Privacy Policy

Effective Date: January 3, 2026
Version: 2026-01-03
Last Updated: January 3, 2026

Recent Changes:

• Added backup retention policies (30 days operational, 7 years audit logs) (Section 6.3)
• Clarified data retention in backups after account deletion (Sections 3.7, 6.3, 14.8)
• Added disclosure of Sentry error tracking service (Section 9.1)
• Expanded Third-Party Services section with infrastructure providers

---

Introduction

Welcome to EchoesOf ("we," "us," or "our"). We are committed to protecting your privacy and the privacy of your family. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

By using EchoesOf, you acknowledge that you have read and understood this Privacy Policy.

---

1. Information We Collect

1.1 Information You Provide

We collect information that you voluntarily provide to us:

• Account Information: Name, email address, password, date of birth
• Profile Information: Display name, profile photo, relationship to family members
• Family Information: Family name, member relationships, roles
• Recordings: Audio, video, photos, documents, and text recordings you upload
• Messages: Communications with us or other family members through the platform
• Payment Information: Processed securely through third-party payment processors (we do not store full credit card numbers)

1.2 Information Collected Automatically

When you use our platform, we automatically collect:

• Usage Data: Pages viewed, features used, actions taken, time spent on pages
• Device Information: IP address, browser type, device type, operating system
• Log Data: Access times, errors, performance metrics
• Cookies: See our Cookie Policy section below

1.3 Information from Third Parties

We may receive information from:

• Authentication Providers: If you sign in using third-party services
• Payment Processors: Transaction confirmation and payment status

---

2. How We Use Your Information

We use your information to:

2.1 Provide and Improve Services

• Create and manage your account
• Process and deliver your recordings
• Store and organize family content
• Provide customer support
• Improve platform functionality and user experience

2.2 Communications

• Send service updates and notifications
• Respond to your inquiries
• Send important security or policy updates
• Marketing communications (with your consent)

2.3 Security and Compliance

• Detect and prevent fraud
• Enforce our Terms of Service
• Comply with legal obligations
• Protect the rights and safety of our users

2.4 Analytics

• Understand how users interact with our platform
• Identify trends and usage patterns
• Optimize performance and features

---

3. COPPA Compliance

Children's Online Privacy Protection Act (COPPA)

3.1 Age Requirements

EchoesOf is designed for adults aged 18 and over. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

• To create an account: You must be 18 years or older
• Age verification: All new users must verify they are 18+ during registration
• Child accounts: Only family account owners may create accounts for children under 13

3.2 Child Account Creation (Under 13)

Owner-Only Restriction:

To ensure COPPA compliance, only the family account owner can create accounts for children under 13 years old. The family account owner is the designated legal parent or guardian for all children in the family.

Why Owner-Only?

• Ensures consent comes from the actual legal parent/guardian
• Clear audit trail of who gave consent
• Prevents unauthorized account creation by non-parents
• Simplifies COPPA compliance verification

Creating a Child Account:

When the family owner creates an account for a child under 13:

1. The owner must certify they are the child's biological parent, adoptive parent, or legal guardian
2. The owner explicitly consents to the collection and use of the child's information
3. We record the owner's consent with timestamp, IP address, and verification details
4. The owner retains full control over the child's account

Family Members Who Are Not Owners:

Family administrators and other members cannot create accounts for children under 13. If you need to create a child account and are not the family owner, please:

• Contact the family owner to create the account
• Contact our support team at privacy@echoesof.life for assistance

3.3 Verifiable Parental Consent

Consent Method: Authenticated Owner Certification

When creating a child account, the family owner provides verifiable consent by:

• Being authenticated as an 18+ adult (verified at registration)
• Being identified as the family account owner (documented in our system)
• Explicitly certifying they are the legal parent/guardian
• Checking a consent acknowledgment that clearly states what information will be collected
• Acknowledging our Privacy Policy and Terms of Service

What We Record:

