Privacy Policy
Effective 17 June 2026 · Last updated 17 June 2026
This Privacy Policy explains how Echo.Me(“Echo”, “we”, “us”, “our”) collects, uses, shares and protects your personal information. It applies to anyone who uses the Echo.Me iOS or Android app, our website at echome.helloworld.com.ng, or any other service that links to this policy.
Echo is a decision studio: you set a goal, build a small model of your world, and work through it step by step with AI-generated guidance to see where each choice could lead. Because that guidance is produced by artificial intelligence, this policy pays special attention to what is sent to AI providers and why (see Section 5).
We comply with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR). For users in the European Economic Area / United Kingdom we also honour GDPR / UK GDPR, and for California residents the CCPA/CPRA. Where these give you stronger rights than your local law, we extend them to you anyway.
1. Who we are
Echo.Me is operated by HelloWorld(the “data controller”), the publisher of the Echo.Me app. You can reach our privacy team and Data Protection Officer (DPO) at any time at [email protected] — one inbox handles support, privacy, legal and DPO correspondence. We respond within the timeframes in Section 10.
2. Information we collect
We collect only what we need to run Echo, and we flag optional fields. We do not require a real name, a photo, or a date of birth to use the core app.
2.1 Information you provide
| Data | Why we collect it |
|---|---|
| Email address (and, optionally, phone number) | To create and secure your account, verify it, and send essential service messages. |
| Password | Stored only as a salted one-way hash (bcrypt) — never in plain text. |
| Profile — display name, bio, photo, date of birth, gender, language, timezone (all optional) | To personalise your experience and show an author name on stories you choose to publish. |
| Your simulations — goals, the objects/records and field values you add, the steps and moves you take, and the conversations you have with the in-app guidance | To run your simulation, generate guidance, measure progress, and save your journey so you can return to it. |
| Shared stories — any journey you publish, plus reactions and comments you post | To power the public stories feed (only when you choose to publish — see Section 6). |
| Payment records — amount, currency, method, transaction reference and status | To sell credits and Premium. Card/bank details are handled by our payment processors; we never receive or store your full card number or CVV. |
| Support & correspondence | Messages and data-requests you send us, kept while the matter is open plus a short audit window. |
If you sign in with a third-party identity provider (e.g. Google, Apple, Facebook, GitHub or X) we receive your basic profile and verified email from that provider; we never receive your password with them.
2.2 Information collected automatically
- Device & app data — device model, operating system and version, app version, locale, and a push-notification token (to deliver notifications you've enabled).
- Session & security data — sign-in events, an IP address and user-agent recorded with your session, and limited request logs (method, path, status, timing) kept to keep the service working, debug errors, and prevent abuse.
- World usage & feedback — when you play in the 3D world we record which views you open and how long a step takes (ids and timings, never your answers), your answers to the occasional “which object changed?” check, and any “this doesn’t look right” report you send, together with what the scene was showing. We use these to fix how the world is drawn; a report is reviewed by AI and may redraw your world.
- Diagnostics — error and performance logs. We do not embed third-party advertising, tracking, or analytics SDKs in the app, and we do not use the advertising identifier (IDFA/AAID).
3. How we use your information
| Purpose | Examples |
|---|---|
| Provide the core experience | Set up your world, plan steps, play moves, hold step conversations, run expert skills, measure goal progress, and save everything. |
| AI guidance | Send the necessary simulation content to an AI provider to generate the next situation, options, outcomes, or advice (see Section 5). |
| Payments & credits | Sell and meter credits, run Premium subscriptions, and keep transaction records. |
| Public stories | Publish, list, and let others react to, comment on, and fork the stories you choose to share. |
| Communicate | Verify your account, reset your password, send notifications you've enabled, and answer your enquiries. |
| Security & integrity | Detect and prevent fraud and abuse, enforce limits, and keep accounts safe. |
| Improve Echo | Understand how features perform using aggregated, non-identifying analysis. We do not build advertising profiles. |
| Legal | Meet tax, accounting, and other legal obligations and respond to lawful requests. |
We do not sell your personal information, and we do not use it for targeted advertising.
4. Legal bases for processing
Where the NDPA / GDPR require a legal basis, we rely on: contract (to deliver the service you sign up for, including AI guidance); consent (e.g. publishing a story, or enabling push notifications) — which you can withdraw at any time; legitimate interests (securing and improving the service, preventing abuse); and legal obligation (e.g. keeping financial records). The lawful basis for transmitting your content to AI providers is performance of our contract with you — it is the feature you asked for.
5. AI processing — what we send and why
Echo's guidance is generated by large-language-model (LLM) AI. To produce a response, the content needed for that specific request is transmitted to our AI provider over an encrypted connection, and the model's reply is returned to your simulation.
5.1 Who our AI providers are
We use OpenAI and/or Anthropic as our model providers (the active provider and model are a server configuration). These providers process the content we send under their own enterprise/API terms. OpenAI and Anthropic both state that content submitted through their business APIs is not used to train their models by default. We send only what is needed to fulfil your request, and we do not use your private simulation content to train any model of our own.
5.2 What is sent
Depending on the feature you trigger, we may send:
- World setup — the goal category and the short prompt you type.
