Privacy Policy

Overview

Echo is a personal AI assistant developed by Phantom Core. This policy explains what data Echo accesses, how it is used, and how it is stored. Echo is built with a local-first philosophy - your data stays on your device wherever possible.

Data We Access

Echo may access the following data depending on which features you enable:

• Microphone - Voice input for AI conversations. Audio is processed in real-time and is not stored or recorded.
• Camera - Optional face authentication for the Vault security system. Facial descriptors are stored locally on your device only and never transmitted.
• Screen capture - Optional screen sharing for vision-based AI tasks. Frames are processed in memory and not saved to disk.
• Gmail - Read, draft, and send emails on your behalf when you request it. Echo only accesses Gmail when you give an explicit command. We request the minimum required scopes: gmail.send, gmail.readonly, and gmail.compose.
• Connected Android device - When you connect a phone via ADB, Echo can read device telemetry (battery, storage, model) and execute commands you request. No phone data is stored by Echo.
• File system - Echo may read or write files on your PC when you request file-related tasks. Echo does not access files without an explicit instruction.
• System information - CPU, RAM, and OS data is read locally to display system metrics. This data is never transmitted.

Data Storage

All data stored by Echo lives on your local machine in your OS user data directory. This includes:

• Conversation history and AI memory (stored locally)
• API keys, encrypted using your OS's secure storage (Windows Credential Store / macOS Keychain)
• Vault PIN hash and facial biometric descriptor (stored locally, never transmitted)
• Gmail OAuth token (stored locally in your user data folder)
• Connected device history (stored locally)

Third-Party Services

Echo uses the following third-party APIs to provide its functionality:

• Google Gemini API - Powers the AI conversation engine. Your messages are sent to Google's servers for processing. See Google's Privacy Policy.
• Gmail API - Used to read, draft, and send emails when requested. Governed by Google's Privacy Policy.

Echo does not use analytics, advertising networks, or any other third-party data collection services.

Biometric Data

If you enable face authentication, Echo uses your camera to generate a facial descriptor - a numerical representation of your face. This descriptor is stored exclusively on your local device and is never transmitted to Phantom Core or any third party. You can delete this data at any time by resetting your Vault in Echo's settings.

Children's Privacy

Echo is not intended for use by individuals under the age of 13. We do not knowingly collect personal data from children.

Changes to This Policy

We may update this policy as Echo's features evolve. The effective date at the top of this page will reflect the most recent revision. Continued use of Echo after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this policy or how Echo handles your data, contact us at [email protected] or visit phantomcore.uk.