Skip to content

Privacy Policy

Echo Automation Privacy Policy

Your privacy is important to us. It is Echo Automation's policy to respect your privacy and comply with applicable laws and regulations regarding any personal information we may collect about you, including through our desktop application Echo and its associated services.

"Personal information" means any information about an identifiable individual. This can include information about you as a person (such as name and email address), your devices, your license status, and information about how you use our app and online services.

If our app or website links to third-party sites or services, please be aware that those sites and services have their own privacy policies. Once you follow a link to any third-party resource, their privacy practices will apply to your use of those services. This Privacy Policy does not apply to your activities on third-party sites or services.

This policy is effective as of December 9, 2025

Last updated: December 9, 2025

Information We Collect

Information we collect falls into two broad categories:

Voluntarily provided information – information you knowingly and actively provide to us when using Echo or interacting with us.

Automatically collected information – information that is automatically sent by your device or the app when certain features are enabled.

We describe each category in more detail below.

Automation Data and Macro Content

Echo is a desktop automation tool that records and replays mouse and keyboard actions and may use image or text recognition to locate elements on your screen. Because of the sensitive nature of what you may automate, Echo is designed so that your automation content stays on your device by default.

What stays on your device by default

The following data is stored locally on your computer and is not sent to our servers unless you explicitly choose to share it (for example, in a support request):

  • Macro recordings, including mouse and keyboard events, timings, and playback settings
  • Any images you add for image-based automation
  • Text recognized from your screen during OCR operations
  • Your local configuration, settings, and macro database (for example, ~/.echo/macros.db or the Windows equivalent)

We do not transmit macro content or screenshots to our servers as part of normal operation. We only collect high-level usage statistics and technical telemetry, and only if you enable those options (see "Telemetry, Usage Statistics, and Crash Reports" below).

When automation data could be sent to us

If you send us a bug report and explicitly choose to include logs, Echo may attach local log entries containing technical information about the error and how the app was used. These logs are not designed to contain full macro content but may include macro names or file paths you have chosen.

If we later introduce a cloud backup or sync feature, we will clearly explain what data is uploaded and provide settings to enable or disable it.

Telemetry, Usage Statistics, and Crash Reports

Echo can optionally send anonymous usage statistics and crash reports to help us understand how the app is used and to improve stability and performance. These features are opt-in and can be enabled or disabled in the app settings.

Usage Statistics (anonymous, optional)

If you enable "Send anonymous usage statistics", Echo sends high-level information about how the app is used. We track events such as:

  • App start and app close
  • When a macro is recorded
  • When a macro is played
  • When image recognition is used
  • When OCR (text recognition) is used
  • When the app theme is changed

Each usage event typically includes:

  • client_id – a randomly generated UUID that identifies your installation, not linked to your real name or email
  • event_name – for example, app_start, macro_recorded, macro_played, image_recognition_used, ocr_used, theme_changed
  • app_version – for example, 1.6.3
  • os and os_version – for example, Windows 10, 10.0.26200
  • created_at – a timestamp (UTC)
  • Event-specific properties, such as:
    • macro recording: number of events in the macro and duration in milliseconds
    • macro playback: duration, loop mode, and timing mode
    • image recognition/OCR: approximate search region (screen coordinates), threshold or language settings
    • theme change: selected theme identifier

Usage statistics do not include:

  • Macro names or macro steps
  • Exact recorded mouse coordinates or keystrokes as part of your macros
  • Screenshots, images, or recognized text content
  • Files or documents from your computer
  • Passwords, credentials, or browser history

We use this data in aggregate to understand which features are used, improve performance, debug issues, and prioritize future development.

Crash Reports (optional)

If you enable "Send crash reports", Echo can send technical error reports to us when the app encounters an unhandled exception or serious failure. Crash reports may include:

  • client_id (the same random UUID described above)
  • Error type and message (for example, MemoryError, AttributeError)
  • Stack trace (code locations and call stack at the time of the error)
  • App version, operating system and version, and Python runtime version
  • Additional diagnostic context we attach to help reproduce the issue
  • A timestamp (UTC)

Crash reports are not designed to capture macro content or screen content, and we do not intentionally collect passwords, credentials, or the contents of your files. However, as with any diagnostic data, there is a small possibility that technical context may reflect macro names, file paths, or window titles involved in the error.

You can disable usage statistics and crash reporting at any time in the app settings. Disabling these options stops Echo from sending new telemetry data but does not affect data already collected.