• Date and time of consent
• IP address and user agent of the consenting owner
• Owner's user ID (verified as family owner)
• Child's age at time of consent
• Privacy Policy and Terms version acknowledged
• Certification statement accepted by owner

3.4 Parental Rights

Parents (family owners) have the right to:

• Access: View all information we have collected about their child
• Export: Receive a copy of their child's data in JSON or CSV format
• Modify: Update or correct their child's profile information
• Delete: Request deletion of their child's account and information
• Revoke Consent: Delete the child's account at any time, which removes consent

How to Exercise Your Rights:

• Through the Platform: Manage your child's account in family settings
• Via Email: Contact us at privacy@echoesof.life
• For Deletion Requests: Use the account deletion feature or contact support

Response Time: We will respond to parental requests within 10 business days.

3.5 What Information We Collect from Children Under 13

With parental consent, we collect and use:

Personal Information:

• Child's first name and last name
• Date of birth (to verify age)
• Relationship to family members

Content Created:

• Recordings (audio, video) created or uploaded
• Photos and documents shared
• Text recordings and memories

Usage Information:

• Pages viewed and features used (to improve the service)
• Device information (for security and performance)

What We Do NOT Collect:

• Email addresses for children under 13 (parents manage accounts)
• Phone numbers
• Physical addresses
• Payment information
• Geolocation data
• Social media profiles

3.6 How We Use Children's Information

We use children's information only to:

• Provide the family memory preservation service requested by the parent
• Display and organize the child's content within the family vault
• Allow authorized family members to view shared memories
• Maintain account security
• Comply with legal obligations

We do NOT:

• Use children's information for marketing
• Share children's information with third parties for their marketing
• Create public profiles for children
• Collect more information than necessary to provide the service

3.7 Retention of Children's Information

• Active Accounts: Retained as long as the family account is active
• Deleted Accounts: Soft-deleted and retained for 3 years for legal compliance
• Permanent Deletion: After 3 years, or immediately upon parental request
• Audit Logs: Consent records retained for 7 years for COPPA compliance
• Backups: Data may remain in backup systems for up to 30 days after account deletion as part of our disaster recovery procedures

Note: Parents can request immediate permanent deletion by contacting privacy@echoesof.life. While we will remove data from active systems immediately, some backup copies may persist for up to 30 days until they naturally age out of our backup rotation.

3.8 Third-Party Access to Children's Information

We do not share children's information with third parties except:

• Within the Family: Shared with family members designated by the parent
• Service Providers: AWS for secure storage (under strict data protection agreements)
• Legal Requirements: When required by law or to protect the child's safety

All third-party service providers are required to maintain the confidentiality and security of children's information.

To exercise these rights, contact us at: privacy@echoesof.life

---

4. How We Share Your Information

We do not sell your personal information. We may share information:

4.1 Within Your Family

• Recordings and content you upload are shared with family members you've designated
• Family members can view content based on permissions you set

4.2 Service Providers

We work with trusted third-party service providers:

• Cloud Storage: Amazon Web Services (AWS) for secure data storage
• Content Delivery: CloudFront for video/media delivery
• Email Services: For account notifications and communications
• Payment Processing: Secure payment processors for subscriptions

4.3 Legal Requirements

We may disclose information when required by law:

• To comply with legal obligations or court orders
• To protect our rights, property, or safety
• To investigate fraud or security issues
• In connection with a business transfer or acquisition

4.4 With Your Consent

We may share information for other purposes with your explicit consent.

---

5. Data Security

We implement industry-standard security measures:

5.1 Technical Safeguards

• Encryption: Data encrypted in transit (TLS/SSL) and at rest
• Access Controls: Role-based access with authentication requirements
• Infrastructure Security: Secure cloud hosting with AWS
• Regular Audits: Periodic security assessments and vulnerability testing

5.2 Organizational Safeguards

• Employee Training: Staff trained on privacy and security best practices
• Access Limitations: Only authorized personnel can access personal data
• Incident Response: Procedures for handling security breaches

Note: While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

---

6. Data Retention

6.1 Active Accounts

We retain your information as long as your account is active or as needed to provide services.

