This Privacy Policy explains how EchoPilot ("EchoPilot", "we", "our") collects, uses, stores, and protects information when you use our mobile app, our website, and any integrations you choose to connect. By using EchoPilot you agree to the practices described below.
Summary
- EchoPilot is a voice-first productivity app. It transcribes voice notes, extracts structured actions (tasks, reminders, events, notes, emails), and lets you route approved actions to services you connect.
- Before sending personal data to a third-party AI service, EchoPilot asks for permission in the app and identifies the data sent and the processor receiving it.
- EchoPilot only accesses data from connected services after you explicitly authorize the connection, and only performs actions you confirm inside the app.
- EchoPilot does not sell user data. We do not use Google user data for advertising. We do not train generalized machine-learning models on Google user data.
- You can disconnect any integration at any time. You can request account or data deletion by emailing support@echopilotapp.com.
Information we collect
- Account information - email address, display name, authentication identifiers issued by Supabase, and subscription state.
- Voice and content data - audio recordings you create on iPhone or Apple Watch, their transcripts, extracted action cards, follow-up messages, and related metadata such as session timestamps and timezone.
- Integration data - OAuth credentials and minimum sync metadata (provider identifiers, external resource IDs, sync status, last-synced timestamps) for the services you connect.
- Search index data - to power Ask EchoPilot, we convert your transcripts and action cards into numeric representations (embeddings) that capture their meaning, and store them alongside your content so you can search by meaning rather than exact keywords. Embeddings are derived from your content and are stored durably until you delete them.
- Technical data - device model, OS version, app version, anonymized usage events, and crash diagnostics used to operate and improve the service.
How we use information
- To transcribe your voice notes and convert transcripts into structured action cards.
- To store your sessions, built-in Tasks, Reminders, Notes, action cards, preferences, and integration settings so you can revisit and refine them.
- To route approved actions to the destination you select, only after you tap the explicit confirmation control inside the app.
- To build and maintain a personal semantic search index over your own transcripts and action cards, so Ask EchoPilot can answer questions about what you captured. This index is used only to answer your own queries and is never used to train third-party models.
- To provide support, security, debugging, abuse prevention, and product improvement.
Third-party AI processing
EchoPilot uses LatentKit as its third-party AI processor for speech-to-text transcription, structured action extraction, and AI follow-up refinement. LatentKit may route language-model requests to one or more model providers configured under EchoPilot's LatentKit policy, and EchoPilot may rotate between these providers to maintain reliability and quality. These providers currently include DeepSeek, Google (Gemini), OpenAI, and Anthropic.
When you allow AI processing in the app, EchoPilot may send LatentKit the following data only as needed to provide the requested feature:
- Audio recordings for speech-to-text transcription.
- Transcripts, follow-up messages, recent session thread context, selected action titles/bodies, and action metadata for extraction or refinement.
- Timezone, enabled destination names, display name, and default destination preferences so the AI can resolve dates and route actions accurately.
EchoPilot does not sell this data or use it for advertising. We require processors that receive user data to provide the same or equal protection described in this policy and to process data only to provide EchoPilot's user-facing features.
Google API user data
EchoPilot integrates with the following Google APIs at your option. Each scope is requested only because it is required for a specific user-facing feature.
Google Tasks (https://www.googleapis.com/auth/tasks)
- Why we need it: To create, update, complete, and delete Google Tasks that you generate from a voice note inside EchoPilot.
- What we access: Tasks on your default or selected task list. We read task IDs for tasks EchoPilot creates so we can update them later.
- How we store it: OAuth tokens encrypted at rest. Minimum sync metadata (task ID, sync status, timestamps).
Google Calendar
- Why we need it: To create, update, and delete calendar events that you approve in EchoPilot.
- What we access: Event details needed for EchoPilot-created events, including title, date/time, location, notes, external IDs, and sync status.
- How we store it: OAuth tokens encrypted at rest plus minimum event sync metadata.
