Privacy Policy

1. Scope

This Privacy Policy describes how personal information is collected, used, disclosed and retained in connection with the echo. browser extension, website and related services (the “Service”).

2. Information processed from web pages

When echo. is enabled on a supported page, page text is processed within the browser to identify passages. The page URL, page title and a content fingerprint are transmitted to the Service to identify related discussion activity. The complete article is not transmitted as part of that activity lookup.

Page and passage records are stored when associated content, including a comment or private note, is submitted. These records include the URL, title, passage identifiers, position information, content fingerprints, readable passage excerpts and adjacent context. An activity lookup does not, by itself, create a new page record.

URL fragments and certain recognized tracking parameters are removed from the URL used for page identification. Other information contained in a URL or title may remain.

3. Account information

Account information includes an email address, handle, display name, profile description, avatar settings, account identifiers, status, preferences, timestamps and records of acceptance of a terms version. The information provided depends on the registration method and the profile fields completed.

Credentials, session identifiers and verification information are processed for sign-in, account verification, password recovery and account changes. Passwords for local accounts are stored in hashed form.

When an external sign-in method is selected, the Service receives the identity reference, email address and other authentication information made available by the relevant provider. The password for a Google or GitHub account is not provided to echo.

4. Content and social information

The Service stores submitted comments, replies and private notes, together with associated passages, identifiers and timestamps. Comment information also includes spoiler indicators, optional labels, editing or removal status and related discussion metadata. Reaction records identify the account, reaction and associated content.

Public comments and accompanying author information are available to readers, including people without an account where public reading is supported. Author information may include a handle, display name, avatar and service role. Hiding a profile does not make comments in public discussions private. Reaction counts and other public discussion activity may also be displayed.

Private note text is available to its owning account through the ordinary user features. It is not published to other readers or made available through standard moderation tools. Notes are stored on the Service’s servers and may be accessible to authorized personnel responsible for operating the Service or its infrastructure. Private notes are not end-to-end encrypted.

Follow, block and mute relationships are stored. A followed account may receive relationship information and a notification; follower and following counts may be displayed. Block and mute records are not published as public lists, and no direct notification is issued solely because an account was blocked or muted.

Notification records include the event concerned, associated content or account information, timestamps, read status and notification preferences. Notification information may be updated through periodic requests while the extension is enabled and signed in.

5. Use of personal information

Personal information is processed for the following purposes:

• Identifying passages and retrieving associated discussions.
• Creating and administering accounts, authenticating users and maintaining account security.
• Storing and displaying comments, replies, reactions, profiles and private notes.
• Operating follow relationships, content filters and account notifications.
• Delivering verification, recovery and other account-related communications.
• Reviewing reports and appeals, enforcing community rules and preventing misuse.
• Diagnosing errors, maintaining service reliability and responding to support or privacy requests.
• Responding to legal requirements and protecting rights where applicable law permits or requires the processing.

Personal information is not sold or rented by echo. Browsing information, private notes and account information are not used by echo. for targeted advertising or to train artificial intelligence models.

6. Reports, support and operational records

Reports and appeals include the submitting account’s identifier, the content or decision concerned, the stated reason, any explanation provided, timestamps and review outcomes. Moderation records may contain removed content, passage excerpts, internal notes and records of administrative actions.

Access through administrative tools is subject to roles and permissions. Reports, appeal statements and internal moderation notes are not published as public discussion content. Certain privileged actions, including access to an account email address through the owner tool, are recorded in an audit log.

Support correspondence includes the sender’s address, message content, attachments and information supplied for handling the request.

Connection and request information is processed to deliver and secure the Service. This includes IP addresses, timestamps, requested service paths, response information and error details. Some request information is retained in operational logs. Hosting and communication providers also process technical information associated with their services.

7. Disclosure of personal information

Information is disclosed to other users to provide the public and social features described above. Public content may be copied or shared outside the Service by other people; removal from echo. does not remove independent copies.

Service providers process information for hosting, database operation, authentication, email delivery, delivery monitoring and support. The provider involved depends on the function used.

