Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account information: your email address and authentication credentials (handled by our auth provider, Supabase).
• Profile information: your first name, date of birth, target audience, and focus areas — collected during onboarding to personalize your questions.
• Your Content: the transcripts of your voice answers, the AI-generated questions shown to you, and AI-polished versions of your transcripts (Pro accounts only).
• Derived context: summary insights (themes, people mentioned, key life events) extracted from your entries and used to generate more relevant future questions.
• Billing information: for paid accounts, we store a Stripe customer identifier and subscription status. We donot store your credit card number — Stripe handles that.
• Usage data: basic technical information such as request logs, timestamps, and the duration of audio you transcribe (used to enforce the fair-use cap described in our Terms).

2. Audio Recordings

This is the most important thing to know about Etch: we do not retain your audio recordings. When you record an answer, the audio file is streamed to our transcription provider (OpenAI Whisper), converted to text, and then discarded. The raw audio never touches our database or file storage and is not retained by us after transcription. What we keep is the resulting text transcript.

Your transcript, AI-polished transcript, entry metadata, and derived context are stored in Supabase so Etch can show your private vault and generate more relevant questions. In other words: Etch stores your written story data, not your voice recording.

3. How We Use Your Information

We use the information we collect to:

• provide, maintain, and improve the Service;
• generate personalized daily questions based on your profile and prior entries;
• polish transcripts for readability (Pro accounts);
• process subscription payments through Stripe;
• prevent abuse and enforce the fair-use provisions in our Terms;
• communicate with you about your account or the Service;
• comply with legal obligations.

We do not sell your personal information, and we do not use your content to train third-party AI models.

4. Third-Party Service Providers

We rely on a small set of trusted service providers to operate Etch. They process data on our behalf under contractual confidentiality and security obligations:

• Supabase — authentication and database hosting.
• Vercel — application hosting.
• OpenAI — audio transcription (Whisper).
• Google — question generation and transcript polishing (Gemini).
• Stripe — payment processing.

Each of these providers has its own privacy policy governing their handling of the data we share with them.

5. What Private Means

Etch is private in the sense that your account content is not public, is protected by account authentication and database row-level security, and is not sold or used to train third-party AI models. Etch is not currently end-to-end encrypted: authorized service providers and a very small number of operators may process or access data when necessary to run, secure, debug, or support the Service.

6. Data Retention

We retain Your Content for as long as your account is active. If you delete your account, we will delete Your Content and personal information within 30 days, except where we are required by law to retain it or where it is contained in routine backups (which are overwritten on a rolling basis).

7. Your Rights

Depending on where you live, you may have rights to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email us at hello@myetch.app. We will respond within 30 days.

8. Security

We use industry-standard safeguards to protect your data, including encryption in transit (HTTPS) and at rest, row-level security policies in our database, and limited access to production systems. No system is perfectly secure, so we cannot guarantee the security of any information, but we work to protect it as if it were our own.

9. Children's Privacy

Etch is not directed to children under 18, and we do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete it.

10. International Users

Etch is operated from the United States. If you access the Service from outside the United States, you understand and consent to the transfer of your information to, and processing in, the United States, which may have different data protection laws than your country.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 14 days before the change takes effect.

12. Contact

Questions about this Policy? Email hello@myetch.app.