Effective date: August 9, 2026
Echoes ("Echoes," "we," "us") is a mobile app for tracking shared habits and splitting expenses with the people you live with or share responsibilities with, organized into "boards." This policy explains what information Echoes collects, how it's used, and the choices you have.
Echoes is operated by Zelda, based in Italy, who is the data controller for the personal information described below.
Account information. When you register, we collect a username, email address, and password. First and last name and a profile picture are optional. Your password is never stored in plain text — it's hashed before it touches our database.
Email verification and password resets. To confirm that the email address on your account is yours, and to let you get back in if you forget your password, we send you emails containing a one-time link. We store a token for each of these alongside your account: verification links expire after 24 hours, and password reset links expire after 1 hour and can only be used once. These emails are delivered by Resend, which receives your email address and the name on your account in order to deliver them.
Habit and board data. Names, descriptions, and completion history for habits you create, and the name, description, and membership of any board you create or join. Boards are joined using a numeric invite code.
Expense data. Amounts, descriptions, dates, categories, and splits for any shared expenses you or others log within a board.
Device and diagnostic data. We use Sentry for crash and error reporting, on both the app and our backend. When something goes wrong, Sentry receives a stack trace, the app/OS version, and device type. Our backend is configured to strip personal data (send_default_pii=False) from these reports before they're sent.
Push notification tokens. If you enable push notifications, we store a device push token tied to your account, used to alert you when someone adds an expense to a board you're on. You can turn notifications off at any time, both app-wide and per board, from within the app.
We do not use advertising or analytics SDKs, and we do not sell your data to anyone.
If you're in the EEA/UK, here's what we rely on to process each category of data:
send_default_pii=False) and limiting what's collected to stack traces and device/app version.Where we rely on legitimate interest, we've limited collection to what's needed for that purpose and weighed it against your privacy — you can object at any time using the contact below, and we'll stop unless we have a compelling override.
Echoes is built around shared boards — other members of a board you join can see the habits, expenses, and expense splits you contribute to that board, along with your username, name, and profile picture. This visibility is the core feature of the app, not a side effect.
Beyond board members, we don't share your information with third parties, except:
Your data is stored on servers we control, encrypted in transit via HTTPS/TLS. Authentication uses per-user API tokens rather than passwords sent with every request. If you forget your password, you can request a reset link by email; that link expires after an hour and can only be used once.
To exercise any of these choices outside the app, or to ask us anything about your data, contact us at the address below.
If you're in the EEA/UK, you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Most of this you can do yourself in the app; for anything else, contact us at the address below and we'll handle it directly. If you're not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.
We keep your account, habit, board, and expense data for as long as your account is active. Email verification and password reset tokens are short-lived by design — 24 hours and 1 hour respectively — and are deleted along with your account. If you delete your account, your account record, profile picture, and any push notification tokens are removed immediately; data you contributed to shared boards may persist as part of other members' board history, as described above. Diagnostic data sent to Sentry is retained per Sentry's own retention settings, currently 90 days.
Echoes is not directed at children under 16, and we don't knowingly collect information from them.
If we make material changes to this policy, we'll update the effective date above and, where appropriate, notify you in the app.
Questions about this policy or your data: echoes@zelda.sh