Google Drive
- Why we need it: To create and update documents or text files that you approve from note actions.
- What we access: Files EchoPilot creates or is authorized to manage under the granted Drive scope, plus file IDs and sync status.
- How we store it: OAuth tokens encrypted at rest plus minimum file sync metadata.
Slack user data
EchoPilot requests Slack access only when you connect Slack from Integrations.
- Why we need it: To post note actions you approve to the Slack channel selected during installation.
- What we access: The selected workspace/channel metadata and permission to post messages as the EchoPilot app.
- How we store it: OAuth bot tokens encrypted at rest, plus minimum channel and sync metadata.
Other connected services and device destinations
- Todoist, Notion, and Microsoft services - if you connect them, EchoPilot stores encrypted OAuth credentials and sends only the approved action data required to create, update, send, or remove the item you confirm.
- Apple Reminders, Device Calendar, alarms, and notifications - EchoPilot requests device permissions when needed, writes approved reminders/events through device APIs, and schedules user-created reminder or task alerts on the device.
- Apple Notes, WhatsApp, and Mail - EchoPilot opens a share sheet, prefilled WhatsApp handoff, or mail composer with approved content; it does not silently save to Notes or send a WhatsApp or Mail message through these user-mediated flows.
Google API Services User Data Policy - Limited Use
EchoPilot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:
- Google user data is used only to provide or improve user-facing features the data was granted for.
- We do not transfer Google user data to third parties except as necessary to provide those features, comply with law, or as part of a merger or acquisition with continued policy adherence.
- We do not use Google user data to serve advertising.
- Humans do not read Google user data except with your explicit consent, for security or legal reasons, or when aggregated and anonymized.
How long we keep your data
- Voice notes, transcripts, and action cards are retained while your account is active. You can delete individual sessions or actions in the app.
- Search index embeddings are retained while your account is active and are deleted when you delete the underlying session or action, or when you delete the whole index under Settings > Delete Ask memory. Deleting the index does not delete your notes.
- OAuth credentials are retained only while an integration is connected. Disconnecting deletes stored tokens.
- Account deletion removes personal data within 30 days, except where retention is required by law.
Security
We use industry-standard safeguards including encrypted-at-rest OAuth credentials, HTTPS in transit, and least-privilege access controls. No internet service can guarantee absolute security.
Your choices
- Enable, disable, or disconnect integrations in the EchoPilot app at any time.
- Revoke EchoPilot's access from myaccount.google.com/permissions.
- Delete the semantic search index at any time under Settings > Delete Ask memory. Your notes, tasks, and reminders are unaffected; new captures are indexed again unless you delete it once more.
- Delete your account from inside the app under Settings > Delete account. See Account deletion for steps and retention details.
- Request data export or other privacy actions at support@echopilotapp.com.
Third-party processors
- Supabase - authentication, database, and file storage.
- LatentKit - speech-to-text transcription, structured action extraction, AI follow-up refinement, and generating the embeddings used for the Ask EchoPilot search index.
- Language-model providers (DeepSeek, Google Gemini, OpenAI, Anthropic) - language-model processing through LatentKit policy for action extraction and refinement; EchoPilot may rotate between these providers.
- PostHog - product analytics when configured.
- RevenueCat - subscription management.
- Sentry - crash and error reporting.
- Vercel - application hosting.
- Connected integration providers - Google, Todoist, Slack, Notion, Microsoft, Apple device services, and Mail only when you connect, enable, or confirm sending an action to those destinations.
Children
EchoPilot is not directed to children under 13. We do not knowingly collect personal information from children.
International users
EchoPilot may process information in the United States. By using the service you understand your information may be transferred and processed there.
Changes
We may update this policy as the product evolves. Material changes are reflected in the "Last updated" date above.
Contact
Privacy questions and data-deletion requests: support@echopilotapp.com. Account deletion steps are available at Account deletion. We respond to verified privacy requests within five business days.