Privacy Notice

1. Who We Are

EchoWithin ("we", "us") provides encrypted personal notes, collaborative notes, direct messaging, Bonds (pair relationship spaces), communities, forms, and multiplayer games. For the purposes of the Kenya Data Protection Act, 2019 (DPA), EchoWithin is the data controller for the personal data you provide to us.

Privacy questions and requests can be sent through the contact form on our About page or by email to [email protected].

2. Data We Collect

• Account data: username, email address, password (stored hashed), date of birth, and profile details you choose to add (bio, avatar, links).
• Content you create: personal notes, shared notes, blog posts and comments, direct messages, voice notes, images, community posts, forms and responses, and game content.
• Bonds data: shared habits, countdowns, calendar events, goals, journal entries, photo albums, mood logs, and Question of the Day answers (encrypted at rest with per-bond keys).
• Technical data: session/device information, approximate location derived from IP address at login, push subscription tokens, and security/audit logs.
• Payment data: premium subscription status and payment reference. Card details are handled by our payment processor and never stored on our servers.

3. Sensitive Personal Data

Some features process data that the DPA treats as sensitive personal data, including health data (the daily Mood Tracker) and marital/family status (Bonds relationship type and shared journal). We process this data only with your explicit consent, only for the feature you choose to use, and always encrypted at rest. You can remove this data at any time from the relevant feature or by deleting your account.

4. How We Use Your Data & Lawful Bases

• Contract: creating and operating your account and the features you request.
• Consent: sensitive data (mood, relationship, journal), marketing emails, and non-essential cookies. You may withdraw consent at any time.
• Legitimate interests: security, fraud and abuse prevention, service reliability, and moderation of public content.
• Legal obligation: responding to lawful requests and maintaining required records.

We do not sell your personal data. We do not use the contents of your encrypted private notes, DMs, Bonds journals, or Whisper sessions for advertising or profiling.

5. Sharing & Third-Party Processors

We share personal data only with service providers that help us run the platform, acting as data processors under contract. These include hosting, database, media storage, search, email delivery, push notification, payment, and AI moderation/assistance providers. A current list of processors, their purpose, and their data location is maintained in our Processor & Transfer Register and is available on request.

6. International Data Transfers

Some of our processors store or process data outside Kenya. Where personal data leaves Kenya, we rely on a lawful transfer basis (appropriate safeguards such as standard contractual clauses, or your consent for sensitive data) and we keep a record of each transfer, its destination, and the safeguards applied, in line with the DPA and the ODPC Guidance Notes on Cross-Border Data Transfers.

7. How Long We Keep Data

We keep personal data only as long as necessary for the purpose it was collected, then delete or anonymise it. Deleted accounts are removed from live systems immediately and from encrypted backups within the backup retention window (currently 3 days). Whisper Mode sessions are ephemeral and are permanently erased when the session expires. A detailed retention schedule is maintained internally and available on request.

8. Your Data Protection Rights

Under the DPA you have the right to:

• be informed about how your personal data is used;
• access your personal data (download it from Account Settings → Export);
• correct inaccurate data (Account Settings);
• delete your data / erase your account (Account Settings → Delete Account);
• port your data (JSON export);
• object to or restrict processing;
• withdraw consent at any time.

To exercise a right you cannot do in-product, email [email protected]. We respond within the timelines set by the DPA.

9. Children

EchoWithin is not intended for children under 13. Users aged 13 to 17 may use the service only with the consent of a parent or guardian, which we verify before the account can be used. Where a child's data is processed, we apply the protections required by the DPA and the Children Act, 2022.

10. Cookies & Analytics

We use strictly necessary cookies for login sessions and security (these are always on). Analytics and marketing cookies are used only with your consent. You can change your choices at any time.

Manage cookie preferences

11. Security

• Encryption at rest for notes, DMs, Bonds journals, form responses, and more, using per-user and per-bond keys managed by EchoWithin. Content is accessible only to your authenticated session.
• HTTPS with HSTS, Content Security Policy, CSRF protection, and rate limiting.
• Encrypted media is served through signed, time-limited capability URLs.
• Personal data breaches that pose a risk are assessed and reported to the ODPC within 72 hours of becoming aware, and affected users are notified where required.

12. Complaints

If you are not satisfied with how we handle your data, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) via odpc.go.ke or cie.odpc.go.ke.