echova

Privacy Policy

Effective date: September 30, 2026
Last updated: September 30, 2026
Canonical URL: https://echova.app/privacy

1. Who we are

Echova (“Echova,” “we,” “us,” or “our”) provides a consumer AI fitness coaching app. Echova is not a medical device and is not a HIPAA-covered health service. It is a fitness coaching product.

Contact: hello@echova.app

This Privacy Policy explains what personal information we collect, how we use it, who helps us process it, how long we keep it, and the choices you have. It applies to the Echova mobile app and the website at echova.app, including the account and privacy links inside the app.

2. Information we collect

We collect information you provide, information created when you use coaching features, and limited technical information needed to run the app.

2.1 Account information

• Email address
• Sign in with Apple identifiers (when you choose Apple sign-in)
• Account metadata such as account creation time (createdAt), timezone, and last opened time (lastOpenedAt)

2.2 Fitness profile and goals

• Fitness level, training schedule, available equipment
• Limitations or injury notes you choose to enter
• Goal text and optional metrics or progress you enter

2.3 Programs, workouts, and coaching state

• Training plans and exercises
• Prescribed weights, RPE, and related coaching parameters
• Week / phase state for your program

2.4 Session, check-in, and coaching memory

• Workout completion and effort
• Flags you set (for example skip, injury, or travel)
• Voice-to-text transcripts of check-ins or coaching input (we do not store raw audio in Echova’s database)
• Coaching notes
• Append-only session logs and weekly reviews used to personalize coaching

2.5 AI chat and coaching history

When you use AI coaching, we assemble relevant history (such as profile, goals, program state, recent check-ins, and chat) and send it to OpenAI’s API so the model can adapt your plan and responses. We retain Echova-side AI coaching memory separately from OpenAI’s processing of API requests (see Sections 4 and 6).

2.6 Exercise media

We may show AI-generated exercise demos that are reviewed by Echova before use. These are not photos of your body. Echova does not currently collect user body photos.

2.7 Device and operations data

• Push notification token (Firebase Cloud Messaging / FCM) so we can send notifications you enable
• Crash and diagnostic information sent to Sentry (see Section 4). If you are signed in, a report includes your account ID

2.8 Subscription status (payments)

Payments for subscriptions are processed by Apple through In-App Purchase. Echova does not receive your full payment card details. We store subscription-related status we need to provide the product, such as subscription status, tier, and expiry.

2.9 What we do not collect today

As of the effective date of this policy, Echova does not collect:

• User body photos
• Dedicated body-weight fields in the product (these may be added later; if so, we will update this policy)
• Apple HealthKit / Health data (unless we add HealthKit later and update this policy)

3. How we use your information

We use personal information to:

• Create and maintain your account
• Provide AI fitness coaching, programs, workouts, check-ins, and chat
• Adapt plans and coaching based on your profile, goals, and history
• Send push notifications you enable (for example reminders or coaching updates)
• Process and honor subscription status delivered via Apple IAP
• Secure the service, prevent abuse, debug issues, and improve reliability
• Respond to support requests at hello@echova.app
• Comply with law and enforce our terms

We do not sell your personal information.

4. Who processes data on our behalf (service providers)

We use trusted service providers to operate Echova. They process data only as needed to provide their services to us.

OpenAI (API) — how your data is treated under OpenAI’s published API data controls (see OpenAI — Data controls / your data):

• /v1/audio/transcriptions: not used for training; abuse-monitoring retention: none (per OpenAI’s table)
• /v1/chat/completions: not used for training by default (API default; no opt-in to share for training); abuse-monitoring retention up to 30 days, unless Zero Data Retention (ZDR) or similar controls apply to our account

Echova-side retention of coaching history and transcripts is described in Section 6 and is separate from OpenAI’s API-side logs.

Sentry (crash / diagnostics): We use Sentry in the production app to report crashes and diagnostic errors so we can keep Echova stable. Sentry receives technical data about the device and the failure, such as device type, operating system, app version, and error details. If you are signed in, we also send your account ID (your Firebase user ID) so a report can be linked to your account. We do not send your email, your name, screenshots, the contents of the screen, a trail of actions inside the app, or performance-tracing data. Sentry’s privacy policy is at sentry.io/privacy.

Firebase / Google generally act as a processor / service provider for customer end-user data under Firebase’s published privacy and data-processing terms when we use Authentication, Firestore, FCM, and related services.

5. Legal bases and your choices (where applicable)

Depending on where you live, we process personal information under one or more of the following (as applicable):

• To provide the service you request (account, coaching, subscriptions)
• With your consent (for example certain notifications or optional features)
• For our legitimate interests in securing and improving the product, where permitted
• To comply with legal obligations

You can:

• Access or update much of your profile and goals in the app
• Turn off push notifications in device settings
• Delete your account (see Section 6)
• Contact us at hello@echova.app to ask questions or exercise privacy rights available to you under applicable law

If you use Sign in with Apple or manage subscriptions, Apple’s own privacy terms also apply to Apple’s processing.

6. Retention and account deletion

While your account is active: We retain account, profile, program, session, and coaching-memory data as needed to provide Echova.

When you delete your account: We end active use of your account data for coaching. We may retain limited information for a short operational period after deletion (for example to complete deletion across backups, prevent fraud, or meet legal requirements), then delete or de-identify it when no longer needed.

AI coaching memory (Echova-side): Chat and coaching history used to personalize your experience is retained with your account while it is active, and is removed or de-identified as part of account deletion, subject to the short post-delete operational window above.

OpenAI API: Content sent to OpenAI for a request is processed under OpenAI’s API data controls (Section 4). That is separate from how long Echova keeps your in-app coaching history.

We do not sell personal information. We may update retention practices if product or legal needs change; material changes will be reflected in this policy.

7. Children’s privacy

Echova is intended for adults and is not directed at children. We do not knowingly collect personal information from children in a manner inconsistent with App Store age rating and applicable children’s privacy laws. If you believe a child has provided us personal information, contact hello@echova.app and we will take appropriate steps.

8. International transfers

We and our service providers may process and store information in the United States and other countries where we or they operate. Those countries may have privacy laws different from where you live. Where required, we rely on appropriate safeguards and contracts with providers (for example Google/Firebase, OpenAI, and Sentry data-processing terms).

9. Security

We use industry-standard measures appropriate to a consumer app, including encrypted transit (HTTPS/TLS) to our services and access controls on production systems and databases (including Firebase). No method of transmission or storage is 100% secure. Please use a strong device passcode and protect access to your Apple ID and email.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top and post the revised policy at https://echova.app/privacy. If changes are material, we may provide additional notice in the app or by email where appropriate. Continued use of Echova after an update means you acknowledge the revised policy.

11. Contact

Questions about privacy or this policy:

Email: hello@echova.app
Policy URL: https://echova.app/privacy

Also linked from in-app Account → Privacy.

12. Summary (plain language)

This policy describes Echova’s product practices as of September 30, 2026, based on current product facts. It is published for users of echova.app and the Echova app.