This Privacy Policy describes how Karuwa Apps Pvt. Ltd. (“we,” “us,” or “our”), doing business as Echo, collects, uses, discloses, and protects information when you use our mobile application Echo and related services (collectively, the “Services”).
Echo is a mobile app in the Apple Health & Fitness category for journaling, habit-style reminders, streak tracking, AI-assisted chat or optional live AI voice, and similar self-care tools (for example, a “no contact” tracker). Echo supports everyday wellness routines. Echo is not an emergency service, crisis hotline, or mental health provider. It cannot dispatch emergency services, connect you with a counselor, or guarantee that its AI will detect or appropriately respond to a mental health emergency. Always contact emergency services or a licensed mental health professional if you are in crisis.
Age: Echo is offered as a 17+ app on the Apple App Store. The Services are intended for people who are at least 17 years old (or the minimum age shown for Echo in the app store in your region, if higher). If you are younger than that age, do not use Echo or provide us personal information.
Questions: support@aiecho.live
Sensitive content. Because Echo is designed for emotional wellness and relationship recovery, the content you share — including journal entries, AI chat conversations, and voice call audio — may contain sensitive personal information related to your emotional or mental health. This content is handled under the third-party AI providers listed below and is subject to the consent you provide through our in-app AI consent flow. We do not sell this data. We do not use it to target advertising.
Location: The Echo app does not request access to your device’s precise location (e.g. GPS). We do not collect location through a location permission. IP addresses may still be processed by us and our providers for connectivity, security, and approximate region (as with most internet services).
Some information you choose to share in journals or chat may be sensitive (for example, relationship or personal-wellness topics you write about yourself). We process such content only to operate the Services you request and as described here.
Purchases are processed through Apple’s In-App Purchase. We do not receive your full payment card number or card security code. Apple (and, where applicable, subscription management tools such as RevenueCat) may process subscription status, transaction identifiers, and related account metadata. See Apple’s privacy policy: https://www.apple.com/legal/privacy/ and RevenueCat: https://www.revenuecat.com/privacy.
We receive limited profile and authentication information from Apple and Google when you use those sign-in options (for example, name, email or relay email, and identifiers), according to your settings with those providers.
Legal bases (EEA/UK): Where GDPR/UK GDPR applies, we rely on appropriate bases such as performance of a contract (providing Echo), legitimate interests (security, product improvement, where not overridden by your rights), consent where required (for example optional AI features, AI training, research participation, or non-essential cookies on our website, as applicable), and legal obligation where applicable.
When you opt in to AI in the Echo app and use an AI feature, we share personal data with the processors below so that feature can run. This sharing does not occur for AI generation until you have given permission in the app; you can change or withdraw that choice in Settings → Privacy & AI (or the equivalent screen name in the product).
Privacy policies for these AI processors: OpenRouter privacy; Google privacy policy. For Google’s AI developer terms and related disclosures, see also Google AI services terms where applicable to the APIs we use.
We share information with other service providers that process data on our behalf and need it to perform their work, including for example:
We enter into written agreements with our processors (including AI infrastructure providers) that require appropriate safeguards for personal information, processing on our instructions (as a processor or sub-processor where that concept applies), confidentiality, assistance with privacy requests where applicable, and permitted subprocessors only as allowed by contract. We do not sell your personal information for money. When we rely on subprocessors, we expect our primary vendors to impose comparable obligations downstream. No method of processing is perfectly secure; see Security below. We may disclose information if required by law or to protect rights and safety.
We may use information — after removing or obscuring details that identify you (de-identification) and, where possible, combining it with data from other users (aggregation) — to conduct research aimed at improving emotional-wellness and self-care tools, and we may share that de-identified or aggregated data with academic and scientific research organizations that help us evaluate outcomes of the Services and publish research.
Our marketing or informational website may use cookies and similar technologies. We may use Google Analytics on the website to understand traffic and usage. For details and choices, see our Cookie Policy.
The Echo mobile app does not include Google Analytics in the same way a web browser does; website visitors are subject to the Cookie Policy where applicable.
Permission before sharing. Echo does not send your chat, journals, guided journal text, or voice/audio inputs to third-party AI services for model inference until you opt in through the in-app consent flow. You can turn AI features off or adjust them at any time in Settings → Privacy & AI (or the equivalent path in the app). When AI is disabled or you have not consented, we do not send that content to OpenRouter or Google for AI generation as described here (ordinary account, security, or non-AI hosting may still use providers listed in Section 3).
Who receives what (plain language).
Mental Health & Safety Limitation. Echo's AI-generated responses — including text chat, guided journal prompts, and live voice call conversations — are not designed for and must not be used in situations involving suicidal ideation, self-harm urges, psychiatric emergencies, or any other mental health crisis requiring immediate professional intervention. Echo is not a crisis service and cannot contact emergency services on your behalf.
