Privacy Policy

    Effective date: April 21, 2026

    Chromoly Labs, LLC, a Texas limited liability company ("we", "us", "our"), operates Echoback ("the Service"). This policy explains what data we collect, how we use it, and your rights regarding that data.

    1. Information We Collect

    Account Information

    When you create an account, we collect your email address and any profile information you provide. Authentication is handled via Supabase Auth.

    Feedback Submissions

    When visitors submit feedback through your public forms, we collect the feedback content, optional name, email, and rating. This data is stored on your behalf as a project owner.

    App Store Reviews

    If you connect App Store or Google Play review syncing, we fetch and store publicly available review data (reviewer name, rating, review text, date) from those platforms.

    Team Collaboration

    If you invite others to your team (available on Pro and Scale plans), team members you add gain access to the projects, feedback, and widgets in your account. The same data described above is visible to those team members until you remove them. Team members can similarly see your email, name, and team role.

    Payment Information

    We do not store credit card numbers or full payment details. All payment processing is handled by Stripe. We store only a Stripe customer ID and subscription status.

    Usage Data

    We collect standard server logs including IP addresses, browser type, and pages visited. We also use a first-party product analytics service (PostHog) to understand how the dashboard is used so we can improve it. These analytics are scoped to the Echoback product and are not used for cross-site tracking or advertising.

    Rate-Limit and Abuse Prevention

    To prevent spam and abuse on public feedback forms, we store a one-way hash of submitter IP addresses (never the raw IP) alongside the action performed, for a short rolling window. Hashed entries cannot be reversed back to the original address.

    Where Your Data Is Stored

    Echoback data is hosted in the United States on Supabase infrastructure. Stripe processes payment data in its own regions per its policy.

    2. How We Use Your Data

    • Provide and maintain the Service
    • Process payments and manage subscriptions
    • Prevent abuse, fraud, and spam
    • Send transactional emails (account verification, password resets, trial reminders)
    • Improve the Service based on aggregate usage patterns

    We do not sell your personal data. We do not use your data for advertising purposes.

    3. Third-Party Processors

    We share data with third-party processors only as necessary to operate the Service. We use processors for:

    • Hosting, database, and authentication
    • Payment processing
    • Transactional email delivery
    • Security and bot protection
    • Error tracking and product analytics

    A current list of named sub-processors, along with a Data Processing Agreement for business customers, is available on request at support@echoback.co.

    4. Data Retention & Deletion

    We retain account and project data for as long as your account is active.

    Delete your account. You can fully delete your account at any time from Account → Delete Account. This cancels any active subscription, removes all projects and associated feedback, and deletes your authentication record. The email address becomes available to sign up again.

    Automated purge of inactive unpaid accounts. Each month, we automatically delete the project data — including any collected feedback — for accounts that (a) have no subscription record with us (including past cancellations), (b) ended their trial more than 30 days ago, and (c) have not signed in for at least 30 days. The authentication account itself is preserved so you can return and start fresh at any time. This limits how long we retain personal data from visitors who submitted feedback through forms that are no longer being used.

    Team projects. If you belong to a team, deleting your personal account does not remove projects owned by the team owner. Conversely, if the team owner deletes their account, team members lose access to those projects because the projects are removed with the owner's data.

    Right to erasure. If you prefer not to use the self-serve flow, you can request deletion at support@echoback.co and we will process the request within 30 days.

    5. Cookies

    Echoback uses a session cookie for authentication. We use first-party product analytics (see Usage Data above), but we do not use cross-site tracking cookies or advertising cookies.

    6. Your Rights Under GDPR

    If you are located in the European Economic Area, you have the right to:

    • Access the personal data we hold about you
    • Correct inaccurate or incomplete data
    • Request deletion of your data
    • Export your data in a portable format
    • Object to or restrict processing of your data

    To exercise any of these rights, contact us at support@echoback.co.

    7. Your Rights Under CCPA

    If you are a California resident, you have the right to:

    • Know what personal data we collect and how it is used
    • Request deletion of your personal data
    • Opt out of the sale of your personal data (we do not sell personal data)
    • Non-discrimination for exercising your privacy rights

    8. Children's Privacy

    Echoback is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such data, we will delete it promptly.

    9. Changes to This Policy

    We may update this policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new effective date.

    10. Contact

    If you have questions about this Privacy Policy, contact us at support@echoback.co.