Privacy Policy

1. Overview

Echo (“we”, “us”) operates the Echo platform at echoagent.space and its dashboard, API and integrations. When you use Echo we act as the data controller for the information described below. Where you connect your own accounts — an AI provider, a hosting provider, a database, a source-control provider — that provider acts as an independent controller of the data it receives under its own terms.

This policy applies to the Echo website, dashboard, preview runtime and billing. It does not apply to third-party websites, model providers or deployment targets that you connect yourself.

2. Information we collect

We collect the information you give us, the information our service generates while working for you, and a limited amount of technical data needed to operate and protect the platform.

Information you provide

• Account details — the name, email address, profile image and username returned by our sign-in provider, plus the records Echo creates for you (workspace names, member lists, roles and per-member credit limits).
• Project content — project names, descriptions, prompts, chat history, uploaded files and attachments, the plans and configurations produced by Echo, generated source code, preview snapshots, published release bundles and any custom domain you attach.
• Instructions and preferences — workspace skills, knowledge notes, security and MCP preferences, editor theme and language preferences, and provider keys you choose to connect.
• Support messages — anything you send us through the in-product support chat (where it is enabled), the contact page, or a sales enquiry form, including attachments you choose to include.

Information generated while you use Echo

• Execution records — runs, tasks, dependency graphs, tool invocations and their inputs and outputs, sandbox session metadata (runtime provider, runtime version, workspace files) and the checkpoints used to resume an interrupted build.
• Usage and cost records — the provider, model, token counts, latency and internal cost of each model call, together with the credit ledger entries that track how many credits were reserved, consumed or refunded.
• Privacy-safe routing telemetry — which agent profile and model route a run used and whether it succeeded. Echo deliberately excludes prompts, source files, environment values and provider credentials from this telemetry.
• Billing records — the plan, product, amount, currency, credit quantity and status of every purchase, top-up and renewal, plus the payment, subscription and customer identifiers issued by our payment processor.

Technical information we collect

• Security and abuse prevention — sign-in metadata such as IP address, device and browser characteristics, handled by our authentication provider and by our own request logs.
• Error and performance diagnostics — crash reports and performance measurements, used to keep the service reliable.
• Product analytics — aggregated page views, feature usage and acquisition attribution, subject to your analytics consent choice.

3. Account information and authentication

Echo uses Clerk to handle sign-in and sign-up. When you authenticate, Clerk shares your name, email address, profile image and sign-in metadata with Echo, and Echo creates a matching internal account record linked to your Clerk identifier. Echo never stores your password: credential verification happens entirely inside Clerk.

Session state is maintained with secure, HTTP-only cookies issued by Clerk. You can end your session at any time by signing out or by clearing your browser cookies, which will sign you out on the next request.

If you connect your own API keys or connect a third-party service to a workspace, the credential is encrypted before it is written to our database and only a short, non-secret hint (such as the last four characters) is kept in readable form so you can tell your keys apart. Decrypted credentials are used only to call the provider you selected and are never displayed back to you in full.

4. Projects, prompts and source code

Your prompts, uploaded files and the source code Echo generates for you are the core of the service, so Echo stores them so your project keeps working across sessions and devices. You can delete an individual project at any time, and deleting your account removes your projects with it.

Echo does not use your prompts, uploaded files, source code or project content to train general-purpose AI models. Echo does use de-identified, privacy-safe operational telemetry — for example, which agent profile and model route a run used and whether the run succeeded — to operate, debug and improve the platform.

You own the prompts you write and the source code Echo produces for your projects. You can export the full source code of any project as a ZIP archive at any time, and connect a source-control repository so the code can be pushed to a provider you control.

5. AI model providers and data processing

Echo is an orchestration layer. To generate code, Echo sends your prompt, the relevant project files and the surrounding context to the AI model provider selected for that step.

• Bring your own key (BYOK) — on the Free and Echo Infra plans you connect your own provider key. Your prompt and code are sent to that provider and are handled under the provider’s own terms and privacy policy. Your key is encrypted by Echo and is not shared beyond the request itself.
• Echo-managed compute — on paid plans Echo routes work across its own configured provider accounts. Echo selects the provider and model per step and may retry or fall back to another provider when a request fails.
• Supported providers — OpenAI, Anthropic, Google Gemini, Groq, OpenRouter, Moonshot AI, DeepSeek, Mistral, Together AI, Fireworks AI, xAI, Cohere, Perplexity and OpenCode.

Model providers process the content you send under their own terms. Please do not submit content to a provider that you are not permitted to share with that provider, and review provider policies before connecting a key for confidential work.

6. Cookies and analytics

Echo uses strictly necessary cookies to keep you signed in, to remember your workspace, to protect OAuth flows, and to remember your consent and preference choices. Product analytics (page views, feature usage and acquisition attribution) is only collected when analytics consent is enabled, and optional session replay only runs when replay consent is enabled. We do not use advertising trackers or sell advertising data.