6.2 Deleted Accounts

When you delete your account:

• Your information is soft-deleted (marked for deletion)
• Data is retained for 3 years for legal and compliance purposes
• After 3 years, data is permanently deleted
• Audit logs are retained indefinitely for compliance

6.3 Backup Retention

To ensure data recovery and business continuity, we maintain automated backups:

• Operational Backups: Database backups retained for 30 days for disaster recovery
• Audit Logs: Retained for 7 years to meet COPPA compliance requirements
• Media Files: Original uploads and processed videos backed up with versioning enabled
• Backup Purpose: Backups are used solely for system recovery, security, and legal compliance

Important: When you delete your account, your data is removed from active systems immediately (soft-deleted). However, backups may retain your data for up to 30 days during the normal backup retention cycle. After this period, your data is automatically purged from all backup systems as they age out.

For Immediate Deletion: If you require immediate removal from backups (e.g., for legal reasons), contact privacy@echoesof.life. We can expedite the removal process, though some backup copies may persist until the next backup cycle completes.

6.4 Legal Holds

We may retain information longer when required by law or legal obligations.

---

7. Your Rights and Choices

7.1 Access and Portability

• View Your Data: Access your personal information through your account settings
• Export Your Data: Request a copy of your data in JSON or CSV format

7.2 Correction and Deletion

• Update Information: Modify your profile and account information
• Delete Account: Request deletion of your account and associated data

7.3 Marketing Communications

• Opt-Out: Unsubscribe from marketing emails at any time
• Essential Communications: We must send service-related notifications

7.4 Do Not Track

We do not currently respond to Do Not Track (DNT) browser signals.

7.5 California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act. See our CCPA-specific disclosures below.

---

8. Cookies and Tracking

8.1 What Are Cookies?

Cookies are small text files stored on your device that help us provide and improve our services.

8.2 Types of Cookies We Use

• Essential Cookies: Required for authentication and basic functionality
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use our platform
• Security Cookies: Detect and prevent fraud

8.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling cookies may limit platform functionality.

---

9. Third-Party Services

Our platform uses third-party services to provide and improve functionality:

9.1 Error Tracking and Monitoring

We use Sentry (Functional Software, Inc.) for error tracking and performance monitoring to identify and fix bugs that may affect your experience.

What Sentry Collects:

• Error messages and stack traces when technical issues occur
• Browser and device information (type, version, operating system)
• User ID (not your email or name) to help us identify affected users
• Pages visited and actions taken leading to errors (to help reproduce issues)

What Sentry Does NOT Collect:

• Passwords or authentication credentials
• Full content of your recordings
• Email addresses or personal messages
• Sensitive form data (automatically filtered)

Why We Use Sentry:

• Quickly identify and fix bugs affecting users
• Monitor platform performance and reliability
• Improve user experience by catching errors before they're reported

Data Privacy:

• We configure Sentry to scrub sensitive information before transmission
• Sentry data is encrypted in transit and at rest
• We use Sentry's free tier with standard data retention policies
• For more information, see Sentry's Privacy Policy

9.2 Cloud Infrastructure

We use Amazon Web Services (AWS) for hosting, storage, and content delivery:

• Storage: Your recordings are stored in AWS S3 with encryption
• Hosting: Our application runs on AWS infrastructure in the US (us-west-2)
• CDN: AWS CloudFront delivers your content securely and quickly
• For more information, see AWS Privacy Notice

9.3 External Links

Our platform may contain links to third-party websites or services not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

---

10. International Users

EchoesOf is based in the United States. If you access our platform from outside the U.S., your information will be transferred to and processed in the United States, which may have different data protection laws.