Feedback, Bug Reports, and Support

When you choose to send us feedback or a bug report from within Echo or by email, we collect the information you provide so that we can respond and improve the product. This may include:

  • Feedback type (for example, feedback or bug report)
  • Title and description of your message
  • Steps to reproduce an issue, expected behavior, and actual behavior (for bug reports)
  • Optional category and severity level
  • Whether you chose to include logs from your device
  • Optional contact details such as your name and email address, if you decide to provide them
  • Basic technical information such as app version and operating system
  • A timestamp (UTC)

If you check the option to include logs, we may receive additional local log entries containing technical context around the issue. These logs are not designed to contain full macro content but may include macro names or file paths that you have chosen.

We use feedback and bug reports solely to provide support, diagnose problems, and improve Echo.

Personal Information We May Collect

In addition to telemetry and support information, we may ask for personal information in situations such as account registration, license purchasing (when applicable), or direct communication. This may include:

  • Name
  • Email address

You may also voluntarily provide additional information in free-text fields (for example, in feedback or bug reports). Please avoid including sensitive information unless it is strictly necessary for support.

We treat these details as personal information and protect them as described in this policy.

License Activation and Validation Data

Echo is licensed software. To prevent unauthorized sharing of license keys and to enforce device limits, the app communicates with our licensing service and sends certain information necessary for license activation and validation. This data is always collected when you activate or validate a license and is required for the app to function beyond any trial period.

The information sent for license activation and validation includes:

  • License key you have entered
  • A hardware identifier derived from your device (for example, a SHA-256 hash based on hardware attributes such as CPU serial, motherboard ID, or network adapter)
  • Machine name (computer name)
  • Operating system details
  • Echo app version
  • Timestamp of the last validation
  • IP address used for the request (for security and abuse prevention)

We use this information to:

  • Verify that a license key is valid and has not exceeded permitted device or user limits
  • Prevent fraudulent or abusive license key use
  • Maintain accurate records of active installations for billing and support

We do not use license activation data to inspect your macros or other content on your device.

Legitimate Reasons for Processing Your Information

We only collect and use personal information when we have a lawful and legitimate reason to do so. These reasons may include:

  • Providing and maintaining Echo and its core features
  • Fulfilling our contractual obligations (for example, providing licensed access)
  • Improving stability, performance, and user experience
  • Responding to support requests and communications
  • Protecting our rights, preventing fraud, and ensuring security
  • Meeting legal or regulatory obligations

We only collect personal information that is reasonably necessary for these purposes.

Security of Your Personal Information

We take reasonable technical and organizational measures to protect your personal information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction.

However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of any passwords or authentication methods associated with your use of Echo and any related accounts.

How Long We Keep Your Personal Information

We keep personal information only for as long as necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law.

For example:

  • License data and account-related information may be retained while your license or account is active and for a reasonable period afterward for billing, security, and legal purposes.
  • Telemetry and crash report data may be retained for a limited period for analysis and product improvement.
  • Feedback and support communications may be retained for a reasonable period to track issues and improve service.

When personal information is no longer required, we will delete it or anonymize it so that it can no longer be used to identify you.

Children's Privacy

Echo and our services are not directed at children under the age of 13, and we do not knowingly collect personal information about children under 13. If we become aware that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete that information.

Disclosure of Personal Information

We may disclose personal information to:

  • Our employees, contractors, and related entities who need access to perform their duties
  • Service providers and third-party partners who assist us in operating Echo, processing data, or providing related services
  • Professional advisors (such as lawyers or accountants), where necessary
  • Courts, law enforcement agencies, regulators, or other authorities when required by law or in connection with legal claims
  • A purchaser or successor in the event of a merger, acquisition, or similar business transaction (see "Business Transfers" below)

We require our service providers to use personal information only for the purposes we specify and to protect it in accordance with applicable privacy laws.

Third-Party Service Providers

We use trusted third-party service providers to host our backend services, store certain types of data, and distribute software updates. These providers only have access to the information they reasonably need to perform their functions and are contractually or legally obligated not to use it for other purposes.

Supabase

  • Purpose: Cloud database and backend services used to store telemetry, crash reports, feedback submissions, license activation data, and related technical information.
  • Data processed: The telemetry, crash, feedback, and licensing data described in this policy.
  • Location: Southeast Asia
  • Privacy policy: https://supabase.com/privacy

GitHub

  • Purpose: Hosting Echo releases and update files for download.
  • Data processed: GitHub does not receive telemetry or macro content directly from the Echo app. When you download updates from GitHub via your web browser, GitHub may process data such as your IP address and browser information, in accordance with its own privacy policy.
  • Privacy policy: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement

We do not currently process payments inside the Echo app and do not collect or store your payment card details ourselves. If we later integrate payment processors (such as PayPal, Google Pay, or Apple Pay), we will update this section to identify those processors and explain how your payment information is handled.