Information may also be disclosed in response to a lawful request or legal process, to comply with an applicable legal obligation, or to establish, exercise or defend legal rights, to the extent permitted by applicable law.

External websites and independently operated services are subject to their own privacy practices. This Policy does not govern their independent processing.

8. Browser storage and website technologies

The extension stores preferences, authentication state and tokens, temporary discussion-activity information, notification polling information, account-view state and a limited diagnostic log in browser extension storage. The local diagnostic log contains permitted event information rather than comment text, note text or page URLs, and is not automatically transmitted to a remote analytics service.

The first-party website pages do not use advertising pixels, analytics integrations or first-party cookies. Authentication and hosting providers may use separate technical mechanisms in connection with their services.

Site-level and global extension controls affect requests associated with the relevant functions. Disabling the extension for one site does not necessarily stop general account functions such as notification polling. Disabling or uninstalling the extension does not itself delete information stored by the Service.

9. Retention

Account information and submitted content are retained to operate the account and the associated features, subject to the deletion processes described below.

• Comments. Removing a comment withdraws its text from public discussion, although a removal placeholder may remain. Under the default retention setting, text in the primary comment record becomes eligible for clearance after 90 days. Appeal periods, pending appeals and scheduled processing may extend retention. Copies contained in appeal records may remain after the primary comment record is cleared.
• Private notes. Deleting a note, or completing the local account-deletion process, removes the corresponding note record from the active application database.
• Notifications. Notifications are subject to expiry and count limits. Expired notifications are excluded from the account view; expiry does not itself constitute immediate deletion from every stored record.
• Authentication information. Sessions and verification challenges expire, are revoked or are consumed according to their purpose. Expired records covered by scheduled cleanup are removed through that process.
• Related records. Moderation records, appeals, audit records, page metadata and internal identifiers may remain after content or account deletion. Account or content deletion does not automatically erase every associated record, log or provider-held copy.

Deletion from active records is distinct from deletion from separate backup or service-provider systems. Any request concerning retained information may be submitted using the contact details in this Policy.

10. Privacy rights and account controls

Available account controls permit profile changes, management of social and notification preferences, deletion of supported content, data export and account deletion. The standard export includes profile information, comments, private notes, follow relationships and block or mute records. Additional information may be requested through the privacy contact.

Account deletion is subject to ownership verification. The local deletion process clears profile fields and local credentials, revokes local sessions, removes private notes, reactions and the relationship records covered by that process, and removes visible comments through the comment-deletion process. Internal identifiers, external authentication references and associated moderation, appeal, notification or audit records may remain. Deleting an echo. account does not automatically erase every record maintained by its authentication or hosting providers.

Depending on applicable law, rights may include access to personal information, correction, erasure, restriction, objection, portability and withdrawal of consent where processing is based on consent. These rights are subject to applicable conditions and exceptions. A complaint may be submitted to the competent data-protection authority where that right applies.

Requests may be submitted to support@echoextension.online. Information necessary to verify identity or the authority to act for another person may be required. Account restrictions or an inability to sign in do not prevent a request being submitted through that address.

11. Security and international processing

Security measures include hashed local passwords, session protections, account-scoped access and role-based administrative permissions. These measures do not eliminate all risks of unauthorized access, interruption or loss.

Information may be processed by service providers in countries other than the user’s country of residence. The location of processing depends on the provider and service function involved. Cross-border processing is subject to the requirements of applicable data-protection law.

12. Children

Account registration includes a declaration that the user is at least thirteen years old. Higher minimum ages or parental-authorization requirements under applicable law also apply. Questions or requests concerning a child’s personal information may be submitted through the privacy contact.

13. Changes to this Policy

This Policy may be updated to reflect changes to the Service, its information practices or applicable requirements. The revised date will be displayed on this page. Notice of material changes and any consent required by applicable law will be provided as appropriate.

14. Contact

The Service is operated by Alhassan Mohamed Sayed, an individual based in Egypt.

Privacy questions and requests may be submitted to support@echoextension.online.

Where Egyptian data-protection law applies, a complaint may also be submitted to the Egyptian Personal Data Protection Center.