Our Privacy-First Commitment

Echophrase is built with privacy at its core. All voice transcription happens locally on your device using your GPU. We never collect, transmit, or store your voice data, audio files, or transcriptions.

All AI models, recordings, and transcriptions remain on your device. Your voice never leaves your computer.

1. About Us

Company: Imperium42 LLC
Type: Wyoming Limited Liability Company
Address: 1621 Central Ave, Cheyenne, WY 82001, USA
Legal Contact: [email protected]
Data Storage Location: United States of America

2. What We Do NOT Collect

✗ Voice Data: We do not collect, transmit, or store any audio recordings
✗ Transcriptions: We do not collect or store any transcribed text from your audio
✗ AI Models: All models run locally; we do not receive model outputs or inputs
✗ Content: We have zero access to what you transcribe or how you use the software

3. What We Collect (Minimal Data Only)

We collect only the minimal data necessary for authentication, licensing, and product improvement:

3.1 Account & Authentication Data

Email Address: Collected via Supabase authentication for account identification
OAuth Tokens: Temporary session exchange tokens (securely stored in USA)
Refresh Tokens: To keep you logged in without re-authentication (valid ~1 year)
OAuth Scopes Used:
- Authentication (verify identity)
- Authorization (access permissions)
- Offline access (refresh tokens to prevent daily re-login)

3.2 Anonymous Telemetry (Opt-Out Available)

We may store anonymous crash reports and anonymous usage statistics to improve the product. You can opt out at any time in Settings.

Anonymous Crash Reports: Error information to identify and fix bugs (no personal data)
Anonymous Usage Stats: Feature usage patterns to guide development priorities
GPU Information: GPU model and compute capability (to optimize performance)
Selected AI Model: Which transcription model you choose, e.g. Parakeet-TDT or Qwen3-ASR (to improve model recommendations)
Application Version: To ensure compatibility and provide updates

No transcription audio or transcription text is ever collected.

3.3 Cloud Sync for Settings (Pro Subscribers)

Pro subscribers can opt in to syncing application settings to our servers so they carry across every device you sign in on. Cloud sync is off by default and must be enabled per device (Settings -> Cloud Sync). It applies only while you are signed in to a Pro account with sync enabled - Free accounts, signed-out use, and devices where you have not enabled it never sync anything.

What Syncs: Application preferences only - theme, interface language and scale, transcription language, hotkey, output destinations, text formatting options, interface toggles, your selected transcription and text-transformation models, and your text-transformation rules.
What Does NOT Sync: Voice data, audio, or transcriptions of any kind. Also excluded: any API keys you have entered, hardware and performance settings (GPU provider, compute type, microphone selection, voice sensitivity), and local file paths such as your transcript save folder. These stay on the device they belong to.
How It Is Stored: Settings are stored as a content-addressed snapshot on our Supabase infrastructure, associated with your account ID.
Access & Deletion: Your synced settings are included when you export your data (see Section 9), and deleting your account deletes them. You can also disable sync or request deletion at any time.

3.4 Subscription & Licensing Data

Subscription Tier: Free, Pro, or Enterprise
Payment Information: Processed securely by Paddle (we do not store credit card details)
License Status: Active, expired, or canceled
Billing Information: As required by USA tax law

4. How We Use Your Data

Authentication: To verify your identity and maintain your login session
Subscription Management: To provide access to Pro/Enterprise features
Product Improvement: To analyze anonymized telemetry and optimize performance
Legal Compliance: To comply with USA tax, accounting, and business regulations
Customer Support: To respond to your inquiries and provide technical assistance

5. Third-Party Services

5.1 Supabase (Authentication & Database)

We use Supabase for user authentication and database storage. Supabase processes:

Email addresses and authentication tokens
User account data and preferences
Authentication session data

Supabase’s privacy policy: https://supabase.com/privacy

5.2 Paddle (Payments)

We use Paddle as our merchant of record for subscription payments. The majority of payment information is securely stored with Paddle. They process:

Payment information (credit cards, PayPal, etc.)
Subscription billing and invoices
Billing address and tax information

Paddle’s privacy policy: https://www.paddle.com/legal/privacy

GDPR & CCPA Compliance: Supabase and Paddle are fully compliant with GDPR, CCPA, and other regional data protection regulations. As data processors, they process data on our behalf while Imperium42 LLC remains the data controller.

5.3 Cloudflare (Website Infrastructure)

Our website uses Cloudflare for CDN, DDoS protection, and SSL. Cloudflare may collect:

IP addresses (for security and performance)
Browser metadata (User-Agent, etc.)

Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/

5.4 Website Analytics (Umami)

We use Umami, an open-source analytics tool, self-hosted on our own infrastructure (no third-party data sharing).

Cookieless - no cookie consent banner required
Collects: page views, referrer URLs, browser/OS type, country (derived from IP, IP itself is not stored), outbound link clicks (e.g., checkout, download, Discord)
Does NOT collect: IP addresses (not stored), personal identifiers, cookies, cross-site tracking, device fingerprints
Purpose: understand which pages are visited, how visitors find us, and whether pricing/download links are clicked

5.5 Desktop App Analytics (Aptabase)

We use Aptabase, an open-source analytics tool, self-hosted on our own infrastructure.

Collects: app version, OS, GPU backend type, selected transcription model, feature usage signals (recording mode, paste-at-cursor, filler word removal), subscription tier (free / pro / enterprise, not user ID)
Does NOT collect: transcription content, audio, IP addresses (not stored), device fingerprints, user identifiers
Opt-out: Settings > Data > “Help improve Echophrase” toggle
Purpose: understand hardware/model distribution and feature adoption to prioritize development
Data retention: raw events deleted after 1 year

6. Offline Operation

The Free tier requires no account and works fully offline from first launch, with no activation step and no refresh token dependency. If you sign in for a Pro or Enterprise subscription, that account can also operate offline, subject to the periodic re-authentication described in our Terms of Service. During offline use, on any tier:

All transcription happens locally on your device
No data is transmitted to our servers
Your voice data stays on your computer
Internet connection is only ever required for Pro/Enterprise license renewal or re-authentication - never for Free-tier transcription

7. Data Storage & Security

Storage Location: All collected data is securely stored in the United States of America.

Security Measures:

TLS/SSL encryption for all data in transit
Encrypted storage for authentication tokens
Industry-standard security practices
Regular security audits and updates
Minimal data retention (we delete data when no longer needed)

8. Data Retention

Active Accounts: Data retained while your account is active
Inactive Accounts: Deleted after 2 years of inactivity
Deleted Accounts: Data permanently deleted within 30 days
Legal Requirements: Some data may be retained longer for tax/legal compliance (e.g., invoices for 7 years)
Webhook Data: Payment webhook event metadata (event type, timestamps) is retained for audit purposes. Raw webhook payloads from our payment processor are purged after 90 days; event records are deleted after 1 year

9. Your Privacy Rights

You have the right to:

Access: Request a copy of all data we hold about you
Correction: Request correction of inaccurate data
Deletion: Request deletion of your account and data
Portability: Export your data in a machine-readable format
Opt-Out: Disable telemetry collection in application settings
Withdraw Consent: Revoke OAuth permissions at any time

How to Request Data Deletion or Access

Data access and deletion are self-serve directly in the Echophrase app:

1. Self-serve (recommended - instant):

Open Echophrase and go to Settings → Data
Export your data (GDPR data access/portability) - download a machine-readable copy of all data we hold about you
Delete your account - permanently deletes your account and associated data (see Section 8, Data Retention, above)

2. By email (if you can no longer access the app):

Email: [email protected]
Include: Your registered email address and specific request (deletion, access, correction)
Response time: Within 30 days per GDPR requirements

3. For data stored by our third-party providers:

Self-serve deletion and email requests cover data held by our processors on our behalf, OR
You can contact them directly:
- Supabase: Privacy Policy
- Paddle: Privacy Policy

10. GDPR & CCPA Compliance

For European Users (GDPR):

We process data lawfully under legitimate business interests and consent
You have the right to lodge a complaint with your data protection authority
International transfers comply with GDPR requirements

For California Residents (CCPA):

We do not sell your personal information
You have the right to request disclosure of data collection practices
You have the right to request deletion of your data

11. Children’s Privacy

Echophrase is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us immediately at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy on our website with a new “Last Updated” date, and the changes take effect when posted. We are not obligated to provide individual notice of changes except where applicable data protection law requires it (for example, for material changes affecting how we process your personal data). Where we are required to give (or otherwise choose to give) individual notice, we may do so by email to your registered address, by an in-app notice, or by any other reasonable means, at our discretion. We encourage you to review this policy periodically.

Your continued use of Echophrase after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, concerns, or requests, contact us:

Email: [email protected]

Mail:
Imperium42 LLC
Attn: Privacy Officer - Echophrase
1621 Central Ave
Cheyenne, WY 82001
United States

General Support: Contact Form

14. Governing Law

This Privacy Policy is governed by the laws of the State of Wyoming and the United States of America, without regard to conflict of law principles. Any disputes arising from this policy shall be resolved in the courts of Wyoming.