Privacy at Echo
Updated October 24, 2026. This notice describes the current Echo app at echo-voice.pages.dev.
Sign-in information
Echo uses Supabase for email/password and Google sign-in. When you choose Google, Google supplies basic account information such as your account identifier, email, name and profile image to Supabase. Echo uses the verified account identifier to associate your Echo profile and activity with your sign-in. Echo does not request access to your Gmail messages, Google Drive files, calendar or contacts. Passwords are handled by Supabase Auth. Echo keeps sign-in and refresh tokens in secure, HttpOnly cookies.
Your profile and activity
Echo stores the username, display name, bio and photo you provide; published audio and its topic, title and timestamps; likes, listening state, friendship requests, blocks and reports. These records and private media bytes are hosted in Cloudflare D1. Your profile and active published audio are visible to signed-in Echo users, subject to the app’s blocking rules. Do not publish audio or profile details you want to keep private.
Audio and device storage
The microphone is used when you start recording and grant browser permission. Live recordings are limited to ten seconds and remain available until you delete the recording or your Echo profile. Recordings do not automatically expire. Demo activity, interests and the local inbox use your browser’s local storage or IndexedDB. Those device-local records are separate from the live feed.
Reports and safety
You can report a voice or profile with a category and optional details. Reports are stored privately for the app moderator, not shown to the reported person. A report keeps a reference to the target, its title or username, your reason and the review outcome. Moderators can review available reported audio and remove a reported voice. Reporting does not automatically remove content. Reports may remain after the voice or profile is deleted so the moderator can retain a review record.
Your controls
You can edit your profile, remove or replace your photo, delete your own published recordings, manage friendships and block profiles in Echo. “Delete Echo account” removes your Echo profile and associated app records; it does not delete your underlying Supabase sign-in identity. For sign-in identity deletion or other data requests, contact the app operator at xaviermercedes1718@gmail.com. You can clear browser site data to remove device-local records and revoke Google access from your Google account settings.
Service providers
Cloudflare hosts the app and app data. Supabase provides authentication. Google provides Google sign-in when you choose it. These services process requests and may retain operational or security logs under their own policies. Supabase Auth retains account information separately from Echo’s audio storage. This notice does not promise that deletion from active app storage also immediately removes provider logs or backups.