Privacy Policy

Introduction

Echo Thread ("we," "us," or "our") is an independent language learning application built in Wellington, New Zealand. We are committed to protecting your privacy. This policy explains what data we collect, our legal basis for processing it, how we use it, and your statutory rights regarding that data under international frameworks like the GDPR and CCPA.

1. Data Stored on Your Device (Local-First)

Echo Thread is designed with a local-first architecture. We do not maintain centralized servers storing your personal application data. The following data is stored exclusively on your device:

• Your captured vocabulary and custom rules.
• Generated story content and audiobook chapters.
• Spaced repetition scheduling data (FSRS-6 review history).
• App preferences and settings.

This data resides in a local SQLite database on your device. We do not have access to it. It is your responsibility to secure your device and utilize your operating system's backup mechanisms.

2. Third-Party AI Services & International Transfers

To generate personalized stories and audio, the app transmits limited data to third-party AI services. Because we are based in New Zealand and these providers are based in the United States, this involves the international transfer of data, which is governed by Standard Contractual Clauses (SCCs).

• Google Gemini API (Story Generation): Your vocabulary words, context, and selected narrative preferences are sent to Google's Gemini API to generate story content. We do not send any personally identifiable information (PII).
• Google Text-to-Speech API (Audio Synthesis): The generated story text is sent to Google's TTS service to produce audio.

We do not sell, share, or monetize any data sent to these services. The processing is strictly necessary to provide the core functionality of the app (Performance of a Contract).

3. Cookieless Analytics

We use PostHog to collect anonymized usage data on our marketing website and app. To respect your privacy, we have configured PostHog to run in Cookieless Mode(‘persistence: memory’).

This means we do not store cookies, local storage, or any other tracking technologies on your device to track you across different sessions or websites. We only collect anonymous, aggregate data regarding page views and button clicks during a single active session to understand general product performance.

Our legal basis for this processing is Legitimate Interest in improving our software, balanced by the strong privacy protections of cookieless architecture.

4. Email & Waitlist (Data Retention)

If you sign up for our waitlist or contact us, we collect your email address based on your explicit Consent. Emails are processed securely by Resend, a third-party delivery service.

Data Retention & Erasure: Waitlist email addresses are retained only until the product officially launches or you withdraw your consent, whichever comes first. You may request removal from our waitlist at any time by replying to our emails or contacting us directly, at which point your data will be permanently deleted.

5. Your Statutory Rights (GDPR & CCPA)

Depending on your location, you may have specific rights regarding your personal data:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct inaccurate data.
• Right to Erasure ("Right to be Forgotten"): You can request that we delete your data.
• Right to Restrict Processing: You can ask us to limit how we use your data.
• Right to Data Portability: You can request your data in a structured, machine-readable format.

How to Exercise These Rights:Because Echo Thread is a local-first application, you exercise the vast majority of these rights directly on your own device. You can access, edit, export, and permanently erase all your vocabulary and story data simply by using the app's interface or uninstalling the application. For data we do hold centrally (such as your waitlist email), please contact us directly to exercise these rights.

6. Governing Law & Updates

This Privacy Policy and our data practices are governed by the laws of New Zealand, without regard to its conflict of law provisions.

We may update this policy periodically. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

7. Contact Us

If you have any questions about this privacy policy, wish to exercise your statutory rights, or want to be removed from the waitlist, please contact our Data Protection Officer at: hello@echo-thread.com