← Back to Echo

Privacy Policy

How we collect, use, and protect your data when you use Echo.

Effective Date: May 2026

Company: The Final Leap, Bangalore, India

Contact: echo@finalleap.co, +91 8530302273

1. Introduction

The Final Leap ("we", "us", "our") operates Echo, a voice dictation and voice command application for macOS, iOS, Android, and Windows. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use Echo.

2. Information We Collect

We collect the following types of information:

• Account Information: Email address, name, and phone number provided at signup
• Voice Audio: Your audio is sent to our transcription provider to produce text and is not stored on our servers. When a transcription fails, Echo keeps that audio on your own device so you can retry it; that copy is deleted as soon as the retry succeeds, and otherwise discarded automatically after 48 hours. If you turn on "Keep audio for re-transcription" in Settings, Echo keeps audio on your device until you delete that transcription or turn the setting off. Audio is never uploaded to us.
• Transcription Text: The text output from your voice recordings is stored to provide the history feature within the app
• Usage Analytics: Event names, timestamps, app version, and general usage patterns
• Device Information: macOS or iOS version, device model, and app configuration settings

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Echo service
• Process your voice input and deliver accurate transcriptions
• Store your transcription history for your reference
• Send transactional emails (account confirmations, subscription updates, service notifications)
• Improve transcription accuracy and app performance
• Respond to support requests and customer inquiries

4. Data Storage and Third-Party Services

Your data is processed and stored using the following services:

• Supabase: Account data, transcription history, and usage analytics are stored on Supabase servers located in ap-south-1 (AWS, India)
• Sarvam AI: Voice audio is sent to Sarvam AI, an Indian AI company, for transcription processing. We do not retain this audio on our servers
• Resend: Transactional email delivery service for account-related communications
• Anthropic: When you use Echo's command features, the text of your spoken command is sent to Anthropic's Claude API through our own server to determine what action you asked for. If a command needs information from a connected service to answer, that information may be included in the request so the response can be composed. It is not stored by Anthropic and is not used to train models. The API is accessed through our server so that no API key ships inside Echo
• Notion: If you choose to connect Notion, Echo reads and writes content in the Notion pages you have shared with the integration. Notion credentials are stored in the Keychain on your own device

5. Google User Data

Echo connects to your Google account only when you choose to connect it. Connecting is optional and Echo works without it. Echo requests four permissions, and each has a single purpose.

Calendar events (calendar.events). Echo reads events from your primary calendar to answer questions about your schedule, and creates events when you dictate a meeting. Echo does not create, delete, or manage calendars themselves.

Send email (gmail.send). Echo sends emails you dictate. Echo cannot read, search, list, label, or modify your mail. No other Gmail permission is requested.

Contacts, read only (contacts.readonly). When you name a recipient rather than typing an address, Echo searches your contacts to resolve that name to an email address. Echo never creates, edits, or deletes contacts.

Tasks (tasks). Echo lists, creates, updates, completes, and deletes tasks in your Google Tasks lists when you ask it to.

Google data is used only to carry out the command you gave. Echo does not store your calendar events, contacts, or tasks on our servers. This data is fetched when a command needs it, used to answer or act, and then discarded. Your Google access tokens are stored in the Keychain on your own device, never on our servers.

You can disconnect Google at any time in Echo's settings, or revoke access at https://myaccount.google.com/permissions.

Limited Use. Echo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising. We do not sell Google user data. We do not use Google user data to train generalized artificial intelligence models. We do not allow humans to read Google user data, except with your explicit consent for a support request you initiate, where required for security purposes, or to comply with applicable law.

Data Transfer. Echo does not sell Google user data and does not share it with data brokers or advertisers. Google user data is processed on your device and rendered locally. There is one exception, described here for completeness: if you issue a compound command that combines a Google read with a follow-up question — for example "what's on my calendar and summarise my day" — the result of the first part is included as context in a request to Anthropic's Claude API so the follow-up can be answered. Anthropic does not use API inputs to train its models. Simple commands never send Google data anywhere.

Data Protection. Google access and refresh tokens are stored in the macOS Keychain on your own device and never on our servers. Requests to Google APIs are made directly from your device over TLS. No Google user data is stored on our servers at any time.

Data Retention and Deletion. Echo does not retain your calendar events, contacts, or tasks. This data is fetched when a command needs it, used to answer or act, and discarded. You can disconnect Google at any time in Echo's settings, or revoke access at https://myaccount.google.com/permissions, which immediately ends all access.

AI/ML. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Echo does not use Google user data to develop, improve, or train AI or machine learning models, and does not transfer Google user data to any third-party service that uses it for model training.

6. Data Retention

• Account Data: Kept until you request account deletion
• Transcription History: Kept until you delete it or delete your account
• Voice Audio: Not stored on our servers. When a transcription fails, that audio is kept on your own device so you can retry it (deleted as soon as the retry succeeds, and otherwise discarded automatically after 48 hours); with "Keep audio for re-transcription" on, audio stays on your device until you delete that transcription or turn the setting off. Never uploaded to us

7. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Delete: Request deletion of your account and all associated data
• Export: Request an export of your transcription history and account information

To exercise any of these rights, email us at echo@finalleap.co.

8. Cookies and Tracking

Echo is a native macOS, iOS, Android, and Windows application and does not use cookies. Our marketing website (finalleap.co) uses Vercel Analytics, which collects anonymous, aggregated usage data without cookies or personal identifiers.

9. Children's Privacy

Echo is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13.

10. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit and at rest. However, no method of transmission over the internet is 100% secure.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email at the address associated with your account.

12. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes arising from this policy will be subject to the exclusive jurisdiction of the courts in Karnataka, India.

13. Contact Us

If you have questions or concerns about this Privacy Policy, contact us at:

Email: echo@finalleap.co
Phone: +91 8530302273
Address: The Final Leap, Bangalore, India