Privacy Policy

Last updated: 21 September 2026

This policy explains what personal data Echoes processes when you use our website, web app and mobile app, why we do it, and what rights you have. We collect as little as the service needs: there is no advertising, no analytics and no tracking on Echoes.

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

For any question about your data, or to exercise your rights, write to the email address above.

2. Hosting

Echoes runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres located in Germany. Our database, file storage, translation and pronunciation services all run on these servers. Hetzner processes data on our behalf under a data processing agreement (Art. 28 GDPR).

When you visit Echoes, your browser necessarily sends technical data such as your IP address, the time of the request and your browser's user agent. We use your IP address for a few minutes in memory to limit repeated requests (for example, login attempts) and protect the service from abuse. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in running a secure service.

3. Your account

When you create an account we process:

• your email address, a username and a password (stored only as a salted hash);
• if you choose to add them: a display name, a short bio, a profile picture, your native and learning languages, your time zone and your learning preferences;
• the date on which you accepted our Terms of Use, and when you last signed in.

We send you emails only where they are needed to run your account: confirming your email address and resetting your password. These are delivered through Resend, which acts as our processor.

Legal basis: Art. 6(1)(b) GDPR — providing the service you signed up for.

Signing in with Google or Apple

If you sign in with Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland), you are redirected to that provider. It tells us your email address, a user ID and, where available, your name and profile picture. The provider's own privacy policy applies to what happens on its side. Legal basis: Art. 6(1)(b) GDPR.

4. Your learning data

To make spaced repetition work we store the decks, cards, folders and example sentences you create, when you reviewed each card and how you rated it, which box it is in, your self-assessed language levels, and how many AI generations you have used today. Legal basis: Art. 6(1)(b) GDPR.

Sharing. Decks are private unless you share them. If you invite others or make a deck public, the people who can open it see its content and your username. If you delete your account, decks that other members still use are handed over to one of them, so the cards you added to those decks remain available to them without any link to you.

5. AI features

When you ask Echoes to generate cards, it sends the words you entered and the language pair to Google's Gemini API. We do not send your name, email address or account ID. Google may process the request in the United States; Google is certified under the EU–US Data Privacy Framework, and the EU Commission's adequacy decision (Art. 45 GDPR) applies.

Please do not enter personal information about yourself or anyone else into the card generator. AI-generated content can be wrong; check it before you rely on it. Legal basis: Art. 6(1)(b) GDPR.

6. Other services used by features

• Example sentences. If you have example suggestions switched on, our server looks up the word you are adding at Tatoeba (tatoeba.org). Only the word and its language are sent, never anything about you. You can turn this off in your settings.
• Dictionary lookup. When you press the dictionary button while creating a card, your browser asks the Free Dictionary API (dictionaryapi.dev) directly for that word. Because the request comes from your browser, that service sees your IP address. It happens only when you press the button. Legal basis: Art. 6(1)(b) GDPR.
• Read aloud. Some pronunciation playback uses your browser's or device's built-in speech engine. Depending on your browser, the text may be processed by its vendor (for example Google or Apple) under their privacy terms.
• Translation and pronunciation (IPA and audio) run on our own servers in Germany; no third party is involved.

7. Push notifications

If you allow notifications, we use Firebase Cloud Messaging by Google Ireland Limited to deliver review reminders. For this we store a device token and your device's operating system. The token identifies the device to Google, not you personally, but Google may process it in the United States (see the Data Privacy Framework note above). Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time by turning notifications off in Echoes or in your browser or device settings.

8. Storage on your device

Echoes does not use cookies for tracking. The app stores a few items in your browser's local storage that it cannot work without: your sign-in tokens, a copy of your profile so the app loads quickly, your theme and view preferences, and — if you enabled them — your notification token. These are strictly necessary to provide the service you requested, so no consent is required (§ 25(2) no. 2 TDDDG). Signing out removes your sign-in data. Our fonts are hosted by us, so loading a page does not contact Google Fonts.

9. How long we keep data

• Account and learning data: for as long as you have an account. When you delete your account in the settings, it is closed immediately and all its data is permanently erased within 30 days.
• Email confirmation and password reset links expire and are deleted after use.
• Sign-in sessions expire after at most 7 days of inactivity.
• IP addresses used for rate limiting are held in memory for a few minutes.

We keep data longer only where a law requires us to.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17) — you can do this yourself by deleting your account;
• restrict processing (Art. 18);
• receive your data in a structured, machine-readable format (Art. 20);
• object at any time to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21);
• withdraw any consent you gave, with effect for the future (Art. 7(3)).

To exercise these rights, email privacy@echoes.study. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is Bayerisches Landesamt für Datenschutzaufsicht (https://www.lda.bayern.de).

11. Other information

You need to be at least 16 years old to create an account. Providing data is not required by law, but without an email address and password (or a Google or Apple sign-in) we cannot create an account for you. We do not make decisions about you based solely on automated processing within the meaning of Art. 22 GDPR, and we do not sell your data.

We will update this policy when the service changes. If a change affects how we use data you have already given us, we will tell you in the app or by email before it takes effect.