Echotok privacy notice
Effective October 9, 2026. Echotok is an independently operated beta based in Canada. Contact the operator responsible for privacy at echotok.live@gmail.com.
What we collect and why
We assign a random guest identity and use an essential session cookie to connect calls, keep blocks working, and prevent abuse. Our servers receive browser, language, and network information. The application uses a hash derived from those signals for rate limits; it is a pseudonymous identifier, not guaranteed anonymous data. We also keep your declared country, adult confirmation, queue and call timestamps, connection outcomes, reports, blocks, and feedback to operate and improve the beta.
Voice and in-call text travel through LiveKit. We do not record calls or store the live text in our database. Your conversation partner can still record or copy what you share, so avoid identifying or sensitive information. Encryption in transit does not make you anonymous to service providers.
The optional voice estimate runs on your device. If you opt in, we save an uncertain voice category and consent time. It does not verify gender. You can withdraw it by deleting your guest identity or contacting support.
How long we keep it
Daily cleanup is enabled for recognized operational events and ended call history after 30 days, and reports and related moderation metadata after 180 days. Active calls are excluded. Blocks and saved account/friend relationships are not removed by age-based cleanup. Essential session tokens expire after 30 days. Feedback, unclassified records and guest profiles do not yet have automatic age-based deletion. Contact support to request access, correction or deletion. Provider backups follow the providers’ retention practices.
A private Google spreadsheet of aggregate daily and hourly traffic totals is planned. It is not yet receiving daily data. Individual identifiers, guest handles, report text, and conversations must not be exported to it.
Service providers and international processing
OpenAI Sites and Cloudflare host the website, Supabase stores application data in a US region, LiveKit carries calls and messages, and Google stores the private aggregate spreadsheet and support email. These providers process service and security data under their own terms, including infrastructure logs and backup retention. We do not sell personal information or use advertising trackers. Deletion from the live database does not instantly erase provider backups; restored data must have deletion rules reapplied before use.
Your choices and requests
Visit Support & privacy controls to request deletion; self-service deletion is not yet available. Call and report records involving other people can remain for the periods above. For access, correction, deletion, consent withdrawal, or a privacy complaint, contact support with your guest handle and approximate dates. Never send your password or identity documents unsolicited. We may need to verify control of the browser identity or account before disclosing personal data. We aim to respond within 30 days and will explain any permitted extension.
This beta is for adults aged 18 or older using the service in Canada or the United States. Eligibility uses your country declaration; it is not identity or location verification. Contact support about suspected underage use. Calls can be ended or reported at any time.