---

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last Updated" date
• We will notify you via email or platform notification
• You will be required to acknowledge the updated policy upon login
• Continued use of the platform constitutes acceptance of changes

---

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices:

Email: privacy@echoesof.life
Mail: EchoesOf Privacy Team, [Address TBD]
Phone: [Phone TBD]

Data Protection Officer

For GDPR-related inquiries: dpo@echoesof.life

---

13. State-Specific Privacy Rights

13.1 California Residents (CCPA/CPRA)

California residents have the following rights:

• Right to Know: What personal information we collect and how we use it
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of sale of personal information (we do not sell data)
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise these rights, contact us at: privacy@echoesof.life

13.2 Nevada Residents

Nevada residents have the right to opt out of the sale of covered personal information. We do not sell personal information.

13.3 Virginia, Colorado, Connecticut, Utah Residents

Residents of these states have rights similar to CCPA regarding access, deletion, and data portability. Contact us to exercise these rights.

---

14. Children's Privacy (Additional COPPA Details)

14.1 Who Can Create Child Accounts

Family Owner Only:

Only the family account owner can create accounts for children under 13 years old. This ensures that consent comes from the actual legal parent or guardian.

Why This Restriction Exists:

• COPPA requires verifiable parental consent from the child's actual parent or legal guardian
• The family owner is documented as the legal parent/guardian for all children in the family
• This prevents non-parents (family members, friends) from creating child accounts
• Provides clear audit trail for compliance verification

If You Are Not the Owner:

If you need to create a child account but are not the family owner:

1. Ask the family owner to create the account
2. Contact our support team at privacy@echoesof.life for assistance
3. For emergency situations, we can manually verify guardianship documentation

14.2 Information Collected from Children

With the family owner's consent, we collect:

Required Information:

• Child's first and last name
• Date of birth (to verify age and ensure proper protections)
• Relationship to family members

Content and Usage:

• Recordings created or uploaded by or about the child
• Photos and documents shared in family vault
• Text memories and stories
• Usage patterns (which features are used, for service improvement)

Technical Information:

• Device type and operating system (for compatibility)
• IP address (for security and fraud prevention)
• Browser information (for technical support)

What We Never Collect from Children:

• Email addresses (accounts managed by parents)
• Phone numbers
• Physical street addresses
• Geolocation/GPS data
• Social security numbers
• Payment information
• Social media profiles
• Biometric data

14.3 How We Use Children's Information

Permitted Uses:

• Provide the family memory preservation service requested by the parent
• Store and display the child's recordings and content
• Enable family members to view shared content (with parent's permission)
• Maintain account security and prevent unauthorized access
• Comply with legal obligations and respond to legal requests
• Improve service quality and fix technical issues

Prohibited Uses:

• Marketing or advertising directed to children
• Creating public profiles or making information publicly searchable
• Sharing with third parties for their own marketing
• Behavioral advertising or tracking across other websites
• Selling or renting children's information
• Any use not disclosed in this Privacy Policy

14.4 Parental Access and Control

What Parents Can Do:

The family owner (parent/guardian) has full control over their child's account:

1. View All Information:

   • Access all data collected about their child
   • Review all recordings and content
   • See usage history and activity logs

2. Modify Information:

   • Update profile information
   • Correct inaccurate data
   • Change privacy settings

3. Export Data:

   • Download all child's information in JSON or CSV format
   • Includes all recordings, content, and metadata

4. Delete Account:

   • Immediately remove child's account
   • All information is soft-deleted (3-year retention for legal compliance)
   • Can request immediate permanent deletion if needed

5. Manage Sharing:

   • Control which family members can view child's content
   • Set permissions for different content types
   • Restrict access as needed

How to Exercise Parental Rights:

• Through Your Account: Family settings → Child accounts
• Email: privacy@echoesof.life
• Phone: [To be added]
• Response Time: Within 10 business days

14.5 Parental Consent Process

How We Obtain Consent:

1. Account Owner Verification:

   • Owner creates family account (must be 18+)
   • Owner's identity verified at registration
   • Owner documented as the legal parent/guardian

