What We Do NOT Collect

3. What We Collect (Minimal Data Only)

We collect only the minimal data necessary for authentication, licensing, and product improvement:

3.1 Account & Authentication Data

• Email Address: Collected via Supabase authentication for account identification
• OAuth Tokens: Temporary session exchange tokens (securely stored in USA)
• Refresh Tokens: To keep you logged in without re-authentication (valid ~1 year)
• OAuth Scopes Used:
  • • Authentication (verify identity)
  • • Authorization (access permissions)
  • • Offline access (refresh tokens to prevent daily re-login)

3.2 Anonymous Telemetry (Opt-Out Available)

We may store anonymous crash reports and anonymous usage statistics to improve the product. You can opt out at any time in Settings.

• Anonymous Crash Reports: Error information to identify and fix bugs (no personal data)
• Anonymous Usage Stats: Feature usage patterns to guide development priorities
• GPU Information: GPU model and compute capability (to optimize performance)
• Selected AI Model: Which Whisper model you choose (to improve model recommendations)
• Application Version: To ensure compatibility and provide updates

No transcription audio or transcription text is ever collected.

3.3 Future: Cloud Sync for Settings (Optional)

We may offer optional cloud sync for application settings in the future. If implemented:

• What Would Sync: Only application preferences and settings (hotkeys, model selection, UI preferences)
• What Would NOT Sync: Voice data, transcriptions, or any audio content
• Opt-In Only: Cloud sync would be disabled by default and require explicit opt-in
• Opt-Out Anytime: You can disable cloud sync and delete synced data at any time in Settings

3.4 Subscription & Licensing Data

• Subscription Tier: Free, Pro, or Enterprise
• Payment Information: Processed securely by Lemon Squeezy (we do not store credit card details)
• License Status: Active, expired, or canceled
• Billing Information: As required by USA tax law

4. How We Use Your Data

• Authentication: To verify your identity and maintain your login session
• Subscription Management: To provide access to Pro/Enterprise features
• Product Improvement: To analyze anonymized telemetry and optimize performance
• Legal Compliance: To comply with USA tax, accounting, and business regulations
• Customer Support: To respond to your inquiries and provide technical assistance

5. Third-Party Services

5.1 Supabase (Authentication & Database)

We use Supabase for user authentication and database storage. Supabase processes:

• • Email addresses and authentication tokens
• • User account data and preferences
• • Authentication session data

Supabase's privacy policy: https://supabase.com/privacy

5.2 Lemon Squeezy (Payments)

We use Lemon Squeezy (recently acquired by Stripe) for subscription payments. The majority of payment information is securely stored with Lemon Squeezy. They process:

• • Payment information (credit cards, PayPal, etc.)
• • Subscription billing and invoices
• • Billing address and tax information

Lemon Squeezy's privacy policy: https://www.lemonsqueezy.com/privacy

GDPR & CCPA Compliance: Supabase and Lemon Squeezy are fully compliant with GDPR, CCPA, and other regional data protection regulations. As data processors, they process data on our behalf while Imperium42 LLC remains the data controller.

5.3 Cloudflare (Website Infrastructure)

Our website uses Cloudflare for CDN, DDoS protection, and SSL. Cloudflare may collect:

• • IP addresses (for security and performance)
• • Browser metadata (User-Agent, etc.)
• • Anonymized analytics data

Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

6. Offline Operation

After initial activation, Echophrase can operate fully offline as long as your refresh token remains valid (typically ~1 year). During offline use:

• • All transcription happens locally on your device
• • No data is transmitted to our servers
• • Your voice data stays on your computer
• • Internet connection is only required for license renewal or re-authentication

7. Data Storage & Security

Storage Location: All collected data is securely stored in the United States of America.

Security Measures:

• • TLS/SSL encryption for all data in transit
• • Encrypted storage for authentication tokens
• • Industry-standard security practices
• • Regular security audits and updates
• • Minimal data retention (we delete data when no longer needed)

8. Data Retention

• Active Accounts: Data retained while your account is active
• Inactive Accounts: Deleted after 2 years of inactivity
• Deleted Accounts: Data permanently deleted within 30 days
• Legal Requirements: Some data may be retained longer for tax/legal compliance (e.g., invoices for 7 years)

9. Your Privacy Rights

You have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and data
• Portability: Export your data in a machine-readable format
• Opt-Out: Disable telemetry collection in application settings
• Withdraw Consent: Revoke OAuth permissions at any time

10. GDPR & CCPA Compliance

For European Users (GDPR):

• • We process data lawfully under legitimate business interests and consent
• • You have the right to lodge a complaint with your data protection authority
• • International transfers comply with GDPR requirements

For California Residents (CCPA):

• • We do not sell your personal information
• • You have the right to request disclosure of data collection practices
• • You have the right to request deletion of your data

11. Children's Privacy

Echophrase is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us immediately at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• • Posting the updated policy on our website with a new "Last Updated" date
• • Sending an email notification to your registered email address
• • Displaying an in-app notification on next launch

Your continued use of Echophrase after changes constitutes acceptance of the updated policy.

14. Governing Law

This Privacy Policy is governed by the laws of the State of Wyoming and the United States of America, without regard to conflict of law principles. Any disputes arising from this policy shall be resolved in the courts of Wyoming.