← Home

Echo Privacy Policy

1. Introduction

Paper Star, Corp. ("we," "our," or "us") provides the Echo application and services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application and services.

2. Local and Cloud Data

Echo is an open-source application that requires an account. The desktop app stores notes, transcripts, summaries, and meeting data in Echo's local database and associated application files on your device. On mobile, Echo uploads completed recordings to its service and sends them to Soniox or ElevenLabs for transcription. Echo then sends the resulting transcript text to OpenAI to create your note and summary. File-based recording uploads are not retained after transcription. Supported notes, transcripts, summaries, meeting metadata, and non-recording attachments also sync automatically to your Echo account, subject to your plan's history limits. Raw meeting recordings are not uploaded by Cloud Sync. Separately, if the "Share recordings and notes to improve Echo" preference is enabled for your account, Echo retains a server-side copy of the audio from live hosted transcription sessions for product improvement, as described in Section 3.4. Hosted transcription and AI features require an internet connection. If you no longer wish to maintain your account, you can initiate account deletion in Echo's Settings or contact us atsupport@paperstar.cc.

3. Information We Collect

3.1 Information You Provide

We collect information that you directly provide to us, including:

In-app feedback may include the message and images you choose to submit, along with your account email, an internal account identifier, the Echo version, and the in-app entry point you used. We store this feedback in our cloud database and copy it to a private support channel in Slack so our team can review it.

3.2 Information Collected Automatically

When you use the Service, we may automatically collect:

Analytics and telemetry events are designed to avoid raw meeting audio, transcript text, note content, and summary text.

3.3 Desktop Calendar Connections

Connecting Google Calendar, Microsoft Outlook Calendar, or Apple Calendar is optional. Desktop Google Calendar access is read-only.

If you connect Google Calendar or Microsoft Outlook Calendar to Echo's desktop app, we use the Google Calendar API or Microsoft Graph, respectively, to collect and process the data needed to display your calendars and upcoming events in Echo and let you create personal notes and memos associated with those events. This may include:

For desktop calendar connections, we use connected calendar data to display calendars and upcoming events and to support the personal notes and memos you create for those events. The desktop app requests this data directly from Google or Microsoft. To display the same upcoming schedule in the web app, a signed-in desktop syncs a limited snapshot to Echo's servers: event titles, times, attendee names and email addresses, meeting links, calendar colors, and event identifiers from your selected calendars. This snapshot is private to your Echo account; joining a workspace does not share your calendar. Event descriptions and full provider responses are not included in this Home snapshot. When you use hosted transcription for an event-linked session, Echo may send the event title, description, location, and attendee names to the selected speech-to-text provider as keyword hints that improve recognition. When you use hosted AI from an event-linked note, Echo may include the event name in the note context sent to the model. If you ask a hosted AI model about your schedule, Echo may also send matching event titles, times, locations, meeting links, and descriptions so it can answer. We do not use connected calendar data for advertising, marketing personalization, sale to data brokers, or training generalized AI models. The use of information received from Google Workspace APIs adheres to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Apple Calendar requires macOS's full Calendar permission, but Echo does not currently use that access to create, edit, or delete events. Echo reads the calendar and event details described above from Apple Calendar, with the same uses and restrictions described in this section. Because macOS grants that permission to the Echo app rather than an individual Echo account, each Echo account must also connect Apple Calendar separately.

3.3a Hosted Google Calendar and Google Sheets Connections

When you connect a Google account to an Echo hosted managed agent, Echo uses Nango to manage the OAuth connection and relay Google Calendar and Google Sheets API requests. This is separate from the desktop calendar connection described above. Nango holds the Google OAuth grant and refresh tokens for this connection. Echo stores connection identifiers and status and processes calendar event data in its hosted service to detect changes that trigger your configured agent.

Depending on the permissions you grant and the agent you configure, a hosted agent can read calendar event details, create or update events, and read, create, or update spreadsheet content, such as CRM rows and meeting briefs. Calendar and spreadsheet data used by the agent is processed by Echo's hosted agents through third-party AI and runtime service providers and may become part of their session history and generated outputs. Configured workflows may send those outputs to destinations you authorize, such as a calendar event, spreadsheet, or review channel. The restrictions on the use of Google Workspace API data stated above also apply to these hosted Google connections.

3.4 Product Improvement Recordings and Notes

Echo accounts have a "Share recordings and notes to improve Echo" preference. It is enabled by default, applies across your signed-in devices, and can be turned off at any time in the desktop app's Settings. While it is enabled, we collect:

Sessions transcribed with on-device models never leave your device and are never collected this way, and dictation and file-based transcription uploads are not retained. Sharing is forward-only: it applies only to sessions that start while the preference is on. Nothing recorded before you enable it can be collected, and turning it off stops collection from your next session onward but does not automatically delete recordings already shared. The internal session identifier is used only to associate a shared recording with its session and is not sent to speech-to-text providers.

Shared recordings are stored in access-restricted cloud storage that has no in-app or API access — not even for the account that shared them — and can only be read with Echo's backend service credentials. They are deleted when your account is deleted, and you can request earlier deletion as described in Section 7.3.

4. How We Use Your Information

We use your information to:

5. Data Storage and Security

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. We use HTTPS/TLS to protect data transmitted over external networks. The operating system controls at-rest protection for data stored locally on your device, including any device-level encryption you enable.

For desktop calendar connections, calendar and event data is stored in Echo's local application database on your device. Google and Microsoft refresh tokens are stored in your operating system's credential vault and as an encrypted, account-scoped recovery copy in Echo's backend, so your calendar connection can be restored on another signed-in device. Echo retains credential-free disconnect records to prevent an older device from restoring a disconnected account. Calendar-derived keyword hints are sent only when you use hosted transcription for an event-linked session. Hosted AI may receive an event name from an event-linked note or matching event details when you ask about your schedule. Event context attached to a note may also be included in automatic Cloud Sync or content you choose to share. The web Home schedule uses the most recent desktop calendar snapshot and identifies older syncs; snapshots more than 24 hours old are no longer displayed. Disconnecting a calendar immediately prevents its snapshot from being displayed.

