Privacy Policy

Information we collect

• Account information. Your mobile phone number (required to sign in), display name, and (if you choose to add them) email addresses and profile photo.
• Phone number. Used as your primary sign-in identifier and to deliver SMS notifications you have consented to. Stored only after you verify the number with a one-time code.
• Content you create.Audio, video, and photo “echos” you record, group names you choose, comments and reactions you leave, and the recipient information you attach to greeting cards.
• Charm associations. The unique chip ID of any physical EchoTapcharm you scan and claim, plus the group it’s connected to.
• Usage information.Standard server logs (IP address, user agent, timestamps) and product telemetry (events such as “group created”, “echo posted”) used to operate and improve the Service.

How we use your information

• To provide and operate the Service.
• To deliver SMS notifications you have explicitly opted in to receive (see SMS notifications below).
• To authenticate you and protect your account.
• To respond to support requests and communicate with you about the Service.
• To detect, investigate, and prevent fraud, abuse, and security incidents.

SMS notifications

Sign-in codes. EchoTap signs you in with a one-time security code texted to your phone by our login provider (Clerk). This is standard authentication that you trigger by signing in. It is not a marketing or notification subscription, and it is handled separately from the optional alerts below.

New-greeting alerts (optional). Separately, you can choose to receive a text when someone adds a greeting to a card or group you belong to. These alerts are off until you turn them on at Account → Notifications. Turning them on is never required to create an account, make a purchase, or use any EchoTap feature. We do not send third-party offers or affiliate marketing via SMS. Turn them off anytime in Account → Notifications, or reply STOP to any message.

Phone numbers and SMS opt-in data are never sold, rented, or shared with third parties for marketing purposes, including affiliates. We share phone numbers only with our SMS delivery provider (Twilio) for the sole purpose of delivering the messages you have opted in to receive.

Reply STOP to any EchoTap SMS to opt out. Reply HELP for help. Message frequency varies; message and data rates may apply. Full SMS terms: EchoTap SMS notifications.

How we share information

We do not sell your personal information. We share it only with the service providers we rely on to operate EchoTap, and only to the extent each provider needs to do its job:

• Authentication: Clerk (for sign-in, magic links, and Google OAuth).
• Database: Neon (Postgres hosting).
• Media storage: Cloudflare R2 (audio, video, and photo files you upload).
• SMS delivery: Twilio (optional new-greeting alerts); Clerk (sign-in security codes).
• Hosting + analytics: Vercel (application hosting, web analytics).

We may also disclose information when required by law, to protect rights and safety, or in connection with a sale or transfer of the business — in the latter case any successor will be bound by the same commitments described here.

Content you share with others

The echos, photos, and group names you create are visible to the people you invite into a group, and to anyone who taps a charm connected to that group. Greeting cards are shareable via a public link the boss can choose to send. Treat anything you record as visible to the people you intentionally share it with.

Your choices

• Edit your display name, photo, and phone number from /account.
• Disable SMS notifications from /account → Notifications or by replying STOP to any EchoTap SMS.
• Leave a group from the group’s tile on your dashboard.
• Delete your account from /account. Account deletion removes your sign-in credentials, tombstones your account record, and disconnects you from every group you belong to.

Data retention

We retain account information and content for as long as your account is active. After deletion, sign-in credentials are removed immediately; tombstoned account records and operational logs are retained for up to 12 months for fraud prevention and audit purposes, then purged.

Children

EchoTapis not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, please contact us and we’ll delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date at the top of this page; significant changes will also be communicated in the app.

Contact

Questions about this policy or your data? Email privacy@echotap.io or write to us: