EchoList Privacy Policy
What EchoList is
EchoList is a collaborative checklist app for sharing to-do lists with family and friends. It is operated as a small, self-hosted service. This policy explains what data the app handles and what happens to it.
Data we collect
- Account details: your name, email address, and a password (stored only as a bcrypt hash; we never store or see your actual password).
- Your content: the lists and items you create, including titles, notes, due dates, and completion state.
- Sharing and activity records: who a list is shared with and a history of changes (for example, "item completed by <name>") so shared lists work as expected.
- Sign-in tokens: random session tokens (stored hashed) so you stay signed in.
EchoList does not collect location data, contacts, advertising identifiers, or analytics, and it contains no ads or third-party trackers.
How your data is used
Your data is used only to run the service: showing your lists on your devices, syncing shared lists with the people you chose, and sending account emails. It is never sold or used for advertising.
Sharing
List content is visible only to you and the people the list owner explicitly shares the list with. People you share a list with can see your name and email address as the list owner or member.
Email delivery
Password reset codes and list invitations are delivered by email through Resend, our email delivery provider. Only the recipient address, subject, and message text needed for that email are sent to Resend.
Local-only mode
If you use EchoList without an account, your lists are stored only on your device and are never sent to our servers. Uninstalling the app deletes them.
Data retention and deletion
Your data is kept while your account exists. You can delete your account at any time inside the app (My Lists → Delete account). Deletion is immediate and permanent: your account, the lists you own, and your access to shared lists are removed. Change-history entries on other people's lists keep your display name as plain text but are no longer linked to any account. Server backups are rotated out automatically within 14 days and are stored only for recovery.
Security
All traffic between the app and the server uses HTTPS. Passwords are bcrypt-hashed, session tokens and reset codes are stored hashed, and reset codes expire after 15 minutes with a strict attempt limit.
Children
EchoList is a general-audience utility intended for household use. It is not directed at children under 13, and we do not knowingly collect personal information from them. Family accounts for minors should be created and supervised by a parent or guardian.
Changes to this policy
If this policy changes, the new version will be posted at this address with an updated effective date.
Contact
Questions or data requests: brian@echorithm.com