Apple Calendar data is stored in Echo's local application database on your device. Apple Calendar access is controlled by the operating system's Calendar permission. Echo's backend stores whether the current Echo account chose to connect Apple Calendar, so the operating system grant cannot silently carry across Echo accounts. Selected upcoming Apple events are included in the same private Home schedule snapshot described above; refreshing it requires a connected desktop with Calendar permission.

For hosted Google connections, Nango stores and refreshes the Google OAuth credentials. Echo stores connection metadata and calendar change-tracking records. Calendar event content used to start an agent run and the agent's resulting work may be retained in Echo's run records and hosted agent session history. Spreadsheet content used during a run may also be included in that session history and its outputs. These hosted connections do not rely on your device's credential vault.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

6. Data Sharing and Disclosure

6.1 We Do Not Sell Your Data

We do not sell, trade, or rent your personal information to third parties, including connected calendar data.

6.2 Service Providers

We may share your information with third-party service providers who perform services on our behalf, such as:

6.3 Connected Calendar and Google Sheets Data Sharing

When you connect Google Calendar or Microsoft Outlook Calendar to Echo's desktop app, we may share connected calendar data only:

For hosted Google connections, data passes through Nango to reach Google APIs and through Echo's hosted agents and their third-party AI and runtime service providers to carry out the agent tasks you configure. The agent may also send data or generated outputs to destinations you authorize in its workflow.

We do not sell connected calendar data or transfer it to third parties for advertising, marketing, or data broker purposes.

We do not permit employees, contractors, or other people to read connected calendar data unless you give explicit consent for support involving specific data, access is necessary to investigate a security issue or abuse, or access is required by applicable law.

We may disclose your information if required by law or in response to valid requests by public authorities (court orders or government agencies).

6.5 SMS Privacy

Mobile phone numbers, SMS opt-in data, and consent records will not be sold or shared with third parties or affiliates for marketing or promotional purposes. This restriction applies regardless of any other sharing described in this policy.

When you text Echo, we collect your phone number, the messages you send and their timestamps, and delivery and opt-out records. We retain your incoming message as a record of your request for replies to that conversation. We use this information to provide the customer-support and AI-assisted replies you request, maintain your consent preferences, and operate the service. We use AgentPhone and mobile carriers to deliver messages, and AI providers and Slack to prepare and review support replies. These providers process information on our behalf to provide the SMS service, not for their own marketing.

Texting Echo is optional and is separate from email marketing preferences. Reply STOP to cancel text messages, or contact support@paperstar.cc to withdraw consent, request access, or request deletion. We retain consent and opt-out records as needed to honor your choices and meet applicable legal obligations. Review the texting disclosures and phone number on our Text Echo page.

7. Your Rights and Choices

7.1 Access and Portability

Your notes are stored locally on your device and supported content also syncs to your Echo account. You can access notes in Echo and use Echo's export tools to create portable copies.

7.2 Correction and Deletion

You may initiate account deletion from Echo's Settings or request it by contacting us at support@paperstar.cc. Account deletion does not itself remove Echo's local application files from your device, but an account is required to use Echo.

7.3 Data Retention

For desktop Google Calendar or Microsoft Outlook Calendar connections, calendar and event data is retained locally on your device. Disconnecting deletes the provider credential from the operating system credential vault, stops future access, and removes the data from active calendar views after Echo refreshes, but underlying local records and event context already associated with notes may remain until you remove local Echo app data. You can also revoke Echo from your Google or Microsoft account settings. We delete cloud-stored data controlled by Paper Star, Corp. within 30 days of an applicable deletion request, except where required to retain it for legal purposes. In-app feedback and its image attachments remain associated with your account and are included in account deletion, including the copies mirrored to Slack.

Disconnecting a hosted Google connection prevents new agent runs from using that connection and starts removal of the connection from Nango. It does not automatically delete existing calendar events, spreadsheet edits, or previous agent outputs and session records. You can also revoke Echo's Google grant directly in your Google Account. Contact us to request deletion of cloud-stored data under the account-deletion terms above.

7.4 Analytics and Telemetry Controls

7.5 Connected Account Controls

In Echo's desktop app, you can choose which calendars Echo displays or disconnect an account from the Calendar sidebar. Disconnecting stops future access and syncs; it does not delete personal notes or memos you created. You can revoke Echo's access from your calendar provider. Permanently removing local calendar data currently requires removing all local Echo app data from that device.

You can revoke Apple Calendar for one Echo account in Echo's Calendar settings. You can also revoke device-wide Apple Calendar access in your operating system's Privacy & Security settings.

You can disconnect a hosted Google connection through Echo or revoke Echo's access in your Google Account. Pausing an agent stops new trigger-driven runs but does not revoke the Google connection.

7.6 Product Improvement Sharing Controls

You can turn "Share recordings and notes to improve Echo" off at any time in the desktop app's Settings. Turning it off stops collection from your next hosted transcription session onward. Recordings already shared are not automatically deleted when you turn the preference off, but you can request their deletion by contacting us at support@paperstar.cc, and they are deleted when your account is deleted.

8. International Data Transfers

Your information may be transferred to and maintained on computers located outside of your jurisdiction where data protection laws may differ. By using the Service, you consent to such transfers.

9. Children's Privacy

Our Service is not intended for children under 13. We do not knowingly collect personal information from children under 13.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the date above.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Paper Star, Corp.
Email: support@paperstar.cc