Privacy & Security

Last updated: October 8, 2026

What We Collect

When you create an ECHO by InnerCoded account, we store your email address, name, and the journal entries you choose to record. Each entry includes your transcript, your selected mood, and the reflections ECHO returns to you. Your recording is uploaded for transcription and can be played from your entry while available. The daily cleanup clears recording links from entries older than 24 hours. Removing a link or archive record does not establish deletion of the underlying file from Base44 storage.

What We Never Do

  • Read your entries by default. Your journal is private. No one at ECHO by InnerCoded reads your entries in the ordinary course of using the app. The one exception: if our automated safety system detects language suggesting a risk of self-harm or harm to others, a short excerpt — not your full entry — may be reviewed by a safety-focused team member to determine whether outreach or resources are appropriate. See "How We Protect You" below for details.
  • Sell your data. Your transcripts are never sold to advertisers, data brokers, or third parties.
  • Train AI on your words. ECHO does not train its own AI models on your journal entries. Third-party processing follows the applicable provider terms described below.
  • Hold your data hostage. You can export everything or delete everything at any time. Your archive is yours.

Third-Party AI Processing

ECHO by InnerCoded uses the following services for optional AI processing, with your permission:

  • OpenAI (Whisper and safety screening) — Your audio recording is sent to OpenAI to be transcribed into text, and entry text is sent for automated safety screening. Processing and retention depend on the applicable API service terms and account settings. Retention exceptions may apply for security, abuse monitoring, or legal obligations.
  • Anthropic (Claude) — Your transcript is sent directly to Anthropic for optional mood suggestions. Your transcript and relevant prior-entry context are also sent through Base44 to generate ECHO's reflection, DEPTH analysis, and reflection questions. Processing and retention follow the applicable provider and Base44 service terms.
  • ElevenLabs — When you choose Hear ECHO, reflection text is sent to ElevenLabs to generate audio. Its processing and retention are governed by the provider's applicable service terms.
  • Base44 — Hosts your account and archive and routes AI requests. Optional AI share images send selected entry text to Base44's image-generation service.

You can withdraw AI processing permission in Settings. Your existing archive and data exports remain available. Withdrawal stops new AI processing; it does not recall data already processed by a provider.

Provider retention and training settings can vary by service and account configuration. ECHO cannot guarantee that all providers immediately delete processed data. Review the applicable privacy policies and terms for OpenAI, Anthropic, ElevenLabs, and Base44.

How We Protect You

Encrypted in Transit and at Rest

Your data is protected with TLS 1.2+ encryption in transit and AES-256 encryption at rest, applied automatically across our infrastructure.

Private by Default, With One Disclosed Exception

Your entries aren't read by our team in the ordinary course of using ECHO. If an automated safety screen flags possible self-harm or harm-to-others language, a short excerpt may be reviewed by a safety-focused team member — solely to check whether outreach or resources are appropriate.

Audio Removed After Transcription

Your voice recording is used only to produce your transcript. After transcription, the next daily cleanup removes access to it through ECHO.

Complete Data Control

Export your entire archive as PDF or JSON anytime. Delete your account permanently with one action. Your entries are removed from your account immediately.

Site Analytics

When you visit our website, we collect basic visit data — device type, browser, screen size, general timezone, referring page, and how you interact with the page (clicks, scrolling). This is tied to a random identifier stored on your device, not to your name or email, and is used only to understand how people use our site. It is not sold or shared with advertisers.

Your Rights

Right to Access: Export your complete archive at any time from Settings. You receive all your entries, transcripts, ECHO summaries, mood data, patterns, and insights in portable formats.

Right to Deletion: Request permanent account and journal-record removal from Settings. ECHO confirms completion only when app-record and account removal succeed. Media references are removed with journal records; physical storage bytes, backups, and third-party processing retention remain subject to their providers' policies. Deleting ECHO does not automatically cancel an active Apple or Stripe subscription.

Right to Portability: Your data exports include structured JSON for technical use and formatted PDF for reading or sharing with a therapist or coach.

Right to Be Informed: If there is ever a data breach affecting your account, you will be notified within 72 hours with details about what happened and what we've done about it.

Transparency Report

Quarterly update · Current as of June 2026

Data export requests fulfilled0
Account deletions fulfilled0
Law enforcement requests received0
Data disclosed to law enforcement0

Questions about privacy? Contact us at privacy@innercoded.com

For general support: support@innercoded.com

Terms of UseSupport

placeholder

This is sacred ground.

Let it be so. And so it is.

Back to Becoming