Privacy Policy
Echo Loop is provided and operated by Hangzhou Fengchen Hangqi Management Consulting Co., Ltd. ("Echo Loop", "we", "us", or "our"). We act as the controller of personal information described in this Privacy Policy where applicable law uses that term. This Policy explains how we process personal information when you use our mobile applications, website, and related services (collectively, the "Services").
This Privacy Policy describes our information practices. Where applicable law requires your consent for a specific processing activity, we will request it before carrying out that activity.
1. Information We Collect
We collect information directly from you, automatically from your use of the Services and devices, and from sign-in, payment, and other providers when you choose to use them.
1.1 Account Information
When you create or use an account, we may collect:
- Email address (required for account creation)
- Name and profile information (if supplied by you or your sign-in provider)
- Account nickname (may be displayed with an approved public collection)
- Profile picture (if supplied)
- Account and authentication identifiers (including information returned when you use a third-party sign-in provider)
1.2 Learning Data
To provide the Services, we may collect:
- Learning progress (lessons completed, practice time, proficiency level)
- Bookmarked sentences and vocabulary (your saved learning content)
- Spaced repetition data (review schedules and performance)
- Audio playback preferences (speed, loop settings)
1.3 Media and User Collection Content
- Uploaded audio and video files (for transcription, learning, and media collections)
- Collection information (names, descriptions, cover images, and the media titles and descriptions you provide)
- Transcription data (AI-generated subtitles and timestamps)
- Custom annotations (highlights and notes you create)
If you request transcription, the relevant audio is sent to the speech-to-text provider used for that feature to produce a transcript and timestamps. We do not use uploaded audio to train our own AI models. The provider and its handling of submitted data may depend on the feature and region; see Section 4.1.
If you use AI-assisted translation, analysis, review, or lookup features, the text you enter or select and the learning context needed for the result may be sent to the AI Gateway and the model provider used for that request. If you connect an optional Baidu Netdisk account, we process the OAuth authorization code, access and refresh tokens, and permissions (scopes) granted by you. The token is encrypted while held in a temporary server-side session and is deleted after the app confirms local storage or the session expires; the app may then store it in device secure storage.
1.4 Device and Usage Information
We automatically collect:
- Device information (device type, operating system, app version)
- Log data (access times, screens viewed, crash reports)
- IP address (for security and analytics purposes)
- Cookie and similar technology data (on the website, where used for site operation, security, or analytics)
We use Google Analytics 4 where enabled and Vercel Analytics and Speed Insights on the non-China website. These tools may use cookies, identifiers, or similar technologies and receive online activity and device information. Where applicable law requires prior consent for non-essential analytics, we must obtain it before loading those technologies. You can manage cookies through your browser settings, although blocking cookies may not disable all analytics technologies. Contact support@echo-loop.top for questions or requests about analytics data.
1.5 Payment Information
If you subscribe to premium services:
- Payment processing is handled by the provider identified at checkout or in your app store account
- We may receive transaction and subscription identifiers, purchase status, plan, amount, currency, and billing-period information needed to provide the subscription and support payment inquiries
- Your full card or payment credentials are handled by the payment provider; we do not intentionally store full card numbers
2. How We Use Your Information
We use the collected information to:
- Provide Services: Deliver personalized learning experiences, sync progress across devices, and manage your account
- Improve Services: Analyze usage patterns, fix bugs, and develop new features
- AI Transcription: Process uploaded audio through AI providers to generate word-level timestamps
- AI-assisted learning: Process text and relevant learning context you submit for translation, analysis, review, and lookup results
- Media conversion: Convert audio files to formats you request
- Optional account linking: Complete or refresh Baidu Netdisk authorization when you choose to connect that account
- Public Collections: Review submitted collections, publish approved versions, and operate the public collection catalog
- Communication: Send service updates, respond to inquiries, and provide customer support
- Security: Protect against fraud, unauthorized access, and other illegal activities
- Legal compliance: Respond to lawful requests, resolve disputes, and meet legal, accounting, and regulatory obligations
3. Sales and Analytics Disclosures
We do not exchange personal information for money. We disclose online identifiers and usage information to analytics providers to measure and improve the Services. Depending on the provider configuration and applicable law, an analytics disclosure may qualify as a "sale" or "sharing" even when no money is exchanged. We do not intend to use this information to build advertising profiles for third parties. Where a law gives you a right to opt out of a disclosure, you may contact us as described in Section 8; we will provide and honor the choices and preference signals required by law.
