Privacy Policy

Last updated: October 19, 2026

Echoes ("the app") is made by Float Design LLC ("we", "us"). This policy explains what information the app and the echoes.am service collect, why, and what control you have over it.

The short version

We collect what's needed to run your account, library, and listening history, and nothing for advertising. Echoes has no ads, no ad networks, and no third-party analytics or tracking SDKs. We don't sell your information or share it with data brokers.

Information we collect

Account. When you first open the app, Echoes creates a guest account so your library can sync. If you sign in or create an account, we store:

• Your email address and a hashed password, or the identifier Apple provides if you use Sign in with Apple
• Your name and username

Your library. The collections, playlists, favorites, show notes, and follows (of artists and other people) you create.

Listening history. Which recordings you play, when, for how long, and your time zone offset. We use this for your listening stats and recently played shows.

Server logs. Like most web services, our servers record the IP address, time, and path of requests. We use these logs to keep the service running, debug problems, and prevent abuse.

What other people can see

Your name, username, the playlists and collections you make public, and the shows you've recently played appear on your profile, which other Echoes users can view and which you can share as a link. Playlists and collections you share with an invite link are visible to anyone who has that link.

On your device

Downloads, your library cache, and playback state are stored on your device. To make shows searchable in Spotlight and playable with Siri and CarPlay, the app shares show and recording details with your device's on-device search index. That index is managed by Apple and isn't sent to us.

Safari extension

If you turn on the optional Echoes Safari extension, it runs only on Internet Archive and Phish.in pages. It can't tell a concert from anything else until it asks, so when you open any Internet Archive item page, or a Phish.in show page, it sends us that page's identifier (for example, the archive.org item name in the address) to check whether Echoes has the show. It sends nothing else: not other sites you visit, the page's contents, or your account. These requests aren't tied to your account, but like any request they appear in our server logs with your IP address. The extension's only setting, whether to open shows automatically, stays on your device.

Service providers

We rely on a small number of providers to run Echoes, and share only what each needs:

• Apple, for Sign in with Apple and App Store distribution
• Postmark, to send account emails such as password resets
• Better Stack, to store server logs
• Cloudflare, to serve the echoes.am website and shared links

Recordings and some artwork are streamed directly from the Internet Archive and Phish.in, which receive a standard web request from your device, including its IP address and the file requested. We don't send them your account or any other information. Their own privacy policies apply to those requests.

Analytics & advertising

Echoes contains no advertising, no third-party analytics, and no crash-reporting SDKs. We don't track you across other apps or websites, and the echoes.am website doesn't set cookies. If you've chosen to share analytics with app developers in your device settings, Apple may send us anonymous crash reports.

Security

Data is encrypted in transit, and passwords are stored only as salted hashes. No system is perfectly secure, but we take reasonable measures to protect your information.

Your choices

• You can edit your name, username, and email in the app under Account.
• You can delete your account in the app under Account → Delete Account. This permanently deletes your playlists and collections and removes your name, email, username, and sign-in credentials. Any remaining listening history is no longer associated with any identifying information.
• You can remove downloads at any time, and deleting the app removes everything it stored on your device.
• You can ask us for a copy of your data, or ask questions about it, at the address below.

These choices are available to everyone, wherever you live. Depending on where you live, laws such as the GDPR or California's CCPA may also give you the right to access, correct, delete, or port your information, or to object to how we use it. Email us to make a request, and we'll respond within 30 days. We never sell or share your information for advertising.

Retention

We keep account and library information for as long as your account exists. Server logs are kept for a limited period and then deleted.

Children's privacy

Echoes is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we'll delete it.

Changes to this policy

If this policy changes, we'll update the "Last updated" date above and post the revised version at this address. We'll give clear notice before any change that reduces your rights over information we've already collected.

Contact us

Questions about this policy or your data can be sent to support@echoes.am.