Our Privacy-First Commitment

Echophrase is built with privacy at its core. All voice transcription happens locally on your device using your GPU. We never collect, transmit, or store your voice data, audio files, or transcriptions.

All AI models, recordings, and transcriptions remain on your device. Your voice never leaves your computer.

1. About Us

Company: Imperium42 LLC Type: Wyoming Limited Liability Company Address: 30 N Gould St, Ste N, Sheridan, WY 82801, USA Legal Contact: [email protected] Data Storage Location: United States of America

2. What We Do NOT Collect

✗ Voice Data: We do not collect, transmit, or store any audio recordings
✗ Transcriptions: We do not collect or store any transcribed text from your audio
✗ AI Models: All models run locally; we do not receive model outputs or inputs
✗ Content: We have zero access to what you transcribe or how you use the software

3. What We Collect (Minimal Data Only)

We collect only the minimal data necessary for authentication, licensing, and product improvement:

3.1 Account & Authentication Data

Email Address: Collected via Supabase authentication for account identification
OAuth Tokens: Temporary session exchange tokens (securely stored in USA)
Refresh Tokens: To keep you logged in without re-authentication (valid ~1 year)
OAuth Scopes Used:
- Authentication (verify identity)
- Authorization (access permissions)
- Offline access (refresh tokens to prevent daily re-login)

3.2 Anonymous Telemetry (Opt-Out Available)

We may store anonymous crash reports and anonymous usage statistics to improve the product. You can opt out at any time in Settings.

Anonymous Crash Reports: Error information to identify and fix bugs (no personal data)
Anonymous Usage Stats: Feature usage patterns to guide development priorities
GPU Information: GPU model and compute capability (to optimize performance)
Selected AI Model: Which Whisper model you choose (to improve model recommendations)
Application Version: To ensure compatibility and provide updates

No transcription audio or transcription text is ever collected.

3.3 Future: Cloud Sync for Settings (Optional)

We may offer optional cloud sync for application settings in the future. If implemented:

What Would Sync: Only application preferences and settings (hotkeys, model selection, UI preferences)
What Would NOT Sync: Voice data, transcriptions, or any audio content
Opt-In Only: Cloud sync would be disabled by default and require explicit opt-in
Opt-Out Anytime: You can disable cloud sync and delete synced data at any time in Settings

3.4 Subscription & Licensing Data

Subscription Tier: Free, Pro, or Enterprise
Payment Information: Processed securely by Lemon Squeezy (we do not store credit card details)
License Status: Active, expired, or canceled
Billing Information: As required by USA tax law

4. How We Use Your Data

Authentication: To verify your identity and maintain your login session
Subscription Management: To provide access to Pro/Enterprise features
Product Improvement: To analyze anonymized telemetry and optimize performance
Legal Compliance: To comply with USA tax, accounting, and business regulations
Customer Support: To respond to your inquiries and provide technical assistance

5. Third-Party Services

5.1 Supabase (Authentication & Database)

We use Supabase for user authentication and database storage. Supabase processes:

Email addresses and authentication tokens
User account data and preferences
Authentication session data

Supabase’s privacy policy: https://supabase.com/privacy

5.2 Lemon Squeezy (Payments)

We use Lemon Squeezy (recently acquired by Stripe) for subscription payments. The majority of payment information is securely stored with Lemon Squeezy. They process:

Payment information (credit cards, PayPal, etc.)
Subscription billing and invoices
Billing address and tax information

Lemon Squeezy’s privacy policy: https://www.lemonsqueezy.com/privacy

GDPR & CCPA Compliance: Supabase and Lemon Squeezy are fully compliant with GDPR, CCPA, and other regional data protection regulations. As data processors, they process data on our behalf while Imperium42 LLC remains the data controller.

5.3 Cloudflare (Website Infrastructure)

Our website uses Cloudflare for CDN, DDoS protection, and SSL. Cloudflare may collect:

IP addresses (for security and performance)
Browser metadata (User-Agent, etc.)

Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/

5.4 Website Analytics (Umami)

We use Umami, an open-source analytics tool, self-hosted on our own infrastructure (no third-party data sharing).

Cookieless - no cookie consent banner required
Collects: page views, referrer URLs, browser/OS type, country (derived from IP, IP itself is not stored), outbound link clicks (e.g., checkout, download, Discord)
Does NOT collect: IP addresses (not stored), personal identifiers, cookies, cross-site tracking, device fingerprints
Purpose: understand which pages are visited, how visitors find us, and whether pricing/download links are clicked

5.5 Desktop App Analytics (Aptabase)

We use Aptabase, an open-source analytics tool, self-hosted on our own infrastructure.

Collects: app version, OS, GPU backend type, selected transcription model, feature usage signals (recording mode, paste-at-cursor, filler word removal), subscription tier (anonymous - pre-login/free/pro, not user ID)
Does NOT collect: transcription content, audio, IP addresses (not stored), device fingerprints, user identifiers
Opt-out: Settings > Data > “Help improve Echophrase” toggle
Purpose: understand hardware/model distribution and feature adoption to prioritize development
Data retention: raw events deleted after 1 year

6. Offline Operation

After initial activation, Echophrase can operate fully offline as long as your refresh token remains valid (typically ~1 year). During offline use:

All transcription happens locally on your device
No data is transmitted to our servers
Your voice data stays on your computer
Internet connection is only required for license renewal or re-authentication

7. Data Storage & Security

Storage Location: All collected data is securely stored in the United States of America.

Security Measures:

TLS/SSL encryption for all data in transit
Encrypted storage for authentication tokens
Industry-standard security practices
Regular security audits and updates
Minimal data retention (we delete data when no longer needed)

8. Data Retention

Active Accounts: Data retained while your account is active
Inactive Accounts: Deleted after 2 years of inactivity
Deleted Accounts: Data permanently deleted within 30 days
Legal Requirements: Some data may be retained longer for tax/legal compliance (e.g., invoices for 7 years)
Webhook Data: Payment webhook event metadata (event type, timestamps) is retained for audit purposes. Raw webhook payloads from our payment processor are purged after 90 days; event records are deleted after 1 year

9. Your Privacy Rights

You have the right to:

Access: Request a copy of all data we hold about you
Correction: Request correction of inaccurate data
Deletion: Request deletion of your account and data
Portability: Export your data in a machine-readable format
Opt-Out: Disable telemetry collection in application settings
Withdraw Consent: Revoke OAuth permissions at any time

How to Request Data Deletion or Access

To exercise your privacy rights, follow these steps:

1. For data stored by Imperium42 LLC:

Email: [email protected]
Include: Your registered email address and specific request (deletion, access, correction)
Response time: Within 30 days per GDPR requirements

2. For data stored by our third-party providers:

We will coordinate the request with Supabase and Lemon Squeezy on your behalf, OR
You can contact them directly:
- Supabase: Privacy Policy
- Lemon Squeezy: Privacy Policy

10. GDPR & CCPA Compliance

For European Users (GDPR):

We process data lawfully under legitimate business interests and consent
You have the right to lodge a complaint with your data protection authority
International transfers comply with GDPR requirements

For California Residents (CCPA):

We do not sell your personal information
You have the right to request disclosure of data collection practices
You have the right to request deletion of your data

11. Children’s Privacy

Echophrase is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us immediately at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Posting the updated policy on our website with a new “Last Updated” date
Sending an email notification to your registered email address
Displaying an in-app notification on next launch

Your continued use of Echophrase after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, concerns, or requests, contact us:

Email: [email protected]

Mail: Imperium42 LLC Attn: Privacy Officer - Echophrase 30 N Gould St, Ste N Sheridan, WY 82801 United States

General Support: Contact Form

14. Governing Law

This Privacy Policy is governed by the laws of the State of Wyoming and the United States of America, without regard to conflict of law principles. Any disputes arising from this policy shall be resolved in the courts of Wyoming.