2. Child Account Creation:

   • Owner initiates child account creation
   • System verifies user is the family owner
   • Non-owners are prevented from creating child accounts

3. Explicit Consent:

   • Owner shown clear consent notification
   • Must certify they are the biological parent, adoptive parent, or legal guardian
   • Must acknowledge what information will be collected
   • Must accept Privacy Policy and Terms of Service

4. Consent Documentation:

   • We record date, time, and IP address of consent
   • We store owner's certification statement
   • We link consent to both parent and child accounts
   • Audit trail maintained for compliance verification

Consent Method Compliance:

Our consent method meets COPPA requirements because:

• Owner is authenticated as 18+ adult
• Owner is verified as family account owner (presumed legal guardian)
• Owner explicitly certifies legal relationship to child
• Owner's identity can be verified through account information
• Complete audit trail is maintained

14.6 Sharing Children's Information

Within the Family:

• Parent controls which family members can see child's content
• Default setting: Only family owner can view
• Parent can grant access to other trusted family members
• All access is logged for security

Service Providers:

• AWS (cloud storage) - under strict data protection agreements
• CloudFront (content delivery) - for video/media streaming
• All providers are COPPA-compliant and contractually bound to protect data

We Do NOT Share With:

• Advertisers or marketing companies
• Data brokers
• Social media platforms
• Any third party for their own use

Legal Requirements:

• We may disclose if required by law enforcement or court order
• We will notify parents unless legally prohibited
• We will only provide the minimum information legally required

14.7 Data Security for Children

Enhanced Protections:

• Children's accounts have additional security measures
• Access logs monitored more frequently
• Parent notification for any unusual activity
• Automatic logout after inactivity
• No public profile or searchability

Technical Safeguards:

• Encryption in transit (TLS/SSL)
• Encryption at rest (AES-256)
• Multi-factor authentication for family owners
• Regular security audits
• Incident response procedures

14.8 Data Retention for Children

While Account Is Active:

• Information retained as long as family account is active
• Parent can delete at any time

After Account Deletion:

• Soft-deleted (not accessible but retained)
• Retained for 3 years for legal compliance
• Parent can request immediate permanent deletion
• After 3 years, automatically permanently deleted

Backup Retention:

• Automated backups retained for 30 days for disaster recovery
• Audit logs (consent records) retained for 7 years for COPPA compliance
• Backup data automatically purges as backups age out
• Parent can request expedited removal from backups by contacting privacy@echoesof.life

What This Means: When you delete your child's account, their data is immediately removed from active systems. However, backup copies used for disaster recovery may contain their data for up to 30 days until those backups naturally expire. After 30 days, all backup copies containing their data will be automatically purged.

Consent Records:

• Parental consent records retained indefinitely
• Required for COPPA compliance documentation
• Kept separate from child's content
• Used only for compliance verification

14.9 International Data Transfers

Children's Data and International Users:

If you access EchoesOf from outside the United States:

• Children's data will be transferred to and stored in the U.S.
• U.S. may have different data protection laws
• We apply the same COPPA protections regardless of location
• Parents maintain all rights described in this policy

14.10 Questions or Concerns About Children's Privacy

Contact Us:

For any questions about how we protect children's privacy:

• Email: privacy@echoesof.life (mark subject: "COPPA Inquiry")
• Response Time: Within 10 business days
• FTC Complaints: You may also contact the Federal Trade Commission

---

15. Data Breach Notification

In the event of a data breach that affects your personal information:

• We will notify you within 72 hours of becoming aware
• Notification will include the nature of the breach and steps to protect yourself
• We will notify relevant authorities as required by law

---

16. Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or significantly affects you.

---

17. Your Data Protection Rights (GDPR)

If you are in the European Economic Area (EEA), you have the following rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Request limitation on how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing of your data
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at: privacy@echoesof.life

---

This Privacy Policy is effective as of December 21, 2025.

By using EchoesOf, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.