Privacy Policy

Effective date: March 14, 2026 | Last updated: April 5, 2026

This Privacy Policy explains how EchoIndex Team (“EchoIndex”, “we”, “us”) collects and uses personal data when you use https://www.echoindex.io/ (the “Service”).

1. Controller and contact

Controller: EchoIndex Team
Address: Birkenstrasse 4, 52134 Herzogenrath, Germany
Email: team@echoindex.io
Privacy requests: team@echoindex.io

2. What data we collect

• Account data, such as your email address and authentication state, when you sign up or log in.
• Profile data you choose to save, currently limited to your display name.
• Technical and security data needed to serve the app and protect the service, such as timestamps, request metadata, and error logs.
• Authentication cookies and related session data managed through Supabase Auth.
• Saved article records associated with your account when you bookmark news while signed in.
• Communications you send to us, including support and correction requests.

3. Purposes and legal bases

• Providing the service and essential functionality, including login, profile updates, and protected pages.
• Security, abuse prevention, fraud detection, and service integrity.
• Operating and improving the product, including debugging algorithmic or data-quality issues.
• Responding to support and policy requests.
• Complying with legal obligations.

Depending on the processing activity, legal bases may include contract performance, legitimate interests, consent, and legal obligation.

4. Current service-specific notes

• Profile records are stored in a `profiles` table and are intended to be readable and writable only by the signed-in user through row-level access controls.
• Saved article records are stored in a `saved_articles` table and are intended to be readable and removable only by the signed-in user through row-level access controls.
• EchoIndex currently uses Supabase for authentication flows such as signup, login, password reset, and email confirmation.
• We do not currently describe the service as running a first-party advertising or analytics cookie stack in this app. If that changes, this policy and related controls should be updated.

5. Sharing and recipients

We may share personal data with hosting and infrastructure providers, Supabase authentication and database services, support providers, and competent authorities where required by law.

6. International transfers

If personal data is transferred outside the EEA/UK, we rely on applicable safeguards such as adequacy decisions or Standard Contractual Clauses, where required.

7. Retention

We retain personal data only as long as necessary for the purposes described above and applicable legal requirements.

As a general rule, account and profile data may remain associated with your account until the account is deleted or the data is changed, unless a longer retention period is required for legal, security, or abuse-prevention reasons.

8. Your rights (EEA/UK)

Subject to applicable law, you may have rights to access, rectify, erase, restrict processing, object to processing, data portability, and withdraw consent where processing is based on consent. You may also lodge a complaint with a supervisory authority.

9. Your rights (California)

If EchoIndex is subject to CCPA/CPRA for your use case, California residents may have rights to know, delete, correct, and opt out where applicable.

10. Security

We implement reasonable technical and organizational measures to protect personal data. No method of transmission or storage is completely secure.

11. Changes to this policy

We may update this policy. We will update the “Last updated” date and provide additional notice for material changes where required.