1. Who we are
EchoMind is a personal wellbeing app operated by HorizontAce("HorizontAce", "we"). HorizontAce is the data controller for the personal data described in this policy. This policy explains what we collect, why, the legal basis we rely on, who we share it with, and the choices you have.
2. Data we collect
- Account: email address and (optionally) display name and avatar image.
- Voice recordings: audio clips you record, stored privately in your account.
- Habits & completions: the habits you create and when you mark them done.
- Journal & mood entries: text and mood ratings you save.
- Community posts: prompts, comments, and hearts you share in the Circle feed. These are visible to other signed-in users.
- Notification tokens: if you enable reminders, a push subscription token for your device.
- Billing data (paid plans only): to purchase a subscription you provide payment details directly to our payment processor, Paddle (see §5). HorizontAce receives from Paddle limited billing metadata — customer ID, subscription status, plan, billing period, country, and invoice history — but not full card numbers.
- Usage & diagnostics: minimal error logs to help us fix bugs. We do not use third-party ad or tracking SDKs.
3. How we use it and legal basis
- Provide the Service (authenticate you, play back recordings, track habits, deliver reminders, show community posts) — legal basis: performance of a contract.
- Process payments and manage subscriptions — legal basis: performance of a contract and legal obligation (tax/invoicing).
- Security, fraud prevention, and service integrity — legal basis: legitimate interests.
- Fix bugs and improve the product — legal basis: legitimate interests.
- Send transactional and reminder notifications you opted into — legal basis: consent (revocable any time).
We do not sell your data and we do not use it for advertising.
4. Where it lives
Data is stored on our managed cloud backend with row-level security so each account can only read its own private data. Voice recordings and avatars are stored in private object storage and served via short-lived signed URLs. We apply appropriate technical and organisational measures — encryption in transit, access controls, and least-privilege service credentials — to protect your data.
5. Who we share data with
- Paddle — Merchant of Record. Paddle.com Market Ltd and its affiliates act as the Merchant of Record and reseller for EchoMind subscriptions. When you purchase a plan, your payment details (card, billing address, tax information) are collected by Paddle, and Paddle shares subscription and billing metadata with HorizontAce so we can grant access. Paddle handles payments, tax compliance, invoicing, refunds, and payment-related customer service. See Paddle's Privacy Notice.
- Hosting and infrastructure providers that operate our cloud backend, object storage, and email delivery under our instruction.
- Push notification providers (browser push services and, on mobile, Apple / Google) to deliver reminders you opted into.
- Professional advisers (legal, accounting) where necessary.
- Authorities where required by law.
6. Permissions on your device
- Microphone: only when you tap record. No background capture.
- Notifications: only if you enable reminders. Turn off any time in Profile → Reminders or OS settings.
- Photos: only when you pick an avatar image.
7. Retention
We keep your content while your account is active. If you delete individual items they are removed from our systems. If you delete your account we remove your account data within 30 days, except billing/invoice records Paddle and we are legally required to retain (typically up to 7–10 years, depending on jurisdiction).
8. Your rights
Subject to local law you may have the right to access, correct, delete, export, restrict, or object to processing of your personal data, and to withdraw consent for anything based on it. UK/EEA users additionally have the right to lodge a complaint with their local data-protection supervisory authority.
- Export your data from Profile → Export data.
- Delete individual recordings, habits, entries, and community posts in-app.
- Request account deletion or exercise any right by emailing privacy@echo-mind.world.
9. International transfers
Our providers, including Paddle, may process personal data outside your country. Where data leaves the UK/EEA we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
10. Children
EchoMind is not directed to children under 13. If you believe a child has created an account, contact us and we will remove it.
11. Cookies
We use only essential cookies and local storage needed to keep you signed in and remember your preferences. We do not use advertising or cross-site tracking cookies.
12. Changes and contact
We will update the date above and notify you in-app for material changes. Contact HorizontAce at privacy@echo-mind.world.