Privacy Policy

Draft policy, effective October 24, 2026. Some details are pending confirmation by the founder.

Last updated: October 24, 2026

This policy explains what EchoLike collects, where it goes, and how to delete it. EchoLike is run by Nova. Contact: hello@echolike.app.

Short version: the extension only acts on X (x.com / twitter.com). It sends encrypted copies of the posts you like or bookmark, and your notes, to your own private connection. We don't sell your data, and we don't use ads or tracking.

1. The EchoLike browser extension

What it collects

Only when you act on x.com or twitter.com (including mobile.x.com): - Likes, unlikes, bookmarks and unbookmarks you click. For each one: the post ID, author handle, post link, the visible post text, the post's time, the action, and when you clicked it. - Written notes you type into the EchoLike note box (up to 4,000 characters). - Voice notes, only when you press the 🎙 button and allow your microphone. Recording stops after at most 60 seconds. - A status ping every 30 minutes, and when you press "test", saying the extension is working. It contains no browsing data.

It does not read your X password, direct messages, or pages outside X, and it doesn't track your browsing.

Permissions it asks for, and why

• Access to x.com / twitter.com: to notice your like and bookmark clicks and add the note and 🎙 buttons.
• Access to ntfy.sh: to send your encrypted events (see below).
• storage: to keep your connection code, a queue of unsent events, the last 20 event statuses, and today's like/bookmark count, all on your device.
• alarms: to retry failed sends every minute and send the 30-minute status ping.
• scripting and tabs: only to start working on X tabs that were already open when you install or update.
• clipboardWrite: to copy your connection code when you click it.
• echolike.app is allowed to send the extension your connection code when you pair it on the private page in one click. No other website can.

Where it goes

1. On your device: your connection code (a private channel name plus a secret encryption key) is created in your browser and stored there.
2. ntfy.sh (a third-party relay): each event is encrypted in your browser with AES-GCM before it leaves. ntfy.sh only sees unreadable text and basic connection data such as your IP address, per its own policy. Events are kept there briefly.
3. The EchoLike receiver: a computer run by Nova reads your channel, decrypts the events, and stores them (likes, notes, voice notes) linked to your Telegram chat ID so it can work with them for you. Voice notes are transcribed to text on that same server with an open-source speech model (faster-whisper); the audio is not sent to any outside transcription service and the audio file is deleted right after transcription.
4. AI models: to analyze a saved post for you, the receiver may send the post's text, its link and author, and your note on it (not your audio or Telegram details) to AI models through OpenCode (OpenCode Go hosted models), with Groq as a fallback. Those providers process it under their own policies.
5. Telegram: you pair the extension with our Telegram bot (or on echolike.app). The bot knows your Telegram chat ID and username and sends you replies about your saved items.

2. The directory website (echolike.app)

The directory is free and needs no account. Our hosting provider may keep standard server logs, such as IP address and browser type.

3. @echolike_radar Telegram channel

Joining the channel is handled by Telegram. We can see channel statistics Telegram provides but not your phone number. Telegram's own privacy policy applies.

4. Payments

When paid plans launch, Dodo Payments, our merchant of record, collects and processes your payment details, billing address and tax information. We don't see or store your full card number. We receive what Dodo shares to deliver your purchase, such as your email, what you bought and its status. Dodo Payments' privacy policy applies.

5. Third parties

• X (Twitter): the extension works inside x.com and reads what's on the page; X's own policies apply to your use of X.
• ntfy.sh: relays encrypted events (the public ntfy.sh service).
• OpenCode and Groq: AI models that may analyze a saved post's text and your note.
• Forward Email: forwards mail sent to hello@echolike.app.
• Telegram: bot and channel.
• Dodo Payments: payments, once live.

6. What we don't do

We don't sell or rent your data, share it with advertisers, or use it for ads.

7. Keeping and deleting your data

We keep your saved items while you use EchoLike. To delete everything we hold about you, email hello@echolike.app from the account you used, or with your Telegram username, and we will delete it within 30 days. Uninstalling the extension deletes the data stored in your browser. Billing records kept by Dodo Payments for legal and tax reasons follow Dodo's rules.

You can also ask us what we hold about you or to correct it, at the same address.

8. Children

EchoLike is not meant for anyone under 13.

9. Changes

If this policy changes, we'll post the new version here with a new date.

10. Contact

hello@echolike.app