4. Information Sharing
We share information in the circumstances below and only to the extent reasonably needed for the stated purpose or permitted by law:
4.1 Service Providers
Depending on the feature, provider configuration, and your region, service providers may include:
- Account, database, hosting, storage, and delivery: Supabase, Vercel, and Cloudflare; Tencent Cloud COS/CDN may deliver public media in China where configured
- Speech-to-text: Deepgram, AssemblyAI, or Volcano Engine (Volcengine)
- AI-assisted learning: Vercel AI Gateway and, depending on model configuration, upstream model providers such as DeepSeek, Alibaba, Fireworks, OpenAI, or Azure
- Audio conversion: CloudConvert, when you request an audio format conversion
- Analytics and performance: Google Analytics 4 and, on the non-China website, Vercel Analytics and Speed Insights
- Payments and subscription entitlements: Stripe, Paddle, Apple, Google, or RevenueCat, depending on the purchase channel and feature
- Optional sign-in and account linking: Google or Apple sign-in, and Baidu Netdisk OAuth when enabled and selected by you
- Error monitoring: Sentry, where enabled, for error and diagnostic information
These providers may process account identifiers, device and usage information, submitted text, media or transcripts, OAuth credentials, or transaction information as needed for their services. Their role and terms may differ: providers acting for us process information under our instructions and applicable agreements, while payment, sign-in, and other providers may also process information under their own privacy notices and legal obligations. The providers used for AI, conversion, analytics, and account linking depend on feature availability, configuration, and your region.
4.2 Public User Content
When you submit a collection for public review, the submitted collection information, cover, media files, and associated subtitles or transcripts are available to reviewers. If approved, the published version and your account nickname are made publicly available through Echo Loop websites, public catalogs, APIs, and media delivery. Public content may be viewed, copied, downloaded, or cached by others and may be accessible worldwide. Do not include another person's personal information, image, or voice unless you have the permission or consent required by law. Where the law requires separate consent before public disclosure, choosing a public setting or submitting a collection is not a substitute for that separate consent; we must obtain it before publication. Making a collection private or deleting it removes it from the public catalog, but cannot retrieve copies others have already downloaded or independently retained; temporary caches may also take time to clear.
4.3 Legal Requirements
We may disclose information if required by law, legal process, or government request, or to protect the rights, property, and safety of Echo Loop, our users, or others.
4.4 Business Transfers
If we undergo a merger, reorganization, financing, or sale or transfer of relevant assets, information may be transferred as part of that transaction, subject to applicable law and appropriate safeguards. We will provide notice where required.
5. Data Security
We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal information security incident occurs, we will take remedial measures and notify affected individuals and relevant authorities where required by law. You are responsible for keeping your account credentials confidential and notifying us if you suspect unauthorized access.
6. Data Retention
We determine retention periods by the processing purpose, type of information, account status, applicable recordkeeping obligations, and security or dispute-resolution needs. We retain personal information only for the shortest period necessary for the purposes described in this Policy.
- Account and learning data: Kept while needed to provide your account, synchronization, and learning history. After we verify and act on a deletion request, we delete or anonymize the relevant records, subject to lawful retention requirements.
- Uploaded media and collections: Kept while needed for the relevant feature. After deletion or a change to private status, we remove the relevant public listing and handle media copies still under our control in accordance with the applicable request.
- Transaction records: Kept for the periods required by applicable tax, accounting, and other laws.
- Security logs, moderation, and complaint records: Kept only while needed to prevent abuse, handle incidents or disputes, or meet legal obligations.
- Analytics data: Kept according to the tool configuration and for as long as needed for the analytics purpose.
Database records, media in external storage, provider systems, backups, and CDN caches may be cleared at different times. Deletion requests cover relevant personal information still controlled by us or providers acting on our behalf; backups that cannot immediately be cleared are deleted through the applicable cleanup cycle. Where continued retention is legally required or immediate deletion is technically difficult, we restrict processing to legally permitted storage and necessary security measures. We cannot retrieve public content downloaded or independently retained by others. Contact support@echo-loop.top for retention information relevant to your account or request. For historical uploads or transcription results that cannot automatically be associated with your account, include a content link or file details so we can verify and act on your deletion request.
7. Your Rights
Depending on where you live and subject to applicable legal exceptions, you may request access to, correction or deletion of your personal information, object to or restrict certain processing, withdraw consent, or receive a portable copy of information. If we send you marketing communications, you may opt out using the instructions in the message. To exercise a right, contact support@echo-loop.top or use the in-app settings. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal. An optional feature may become unavailable if you withdraw consent for information needed to provide it. We may verify your identity in a manner proportionate to your request and will respond within the time required by applicable law. If we decline a request, we will explain why and describe any applicable appeal or complaint channel.
