← EchoLing

EchoLing Privacy Policy

Effective date: 2026-04-28

Summary

EchoLing is designed with privacy in mind. By default, translation stays on your device using Apple's system frameworks. Only when you explicitly request online translation or AI-generated recall cards does content leave your device and pass through EchoLing's backend. We do not sell your personal information or use your saved vocabulary for third-party advertising.

Data We Collect

Account and session identifiers. When you sign in, we store a Supabase Auth user ID or an anonymous device user identifier. This lets us associate your saved entries and quota with your account.

Device and request metadata. Our servers log platform, app version, operating system, device model, IP address, timestamps, and request logs for security and debugging purposes.

Content you submit. When you use online translation or AI generation, the text you submit is processed by our backend and the relevant AI provider. Saved vocabulary entries (source text and translation) are stored in our database linked to your account.

Usage and quota data. We track daily generation quota consumption, generation events, and idempotency keys to prevent abuse and deliver consistent service.

Notification and widget data. Recall card content shown in widgets and notifications is derived from your saved entries. This data is stored in an app group container on your device or synced via iCloud, and does not leave your device except through the sync channel you choose.

How We Use Your Data

We use your data solely to provide and improve EchoLing:

  • Delivering translation, recall card generation, and iCloud sync.
  • Managing daily quotas and preventing abuse.
  • Debugging errors and improving reliability.
  • Sending optional push notifications for recall prompts (only if you grant permission).

We do not use your saved vocabulary or submitted text to train AI models for third parties, nor do we use it for targeted advertising.

Third-Party Data Processors

Supabase — authentication and database. Your account data and saved entries are stored in Supabase-managed infrastructure. See supabase.com/privacy.

DeepSeek (or current AI provider) — online translation and AI recall card generation. Text you submit for these features is sent to this provider for processing. Their data retention policies apply; please review their privacy terms.

Vercel (or current hosting platform) — hosting and request logs. Standard server-side logs including IP addresses are retained per Vercel's default log retention period.

Apple — TestFlight and App Store distribution, push notification delivery, and iCloud sync. Apple's privacy policy governs these interactions.

What We Don't Do

  • We do not sell your personal information to any third party.
  • We do not use your saved vocabulary or submitted text for third-party advertising targeting.
  • We do not send the text of your on-device default translations to our backend — that processing stays entirely on your device.
  • We do not share your data with any party not listed in this policy without your explicit consent, except as required by law.

Data Retention

Your account data and saved vocabulary entries are retained until you delete them or request account deletion. Server-side request logs follow the default retention policy of our hosting platform (currently Vercel). AI provider data retention follows the applicable provider's terms — we recommend reviewing DeepSeek's privacy policy for details on how submitted prompts are handled.

Your Rights

You may request access to, export of, correction of, or deletion of your personal data at any time by contacting us at hello@echoling.app. We will respond within 30 days.

California residents may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know, delete, and opt out of sale of personal information. As noted above, we do not sell personal information. For questions, contact us at the email above.

Children's Privacy

EchoLing is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately at hello@echoling.app.

Security

All data in transit is encrypted using TLS. Backend API keys and service credentials are server-side only and are never distributed to client apps. We apply the principle of least privilege to database and service permissions and minimize logging of user content.

Changes to This Policy

We may update this policy as EchoLing evolves. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you through the app. Continued use of EchoLing after changes constitutes acceptance of the updated policy.

Contact

For privacy questions, data requests, or to report a concern, contact us at hello@echoling.app.

Contact: hello@echoling.app