Privacy Policy
Last updated: 14 July 2026
This Privacy Policy explains how Echobird ("we", "us", "the service") collects, uses, and protects your personal data when you use our language-shadowing app.
Echobird is operated by an individual based in Taiwan. For any privacy question or request, contact us at hello@echobird.app.
1. Data we collect
Account data. When you sign up, we store your email address. If you sign in with Google, we also receive your name and profile picture from Google, which we save as your display name and avatar. You can change your display name at any time.
Content you create. We store the workspaces, categories, sentences, and notes you add. The sentences you type are sent to a text-to-speech service to generate audio (see Section 3). To avoid regenerating the same audio, we cache it by a fingerprint of the text: identical sentences may be reused across accounts, so please do not enter private or sensitive information as practice sentences.
Usage data. We keep a record of how many sentences you create each month so we can apply your plan's limit.
Optional data. If you join the Pro waitlist, we store the reasons, languages, and feedback you provide.
Analytics data. We use a product-analytics service to understand how the app is used — for example, which pages are visited. See Section 3 and Section 4.
We do not collect payment information. Paid plans are not yet available.
2. How we use your data
We use your data to:
- provide and run the service (create your account, store your materials, generate audio);
- apply your plan's monthly sentence limit;
- keep the service secure and prevent abuse;
- understand and improve how the app is used;
- contact you about your account or requests you send us.
3. Third-party services
We rely on a small number of trusted providers to run the service. Your data is shared with them only as needed for the purposes above.
| Provider | Purpose | What it processes |
|---|---|---|
| Supabase | Authentication, database, file storage | Account data, your content, audio files |
| Google Cloud Text-to-Speech | Turns your sentences into audio | The sentence text you enter |
| Google (Sign in with Google) | Optional sign-in | Your Google email, name, and profile picture |
| PostHog | Product analytics | Page views and in-app events, linked to your account ID after you sign in |
| Cloudflare Turnstile | Bot protection at sign-in | A one-time verification token |
| Vercel | Hosting and content delivery | Standard request data (e.g. IP address) needed to serve the site |
Our analytics is configured to be privacy-conscious: we do not record your screen or session, and anonymous visitors are not built into personal profiles.
4. Cookies and similar technologies
- Essential cookies keep you signed in. The service cannot work without them, so they are always on.
- Analytics cookies (PostHog) help us understand usage. In the EU/EEA and the UK, these are only set after you consent. You can change your choice at any time.
5. Legal bases (EU/EEA and UK users)
Where the GDPR applies, we process your data on these bases:
- Contract — to provide the service you sign up for.
- Legitimate interests — to keep the service secure and to improve it, in a way that does not override your rights.
- Consent — for analytics cookies, and any optional data you choose to give us. You can withdraw consent at any time.
6. Data retention
We keep your data while your account is active. When you delete your account, your personal data — your profile, workspaces, categories, sentences, notes, usage records, and waitlist entry — is deleted immediately.
As an exception, we keep a one-way fingerprint (a hash) of your email address — not the email itself. We use this only to stop the same person from repeatedly deleting and re-creating an account to claim the new-user free allowance again, and it cannot be turned back into your email address.
Cached audio is stored without any link to your identity and may be kept and reused for other users, because it is not personal data once separated from your account.
7. Your rights
You can:
- access the data we hold about you;
- correct it (you can edit your profile and content directly in the app);
- delete your account and all its data — go to Settings → Profile → Delete account;
- export your data — download a copy from Settings → Profile;
- object to or restrict certain processing;
- withdraw consent for analytics at any time.
To exercise any right, email hello@echobird.app. If you are in the EU/EEA or the UK, you also have the right to complain to your local data protection authority.
8. International data transfers
Our providers may process your data outside your country, including in the United States. Where required, these transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.
9. Children
Echobird is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. If we make a significant change, we will update the date at the top and, where appropriate, notify you in the app.
11. Contact
For any question or request about this policy or your data, email hello@echobird.app.