What We Do Not Collect

Unless you voluntarily provide it (for example, in a feedback form or email), we do not collect:

  • Your real name, postal address, or phone number (outside of support or account contexts)
  • Credit card or payment details (these are handled by external payment processors, when used)
  • Macro content, macro steps, or the specific actions you automate
  • Screenshots or full screen content
  • Keyboard input or typed text from your macros
  • Passwords or credentials
  • Files or documents stored on your computer
  • Precise location data
  • Your contacts or address book
  • Data from your social media accounts (other than public mentions you make yourself)

Your Rights and Controlling Your Personal Information

Depending on your location and applicable law, you may have the right to:

  • Access – request details of the personal information we hold about you.
  • Correction – request that we correct information that is inaccurate, incomplete, or outdated.
  • Deletion – request that we delete your personal information, subject to legal or contractual requirements.
  • Restriction/Objection – object to or request the restriction of certain processing.
  • Data portability – request a copy of certain personal information in a structured, commonly used, and machine-readable format.

You may also:

  • Withdraw consent where processing is based on consent (for example, telemetry settings) without affecting the lawfulness of processing before withdrawal.
  • Opt out of direct marketing communications by using the unsubscribe link in emails or by contacting us.

If you wish to exercise any rights, please contact us using the details in the "Contact Us" section below. We may need to verify your identity before fulfilling your request.

We will not discriminate against you for exercising your rights over your personal information.

Business Transfers

If we or our assets are acquired, or in the unlikely event that we cease operations or enter bankruptcy, personal information may be transferred to a third party as part of the business assets. Any acquiring party will be required, to the extent permitted by applicable law, to continue to use your personal information in a manner consistent with this Privacy Policy (or provide a compatible successor policy).

Limits of Our Policy

Echo and our website may link to external sites and services that are not operated by us. We have no control over the content or privacy practices of those sites and cannot accept responsibility or liability for their policies. We encourage you to review the privacy policies of any third-party sites or services you use.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, technology, or legal requirements.

When we make changes, we will:

  • Post the updated policy at the same location where you accessed this one; and
  • Update the "Last updated" date at the top of this document.

If changes are significant or required by law, we may also notify you by email (if we have your address) or via in-app notifications and, when required, ask for your consent to new uses of your personal information.

Additional Disclosures for U.S. State Privacy Laws

Certain U.S. state privacy laws (including those of California, Colorado, Delaware, Florida, Virginia, and Utah) grant residents specific rights over their personal information. If you are a resident of one of these states, this section applies to you in addition to the rest of this Privacy Policy.

Categories of Personal Information We Collect

In the preceding 12 months, we may have collected the following categories of personal information (as defined in applicable state privacy laws):

  • Identifiers (such as name, email address, IP address, client_id, license key, and an identifier assigned to your account or installation)
  • Internet or electronic network activity information (such as usage events and crash data related to your use of Echo)
  • Commercial information (such as license status and transaction history, when applicable)
  • Inference or profile information to the limited extent that we analyze telemetry data to understand feature usage and improve the product

We collect these categories of personal information for the purposes described in this policy, including providing and improving Echo, securing our services, and complying with legal obligations.

We do not sell your personal information as that term is defined under applicable state laws, and we do not share your personal information with third parties for their own independent marketing purposes.

Right to Know, Access, and Delete

Subject to certain limitations, you may have the right to:

  • Request that we disclose the categories and specific pieces of personal information we have collected about you;
  • Request information about the categories of sources from which we collected personal information, the purposes for which we collected it, and the categories of third parties with whom we share it;
  • Request deletion of personal information we have collected from you, subject to legal and contractual requirements.

To exercise these rights, please contact us using the details in the "Contact Us" section and indicate that your request relates to state privacy law rights. We may need to verify your identity to process your request.

We will not provide your personal information to you or delete it if we cannot verify your identity or if an exception under applicable law applies.

Do Not Track

Some browsers offer a "Do Not Track" (DNT) setting that signals to websites that you do not wish to be tracked. At this time, we do not respond to DNT signals. We will continue to review evolving standards and may update our practices if appropriate.

Contact Us

For any questions, requests, or concerns regarding your privacy or this policy, you may contact us at:

Echo Automation
Operated by Echo Automation
Email: support@echo-automation.io
Website: https://echo-automation.io