EchoLike Privacy Policy

Last updated: October 17, 2026

EchoLike ("we") makes the EchoLike browser extension and the EchoLike inbox at echolike.app. This policy explains what the extension collects, how it is protected and what we do with it.

The short version

• The extension only acts when you click Like, Bookmark, ✎ (note) or 🎙 (voice note) on x.com.
• Every event is encrypted in your browser (AES-256-GCM) before it leaves your device. The relay that carries it cannot read it.
• We don't sell your data, show ads, or track you across websites.

What the extension collects

When you like or bookmark a post on x.com / twitter.com:

• the post's ID, link, author handle, visible text and publication time;
• the action (like, unlike, bookmark, remove bookmark) and the time you clicked.

Only if you choose to add them:

• a written note you type in the EchoLike note box (up to 4,000 characters);
• a voice note you record with the 🎙 button (up to 60 seconds of audio). The microphone is only used while you are recording, and your browser asks for permission first.

Technical data:

• a heartbeat every 30 minutes and an optional "Send test" event, so your inbox can show whether the extension is connected;
• delivery status of your last 20 events (queued, sent, received, error).

The extension does not collect your X password or cookies, your direct messages, your browsing history, or anything from websites other than x.com / twitter.com.

How it is protected

• When you connect the extension, your browser receives a secret relay topic and a 256-bit encryption key. They are stored only in your browser's extension storage (chrome.storage.local).
• Each event is encrypted with that key (AES-256-GCM) inside your browser, then published to your secret topic on ntfy.sh, a public message relay. ntfy.sh only sees unreadable ciphertext, plus the network metadata any web request carries (such as IP address, time and size).
• Your EchoLike inbox, which holds the same key, fetches and decrypts the events, then sends back an encrypted delivery confirmation ("✓ received").
• Events that could not be delivered yet wait in a queue in your browser's extension storage and are retried automatically; they are encrypted when sent.

How we use your data

Only to provide EchoLike to you:

• show your likes, notes and voice notes in your private EchoLike inbox (protected by your username and password);
• organize them into themes and ideas, and summarize or transcribe them using AI services we rely on (large-language-model and speech-to-text providers), which process the content only to return results to us;
• notify you on Telegram, if you connected the EchoLike Telegram bot.

We do not sell or rent your data, use it for advertising, or use it to determine creditworthiness. We do not share it with anyone except the service providers above, or where required by law.

Storage and retention

• On your device: settings, connection details, the delivery queue and the last 20 events, until you uninstall the extension or clear its data.
• On ntfy.sh: encrypted messages are kept for a short time (hours, per ntfy.sh's own policy) and then deleted.
• In your EchoLike inbox: until you ask us to delete them.

Your choices

• Turn off the 🎙 button in the extension popup.
• Disconnect at any time by removing the extension; this deletes the key from your browser.
• Ask us to export or delete your data: hello@echolike.app.

Children

EchoLike is not directed at children under 13 and we do not knowingly collect their data.

Changes

If we change this policy we will update the date above and, for material changes, tell you in the extension or by email.

Contact

hello@echolike.app