Privacy Policy

Echo, operated by SH Group FZE LLC. Last updated 26 June 2026.

This policy explains what information Echo (“we”, “us”) collects when you use the Echo app and service (the “Service”), how we use it, and the choices you have. By using Echo you agree to this policy.

1. Who we are

The Service is provided by SH Group FZE LLC, United Arab Emirates. For any privacy question or request, contact us at [email protected].

2. Information we collect

• Account information — your username and, if you provide one, your email address. Passwords are stored only as a salted cryptographic hash; we never store your password in plain text.
• Your conversations and content — the messages you send, the assistant’s replies, any files you attach, and media the assistant generates for you (images, videos, web previews).
• Voice audio — when you use Voice mode or Live Translate, the microphone audio you record is captured and sent for speech-to-text so Echo can understand and respond.
• Saved memories — facts you explicitly ask Echo to remember are stored to your account and added to future conversations to personalize replies. You can view and delete them in the Memory screen.
• Usage information — counts and timestamps of your activity (e.g. messages per day) used for rate limits, abuse prevention, and service operation.
• Technical information — basic request data such as IP address and device/browser type, used for security and to operate the Service.

3. How we use your information

• To provide the Service — process your messages and return assistant responses and generated media.
• To apply fair-use limits, prevent abuse, and keep accounts secure.
• To operate, maintain, debug, and improve the Service.
• To contact you about your account (e.g. email verification), if you provided an email.

We do not sell your personal information, and we do not use your conversations for advertising.

4. AI processing

Echo’s assistant is powered by AI. To generate a response, the content of your message — together with any attachments or images you send, your audio when you use voice, and any memories you have asked Echo to save — is processed by the third-party AI providers named in Section 4a (Third-Party AI Services & Subprocessors) below, acting strictly as our processors on our behalf. Under their API terms they do not use this content to train their models, and each is contractually bound to protect your data to at least the same standard described in this policy. Echo discloses these providers and obtains your consent before your first message, image, or voice recording is sent for AI processing. Aside from these processors and our hosting infrastructure, we do not share your conversations with anyone.

4a. Third-Party AI Services & Subprocessors

To operate Echo we rely on the following third parties. We share only the data listed, only for the stated purpose. These are the only third parties that receive your content.

AI providers that process your content

• Anthropic (Claude) — your chat messages, the contents of files and images you attach, and the memories you ask Echo to save. Purpose: generate the assistant’s responses.
• OpenAI — your image prompts and any reference photos when you generate or edit images; your microphone audio in Voice mode and Live Translate; transcribed text sent for translation; and audio extracted from videos you ask Echo to transcribe. Purpose: image generation, speech-to-text, real-time voice, and translation.
• ElevenLabs — your microphone audio for voice transcription, and the assistant’s reply text to be spoken back to you (and, for media you create, creative prompts for optional music and sound effects). Purpose: voice transcription, spoken responses, and soundtrack generation.
• Tavily — the search terms you enter and any web links you ask Echo to open, when a request requires the live web. Purpose: web search and page retrieval.

Service & infrastructure providers

• Whop — your Echo username (as checkout metadata) and the email, name, billing address and payment-card details you enter into Whop’s checkout. Purpose: process subscriptions and billing. Card details are entered directly into Whop and handled under Whop’s own privacy policy.
• Cloudflare — your IP address and a challenge token at sign-up (bot protection), and delivery of app assets. Purpose: security and content delivery.
• Resend — your email address and username, only if you provide an email. Purpose: send account and verification emails.
• Open-Meteo — the place name you ask the weather for, with no account identifier. Purpose: return weather information.
• Google Fonts and jsDelivr — your IP address and device/browser type via standard asset requests. Purpose: load fonts and software libraries. No account or chat content is sent.
• Apple — App Store purchase receipts are verified locally on our server; no message content is sent to Apple for this.

Equal protection. Every provider listed above acts solely as our data processor under a data-processing agreement. They process your data only to perform the function described, do not use it to train their own AI models, and do not sell it. Each is contractually required to protect your data to at least the same privacy and security standard set out in this Privacy Policy. We hold every third party to the same commitments that apply to us, and we share your data with no one else except where required by law.

5. Encryption & security

Your stored conversations are encrypted at rest using a key derived from your password, so they cannot be read from a stolen disk or backup without your credentials. All traffic between your device and the Service is encrypted in transit (TLS). Note that, as with any AI assistant, your messages are processed in readable form at the moment they are handled in order to generate a response — true end-to-end encryption is not possible for a service that runs AI on your messages.

6. Data sharing

We share information only with the third parties named in Section 4a above — the AI providers that process your content and the service and infrastructure providers that run Echo — and only as described there. We may disclose information if required by law. We do not sell or rent your data.

7. Retention & deletion

We keep your account and content until you delete them. You can permanently delete your account and all associated data at any time from inside the app (open the menu → Delete account). This action is irreversible and removes your chats, generated media, usage records, and account. Attached files are also pruned automatically after a short period.

8. Children

Echo is not directed to children. You must be at least 17 years old (or the age of majority in your jurisdiction) to use the Service.

9. Your rights

You may access, correct, or delete your information. Account deletion is available directly in the app; for any other request, email [email protected].

10. International transfers

The Service is operated from, and your data may be processed in, the United Arab Emirates and other countries where we or our processors operate. By using the Service you consent to such transfers.

11. Changes

We may update this policy. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notice in the app.

12. Contact

Questions or requests: [email protected].