Your analytics choice is kept in your browser under the local storage key echo_consent_v1, and is honoured by every analytics provider Echo loads. The full list of cookies and local storage Echo uses, and how to change your choices, is set out in the Cookie Policy.

7. Payment information

Echo uses Dodo Payments as its payment processor and merchant of record. Plans, credit packs and renewals are purchased on a hosted checkout page operated by Dodo. Card numbers and other full payment credentials are collected directly by Dodo and never pass through Echo servers.

Echo stores only what it needs to run the service: the product you bought, the amount, the currency, the credit quantity granted, the status of the purchase, and the payment, subscription and customer identifiers returned by Dodo. Tax is calculated and applied by the payment processor. If you connect a payment method, Dodo acts as the controller of that data under its own privacy policy.

8. Data storage, retention and deletion

Echo stores platform data in a hosted PostgreSQL database, project files and published artifacts in object storage (Amazon S3, Google Cloud Storage or Cloudflare R2 depending on the feature), and runs builds in isolated sandboxes that are torn down when the run completes or when its time-to-live expires.

How long we keep data

• While your account is active — we keep your account, workspaces and projects so the service works.
• Projects — you can delete a project at any time. Workspace owners can also enable automatic removal of dormant projects after a grace period they choose (for example 30, 90, 180 or 365 days).
• Account deletion — deleting your Echo account permanently removes the account and the records tied to it, including projects, workspaces, folders, runs, credentials, credit records, usage records and billing records held by Echo. The sign-in identity is removed with it, so signing up again with the same email address creates a new, empty account.
• Billing and security records — deleting your account removes the purchase records Echo holds. Where applicable law requires certain financial or tax records to be retained for a defined period, only those records are kept for that period.

If you need a copy of your data or want it removed and you cannot use the in-product controls, contact us using the details in section 14.

9. Third-party services

We rely on the following categories of third-party services:

• Authentication — Clerk, for sign-in, session management and account recovery.
• Payments — Dodo Payments, for checkout, subscriptions, customer portal, refunds and disputes.
• AI model providers — the providers listed in section 5, for inference.
• Hosting, analytics and monitoring — Vercel (web hosting, analytics and speed insights) and Sentry (error monitoring in production).
• Optional analytics providers — PostHog, Google Analytics 4 and Microsoft Clarity, which are only loaded when configured for the deployment and when consent allows.
• Transactional email — Resend, for workspace invitations and ownership transfers.
• Sandbox runtime — Daytona, for isolated hosted build sandboxes.
• Storage — Amazon S3, Google Cloud Storage and Cloudflare R2, for uploads, artifacts and published releases.
• Services you connect yourself — hosting and deployment providers (Vercel, Netlify, Railway, Cloudflare Pages and Workers, Supabase), source-control providers (GitHub, GitLab, Bitbucket, Gitea) and any database or API you bring. These providers receive the credentials and data you authorise and are governed by their own terms.

We share personal information only with the service providers listed above (acting on our instructions or as an independent controller for the data they receive), with professional advisers, and with authorities where required by law or necessary to protect rights, safety and service integrity. We do not sell your personal information.

10. Security practices

Echo applies the following measures to protect your data:

• Encryption in transit for all data sent to and from Echo.
• Encryption at rest for API keys, build secrets and provider credentials before they are written to the database.
• Scoping of permissions: connected accounts are authorised with the narrowest access the integration needs, and you can revoke a connection at any time.
• Signature verification on billing webhooks, so credits are only granted for events that genuinely came from our payment processor.
• Redaction in error monitoring: authorization, cookie, API key and webhook signature headers are stripped from reports, and fields whose names suggest prompts, code, secrets or credentials are redacted.
• Isolated sandboxes for build execution, so generated code runs in a disposable environment rather than on shared infrastructure.
• Transactional accounting for credits, so a duplicated or replayed billing event cannot grant credits twice.

No system is completely secure. Please use a strong, unique password, protect the API keys and database credentials you connect, and revoke provider access you no longer need.

11. Your rights and privacy requests

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, to withdraw consent for analytics, and to complain to a supervisory authority.

• Access, correction and export — available directly from your Echo account and workspace settings.
• Deletion — available from your account settings, or on request.
• Analytics consent — your choice is stored in your browser and applies to future collection. You can change the stored preference at any time, or ask us to record a preference on your account, and we will apply it.
• Everything else — email us and we will respond within the timeframe required by applicable law.

12. Children’s privacy

Echo is not directed at children under 13, or under the higher minimum age in your jurisdiction, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes to this policy

We update this policy when our practices change and revise the date at the top of the page. Where a change is material we will also notify you in the product or by email. Continuing to use Echo after a change takes effect means you accept the updated policy.

14. Contact information

For any privacy question, data request, or to reach the Echo team, use email as the official channel:

• Email — founder@echoagent.space
• X (Twitter) — https://x.com/EchoBuildNivo

You can also reach us through the Contact & Support page. Please do not include passwords, API keys or other secrets in an email.