If you or someone you know may be at risk of self-harm or suicide:
AI responses may be inaccurate, incomplete, or contextually inappropriate. Do not rely on them for legal, financial, medical, or safety decisions.
Where to read more. Sharing with these vendors is summarized in Section 3.1. Their public privacy materials: OpenRouter; Google.
In addition to generating responses for your session, we may use data from your interactions with Echo — such as chat conversations, feedback you give on AI responses, and usage patterns — to train, fine-tune, and improve the AI systems behind Echo, so they become more accurate, safer, and more helpful. The following applies to any such use:
If you sign in with Apple or Google, we receive certain information from that provider as permitted by your settings with them. We use it to operate your account. Their use of your information is governed by their policies: Apple — Apple Privacy Policy; Google — Google Privacy Policy. If you use Google APIs in ways subject to Google’s API Services User Data Policy, we comply with those requirements for that use.
We are based in the United States. If you access Echo from outside the United States, your information may be processed in the U.S. and other countries where we or our providers operate. For transfers from the EEA, UK, or Switzerland subject to applicable law, we rely on appropriate safeguards such as the Standard Contractual Clauses (including through our vendors’ agreements) unless another valid mechanism applies.
We keep information for as long as needed to provide the Services, comply with law, resolve disputes, and enforce agreements. When you delete your account or ask us to delete personal information where applicable, we delete or anonymize it subject to legal retention needs and backup cycles.
Information collected as part of an IRB-approved research study that you separately opted into may be retained for up to seven (7) years following completion of the study, as required or permitted by the applicable research protocol, recordkeeping requirements, or law; this exception does not apply to ordinary use of Echo. We may retain de-identified or aggregated data (which no longer identifies you) for research and product improvement after your account is deleted.
We implement reasonable technical and organizational measures to protect information. No method of transmission or storage is 100% secure.
Echo is not directed at children under 13 (U.S. Children’s Online Privacy Protection Act category). We do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe we have collected information from a child under 13, contact us at support@aiecho.live and we will take appropriate steps to delete it.
Separately, Echo is listed as 17+ on the App Store and is intended for users who meet that age requirement (see Age above). We do not knowingly collect personal information from users who do not meet the applicable minimum age for the Services.
Depending on where you live, you may have rights to access, correct, delete, or export your personal information; to object to or restrict certain processing; to withdraw consent where processing is based on consent; and to lodge a complaint with a supervisory authority (EEA/UK).
To exercise rights: email support@aiecho.live. We may need to verify your request.
Cookie preferences (website): use the controls described in our Cookie Policy where applicable.
Residents of certain U.S. states may have additional rights under state law (including access, correction, deletion, portability, and opt-out of certain processing such as “sale,” “sharing,” or targeted advertising, where those terms apply).
Sale / sharing: We do not sell personal information for money. Depending on configuration, some website analytics could be considered “sharing” for cross-context behavioral advertising under California law — we aim to configure analytics and consent tools to match our practices; contact us to opt out of rights-based requests as applicable.
De-identified data: We may use and disclose de-identified or aggregated information for research and product improvement; we maintain it in de-identified form and do not attempt to re-identify it. This is not a “sale” of personal information.
The table reflects categories of personal information we may collect as described in this Policy. “Collected” means we collected it in the past 12 months or expect to collect it as the Services operate.
| Category | Examples (illustrative) | Collected |
|---|---|---|
| A. Identifiers | Name, email, IP, device identifiers, account ID | Yes |
| B. Customer records (Cal. Civ. Code § 1798.80) | Name, contact information | Yes |
| C. Protected classification | Race, religion, etc. | No |
| D. Commercial information | Subscription or purchase records (via Apple) | Yes |
| E. Biometric information | Voiceprints used solely as biometric identifiers | No* |
| F. Internet or network activity | App/website interaction, technical logs, analytics on website | Yes |
| G. Geolocation data | Precise GPS from the Echo app | No** |
| H. Audio, electronic, visual | Voice you send for AI or chat; profile photo | Yes |
| I. Professional / employment | Job applications, etc. | No |
| J. Education information | Student records | No |
| K. Inferences | Profiles used for automated decisions with legal effect | No*** |
| L. Sensitive personal information | Account credentials; certain user-generated journaling or reflection content you provide | Yes |
* We process voice audio you choose to send for features like AI chat or live voice; we do not use the Echo app to collect standalone “voiceprint” biometric templates for identity verification.
** The Echo app does not request device location permission. IP-based processing may still occur.
*** We do not build cross-context marketing profiles from inferences as described in typical “profiling for ad targeting” CPRA examples; AI responses may use session or saved context to operate features.
California residents may request information about disclosure of certain categories of personal information to third parties for their direct marketing purposes. Contact support@aiecho.live.
We may update this Policy. We will post the updated version and revise the “Last updated” date.
Karuwa Apps Pvt. Ltd. (Echo)
Email: support@aiecho.live
Review, update, or delete: use in-app account tools where available, or email support@aiecho.live.