- Planning & moves — your goal, the objects/records in your world and their field values, your plan steps, and recent context, so the AI can propose the next step, options and outcomes.
- Conversation — the current step plus the message or challenge you type.
- Expert skills — the step context and any message you provide to the skill.
We do not send your name, email, phone number, password, payment details, or precise location to the AI provider. The content sent is the simulation content you authored. Because a simulation can be about your real life, please avoid entering information you would not want processed by a third-party AI provider — for example, government identifiers, health records, or other people's personal data.
5.3 Important limits of AI
- AI output can be inaccurate, incomplete, or wrong. Echo is a thinking and rehearsal tool, not professional advice.
- Echo does not make automated decisions that produce legal or similarly significant effects about you (see Section 12). You choose every move; the AI only suggests.
- Echo works even with AI turned off, using built-in deterministic content — so the service does not depend on sending your data anywhere.
6. How we share information
| Recipient | Why |
|---|---|
| AI providers (OpenAI / Anthropic) | To generate guidance, as described in Section 5. |
| Payment processors (Paystack, Flutterwave, Apple App Store, Google Play) | To take payment for credits and Premium. They handle your card/billing data as independent controllers under their own terms and PCI-DSS; we receive only a transaction record. |
| Infrastructure providers | Cloud hosting and database, media/object storage, and (optionally) a caching/queue service — under contract, only as needed to run Echo. |
| Messaging providers | Apple Push (APNs) and Google (FCM) to deliver push notifications; an email provider for transactional email. |
| Other users | Anything you publish as a public story, and reactions/comments you post, are visible to others (see below). |
| Legal & safety | Authorities or others where required by law or to protect rights, property, or safety. |
Public stories. Your simulations are private by default. A story becomes public only when you publish it. A published story exposes its title, summary, a one-line outcome arc, a per-step reel (situation, decision, outcome), any phases, and the author display name on your profile; the “roads not taken” are kept for you (and premium readers) and are not shown to everyone. Others can react to, comment on, and fork a public story (a fork starts from your baseline world, not your played-out values). Please don't publish anything you wish to keep private. We do not sell personal information.
7. Data retention
| Data | Retention |
|---|---|
| Account & profile | While your account is active. On deletion we anonymise the identifying parts of your profile (see Section 10) within the timeframe in our Data Request Policy. |
| Simulations, stories & conversations | Kept while your account is active; after deletion they are retained only in a form no longer linked to your identity, or removed per your request. |
| Payment & transaction records | Retained as required by tax and accounting law, in pseudonymised form, after account deletion. |
| Verification codes (OTP) | Held only as a short-lived hash (minutes), then discarded. |
| Security & request logs | Kept for a limited period (typically up to 14 days for ordinary logs; longer for security/error records). |
8. Sub-processors & international transfers
Echo relies on a small set of vetted providers to operate. Categories include: cloud hosting and PostgreSQL database; AI model providers (OpenAI, Anthropic); payment processors (Paystack, Flutterwave, Apple, Google); push and email delivery (APNs, FCM, SMTP email); media/object storage; and an optional cache/queue. Some are located outside Nigeria (including the United States and the EU). Where your data is transferred internationally we rely on appropriate safeguards consistent with the NDPA and GDPR (such as adequacy findings or standard contractual clauses), and we transfer only what each provider needs.
9. Security
We protect your data with encryption in transit (HTTPS/TLS), salted password hashing (bcrypt), short-lived access tokens with rotating, revocable refresh tokens and replay detection, role-based access controls, authenticated real-time connections, and rate limiting. No system is perfectly secure, but we work to protect your information and to notify you and the relevant authority of any breach as required by law.
10. Your rights
Subject to applicable law, you may exercise the following rights:
- Access — a copy of your data, machine-readable.
- Rectification — correct inaccurate data (much of it editable in-app).
- Deletion (“right to be forgotten”) — delete your account in-app or on request; we anonymise/erase as described in the Data Request Policy, keeping only what the law requires.
- Portability — receive your data in a portable format.
- Restriction & objection — limit or object to certain processing.
- Withdraw consent — e.g. turn off notifications or unpublish a story; this doesn't affect processing already carried out.
Use the Data Request form or email [email protected]. We aim to respond within 7 working days (NDPA/NDPR); statutory maximums are 30 days (GDPR, extendable) and 45 days (CCPA, extendable). You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng), your EU/UK supervisory authority, or the California Privacy Protection Agency. Full procedures are in the Data Request Policy.
11. Children
Echo is not directed to children. You must be at least 13 years old (or the minimum age in your jurisdiction) to use Echo, and if you are under the age of majority you should use it only with the involvement of a parent or guardian. We do not knowingly collect data from children under 13; if we learn we have, we delete it.
12. Automated decision-making
Echo does not make decisions with legal or similarly significant effects about you solely by automated means. AI is used to generate suggestions and narrative inside your simulation; you remain in control of every choice, and the simulation is a rehearsal, not a determination about your real life.
13. Changes to this policy
We may update this policy from time to time. We will post the new version here and update the “Last updated” date; for material changes we will give notice in-app or by email before they take effect.
14. Contact
For any privacy enquiry, or to reach our DPO, contact [email protected]. See also our Data Privacy summary and Data Request Policy.
Questions about this page? Email [email protected].