8. CCPA Rights (California Residents)
If you are a California resident, the California Consumer Privacy Act, as amended (CCPA), may give you the following rights, subject to applicable exceptions:
- Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you
- Right to Delete: You may request that we delete the personal information we have collected from you
- Right to Correct: Request correction of inaccurate personal information
- Right to Opt-Out: Opt out of sale or sharing of personal information for cross-context behavioral advertising, where applicable
- Sensitive Information: Request limits on certain uses or disclosures of sensitive personal information, where applicable
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
- Right to Designate an Agent: You may designate an authorized agent to make requests on your behalf
- Right to Data Portability: You may request your data in a readily usable format
Depending on deployment and provider configuration, in the past 12 months we may have disclosed identifiers and online activity information to analytics providers, and account, media, transcription, and transaction information to the service-provider categories described in Section 4.1, for the business purposes described in this Policy. We do not exchange personal information for money. An analytics disclosure may nevertheless qualify as a sale or sharing under the CCPA depending on the configuration and circumstances. You may opt out of sale or sharing, where applicable, by contacting support@echo-loop.top; we will also honor user-enabled opt-out preference signals where required by law. We will not discriminate against you for exercising a right.
9. GDPR Rights (EU/EEA Users)
If you are located in the European Union or European Economic Area, you may have the following rights under the General Data Protection Regulation (GDPR), subject to legal conditions and exceptions:
- Right of Access: Request access to and a copy of your personal data
- Right to Rectification: Request correction of inaccurate or incomplete data
- Right to Erasure: Request deletion of your personal data ("right to be forgotten")
- Right to Restriction: Request that we restrict the processing of your data
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests or direct marketing
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
- Right to Lodge a Complaint: Complain to a data protection authority in your place of residence, work, or the place of an alleged infringement
For users covered by the GDPR, our legal basis depends on the processing purpose: we process account, learning, and requested transcription information as necessary to provide the Services you request; process public collection information to provide the public feature you choose, and rely on consent where a separate consent is required; use information for service security, fraud prevention, and reliability where our legitimate interests are not overridden by your rights and interests; process non-essential analytics or optional features with consent where required; and retain or disclose information where necessary to meet legal obligations. You may withdraw consent at any time where processing is based on consent. You are generally not required by law to provide optional information, but some information is needed to create an account or use particular features. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.
10. Children's Privacy
In mainland China, personal information of children under 14 is sensitive personal information. We process it only after obtaining the legally required consent of a parent or other guardian and complying with dedicated child-information protection rules. Features involving such processing must not be used before those conditions are met.
Echo Loop is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact support@echo-loop.top. We will take appropriate steps to review the request and delete information where required by law. For minors, parental or guardian involvement or consent may be required depending on local law. Where applicable law requires verifiable parental consent, we will obtain it before processing the child's personal information.
11. International Data Transfers
Our providers may store or process information in countries other than your country of residence, including countries where we or they operate. Where applicable law requires a transfer mechanism or additional safeguards, we will use the required measures. You may contact support@echo-loop.top for information about the recipient or recipient categories, transfer mechanism, safeguards, and how to obtain a copy of relevant safeguards where the law requires us to provide it.
For users in mainland China, we process personal information on the grounds permitted by the Personal Information Protection Law, including necessity to perform a contract with you, legal obligations, or consent as applicable. For sensitive personal information, public disclosure, or transfers abroad, we provide the additional notices and obtain separate consent where required. Before a transfer abroad, the required notice includes the overseas recipient's identity and contact details, processing purposes and methods, information types, and ways to exercise your rights. We implement the applicable transfer mechanism and safeguards before the transfer. You may request access, a copy, correction, supplementation, deletion, restriction or refusal of processing, withdrawal of consent, or an explanation of our processing rules by contacting support@echo-loop.top.
12. Third-Party Links
Our Services may contain links to third-party websites or services that we do not control. Their privacy practices are governed by their own notices. This does not limit any responsibility we have under applicable law. Review their privacy policies before providing information to them.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by:
- Posting a notice within the app
- Sending an email to registered users
We will also update the date at the top of this Policy. Updating the date alone does not constitute notice of a significant change. Where advance notice is required, we will give reasonable notice before the change takes effect.
The updated Policy will apply from its stated effective date. Where a change requires consent under applicable law, we will obtain it. We will not apply a material change retroactively to processing that has already taken place.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us:
Email: support@echo-loop.top
If you are making a privacy rights request, please identify your account and the right you wish to exercise. We may ask for information needed to verify your identity.
Thank you for trusting Echo Loop with your language learning journey. We are committed to protecting your privacy and providing a secure learning environment.