Last updated: 1 April 2026 · Effective: 1 April 2026
Pratesh John Mathew ("Ekcho"), operating individually, is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Data Controller under the GDPR (for EU/EEA users).
Contact our Data Protection Officer: privacy@ekcho.net
When you register, we collect your chosen voice name and a password (stored as a bcrypt hash — we never see your actual password). We do not require your real name, email address, phone number, or date of birth. We generate an internal pseudonymous email address for your account which is never shown to you or anyone else.
When you broadcast, your audio recording is uploaded and stored on Supabase Storage (servers in the EU or as configured by our Supabase project region). Your audio is processed by OpenAI Whisper to generate a text transcript for content moderation purposes. The transcript is stored alongside your broadcast.
We record which broadcasts you have listened to, your playback position, and whether you completed a broadcast. This is used to provide session memory (resume where you left off) and to generate completion statistics for broadcasters. This data is associated with your account, not your real identity.
Messages sent between users ("notes") are stored in our database. They are only accessible to the participants in that conversation. We do not read your private messages except as required for moderation investigations following a report.
If you and another user mutually agree to unmask, the personal detail you choose to share (e.g. a first name or city) is stored permanently and is visible only to the person you shared it with. You control what you share and when.
If you purchase Ekcho Pro or Credits, payments are processed by Lemon Squeezy. We receive confirmation of your payment and your subscription status but we do not receive or store your payment card details. Lemon Squeezy's privacy policy applies to payment processing.
We collect IP addresses (for rate limiting and security), browser type, device type, and access logs. These are stored for up to 90 days and used for security purposes only.
Content moderation scores (from OpenAI Moderation API) are stored alongside broadcasts. If a broadcast is flagged or removed, we retain the moderation record for 2 years for accountability purposes.
Under the DPDP Act 2023 and GDPR, we process your data on these bases:
| Data type | Retention period |
|---|---|
| Account profile | Until you delete your account + 30 days |
| Voice recordings | Until you delete the broadcast + 30 days |
| Transcripts | Same as broadcast |
| Listening history | Until account deletion |
| Private messages | Until account deletion or mutual deletion |
| Unmask details | Permanent (by design — cannot be unseen once shared) |
| Payment records | 7 years (Indian financial regulations) |
| Moderation records | 2 years |
| Security logs (IP) | 90 days |
We do not sell your personal data. We share data only with:
Ekcho is incorporated in India. Your data may be transferred to and stored in servers outside India (EU via Supabase, USA via OpenAI). These transfers are governed by Standard Contractual Clauses (SCCs) and Data Processing Agreements. For EU users, these transfers comply with GDPR Chapter V.
As a Data Principal under the DPDP Act 2023, you have the right to:
To exercise any of these rights, contact: privacy@ekcho.net. We will respond within 72 hours.
If you are in the EU or EEA, you additionally have the right to:
Ekcho is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, please contact us at trust@ekcho.net and we will delete the account immediately.
Users aged 13–17 may use Ekcho with parental consent. We take additional care with content moderation for interactions involving minors.
We protect your data using encryption at rest and in transit (TLS 1.3), Row Level Security (RLS) in our database ensuring each user can only access their own data, bcrypt password hashing, rate limiting on all authentication endpoints, and regular security audits.
In the event of a data breach affecting your personal data, we will notify you and the relevant authorities within 72 hours as required by the DPDP Act.
As required under the Information Technology Act, 2000 and DPDP Act 2023, our Grievance Officer is:
Name: Pratesh John Mathew
Designation: Grievance Officer
Email: grievance@ekcho.net
Email: info@ekcho.net
Response time: Within 72 hours of receipt of complaint
We will notify you of material changes to this Privacy Policy at least 14 days before they take effect, via in-app notification. The latest version is always available at ekcho.net/legal/privacy.