Privacy
Echo keeps what it needs to schedule your practice, and nothing beyond that. There is no advertising, no analytics profile, and nothing is sold or shared for marketing.
What is stored
- Your account
- The email address you sign up with, and a display name if your sign-in provider supplies one. Passwords are handled by Supabase Auth and stored only as a hash — they never reach Echo’s own code.
- What you author
- Your decks and cards: names, prompts, and the settings for each card type. If you attach a Guitar Pro file to a card, that file is stored too.
- Your review history
- Every answer appends one immutable event: which card, when you answered, how you rated it, how long it took, whether it was a scheduled review or free practice, and the card-type detail used for grading (for example, which fret you picked). This log is what the schedule is derived from — it is the product, not a byproduct.
- Session cookies
- Cookies set by Supabase to keep you signed in. They are required for the app to work; there are no advertising or cross-site tracking cookies.
- Usage and performance measurements
- The website reports anonymous page views to Vercel Analytics and page-load timings to Vercel Speed Insights, so it is possible to see which pages people use and whether they are fast. Both set no cookies, build no profile, and do not identify you — the counts they produce are aggregates, cannot be tied back to your account, and do not follow you to any other website. Neither runs in the desktop or phone apps.
What is not stored
Echo has no advertising, no third-party trackers, and no data brokers. Your cards and review history are never sold, rented, or shared with anyone for their own purposes. Nobody is emailed marketing on the strength of what you practise.
Where it lives
Two providers process data on Echo’s behalf, and only to run the service: Supabase hosts the database, authentication, and file storage; Vercel hosts the website and its usage and performance measurements. Every row in the database is scoped to its owner by row-level security, so one account cannot read another’s decks, cards, or reviews.
The exception is a deck Echo has published to the Marketplace: those are readable by anyone, including visitors with no account, which is what lets a link to one show the deck instead of a sign-up form. Only Echo can publish a deck — the decks and cards you write are never made public, and your review history is never readable by anyone but you, whether the deck it belongs to is published or not.
The desktop app keeps its own copy of your decks and answers on your machine so it works offline, and syncs with the same account when it can reach the network. Uninstalling it removes that local copy; it does not delete anything from your account.
How long it is kept
Decks, cards, and review history are kept for as long as your account exists — the schedule is computed by replaying the whole log, so old events stay meaningful. Deleting a deck deletes its cards and their review history with it. The desktop app folds review events older than 90 days into daily summaries locally to stay small; the full history remains on the server.
Your choices
You can edit or delete any deck or card from the app at any time, and delete your account outright from Settings — that removes your decks, cards, review history, and uploaded files immediately, and cannot be undone. To request a copy of everything held about you, or for anything else, email hello@echoreprise.comfrom your account’s address and it will be handled within 30 days. Depending on where you live, you may also have the right to correct your data, object to its processing, or complain to a data protection authority.
Children
Echo is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has signed up, write to hello@echoreprise.com and the account will be removed.
Changes
If this policy changes, the date at the top changes with it. Anything that materially affects what is collected or who it is shared with will be announced in the app before it takes effect.
The third-party code and audio Echo ships with is listed under Credits.