How EchoMe handles your data

1. Overview

EchoMe (“EchoMe,” “we,” or “us”) is a closed-beta tool that drafts AI-generated replies to Instagram DMs and comments in your own voice. You review and approve every reply before it's sent — EchoMe never posts to your followers on its own. This policy explains what data we collect, how we use it, and the choices you have.

2. Information we collect

• Account information— your email address and name, via Supabase Auth (or Google sign-in, if you use it).
• Instagram data— once you connect an Instagram Business or Creator account through Instagram's official Business Login, we access your profile basics (handle, follower count, avatar), the DMs and comments you receive, and the replies you approve, edit, or send.
• Voice & persona data— the tone description and example reply pairs you provide so EchoMe can draft in your voice.
• Usage data— basic product analytics such as login activity and draft approve/edit/reject actions, used to operate and improve the product.

3. How we use your information

• Generate AI-drafted replies to your incoming DMs and comments.
• Learn and refine your voice profile from the examples you provide.
• Show you dashboard insights about your account and reply activity.
• Send you email notifications when new drafts are waiting for review.
• Detect spam, abuse, or activity that violates these terms.

4. AI processing

To generate a draft, the incoming message text (and, for comments, the related post caption) is sent to our AI provider — primarily Anthropic's Claude API, with Groq used as an automatic fallback if Anthropic is unavailable. These providers process the text to generate a draft reply; they do not use it to train their own models under our agreements with them. No draft is ever sent to your followers without your explicit approval.

5. Data storage & security

Your data is stored in a Postgres database hosted by Supabase. Instagram access tokens are encrypted at rest (AES-256-GCM) before storage and are never stored or logged in plaintext. The application itself is hosted on Vercel.

6. Data sharing

We do not sell your personal data. We share data only with the service providers that operate EchoMe — Supabase (database/auth), Anthropic and Groq (AI drafting), Resend (email notifications), Vercel (hosting), and Sentry (error monitoring) — each bound to use it only to provide their service to us, or as required by law.

7. Data retention

Your persona, examples, and message history are kept while your account is active. If you disconnect Instagram, your access token is deleted immediately (within 24 hours at the outside). See our Data Deletion page for how to request removal of your account data.

8. Your choices

You can disconnect your Instagram account at any time from Settings → Connected accounts. You can request a copy or deletion of your data at any time — see Data Deletion.

9. Children's privacy

EchoMe is not directed at children and we do not knowingly collect data from anyone under 13.

10. Changes to this policy

We may update this policy as EchoMe evolves. We'll update the “Last updated” date above when we do.

11. Contact

Questions about this policy or your data? Email support@echomeapp.com.