Moment Echo Privacy Policy

Updated: October 18, 2026

The AI content-retention and staff-access commitments below take effect when the AI features in version 1.5.0 become publicly available.

This policy applies to Moment Echo, operated in Canada by Feng Gao under the Breeze Works name. Feng Gao is the app operator and personal data controller. Privacy contact: [email protected].

Moment Echo is a local-first personal timeline app. Your events, topics, notes, reminders, attachments, location entries, and backup files are stored on your device unless you choose to use features that move or copy that data.

Starting with version 1.4.1, Moment Echo for iOS also sends installation-based usage statistics and crash reports to a server we operate. This is described in the "Usage Statistics and Crash Reports" section below, and you can turn it off at any time.

The Android 1.4.1 release does not send usage statistics, installation identifiers, or crash reports to our analytics service. The analytics section below applies to iOS. The permissions, maps, location search, weather, and backup information also applies to Android where those features are used.

Data You Provide

Moment Echo may store event titles, descriptions, dates and times, topics, moods, reminder settings, money fields, location names, map coordinates, photos, videos, audio recordings, files, and links that you add to events.

Permissions

Camera, photos, microphone, files, and location permissions are used only when you choose the related feature, such as adding a photo, recording audio, importing a file, or saving a location on an event.

Moment Echo does not continuously track your location in the background.

iCloud Sync

On Apple devices, when iCloud Sync is enabled, Moment Echo uploads and downloads your timeline data through your private Apple iCloud account using CloudKit. This sync data is associated with your Apple ID and private iCloud database.

iCloud Sync does not pass through our AI or analytics servers. The analytics service described below does not receive your timeline content. If you choose to use AI features, the relevant inputs and topic information are sent to our servers and the applicable providers as described under "AI Features."

Backups

When you export a backup, the backup file contains your app data and attachments so you can restore them later. You control where that file is saved and shared.

On Android, the operating system may also back up app data or transfer it to another device according to your Android backup settings.

Third-Party Services

Map tiles are loaded from OpenStreetMap. Address and location search may use the platform geocoding services available on your device. These services may receive the location or search query needed to provide the requested map or place result. For example, converting your current coordinates into a place name can send precise coordinates to the platform geocoding service. Map tile requests identify the area being viewed. These services also receive connection information such as your IP address and handle it under their own privacy policies.

When you choose to use current area weather, Moment Echo requests current weather from Open-Meteo using the approximate coordinates needed for that weather result. Open-Meteo may receive the coordinates required to provide the requested weather data. The app rounds weather coordinates to a 0.01-degree grid before sending them. Open-Meteo states that API request logs, including IP addresses and request URLs, may be retained for up to 90 days. These requests are not necessarily processed only in memory. See the Open-Meteo privacy policy and the OpenStreetMap privacy policy.

AI Features

AI features and the Plus and Pro subscriptions are not offered in the China mainland App Store storefront (CHN). Availability is based on the StoreKit account storefront, rather than the app language or GPS location. Manual recording remains available.

AI features require an internet connection to transcribe speech, understand inputs, and suggest or organize events and reminders. We process the related inputs and results only to provide the recording features you request and keep necessary AI call records to check usage, protect service security, and diagnose failures. We do not use this content to train AI models. You can choose to keep using manual recording instead.

Data sent for AI processing

When you use AI, the app sends the text, recording, or transcript for the request, along with context used to understand it: identifiers, names, descriptions, and aliases of topics that are not marked private; the current time, capture time, time-zone offset, and language; and the enabled device time zone, platform, and custom content in your background settings. Private topic metadata is excluded. Transcription and event parsing may use different providers.

The app does not automatically include photos, videos, existing event bodies, or device location as AI input. Personal information you include in your input, topics, or custom background, such as names, places, or health details, is still sent with that content. Please provide only what the recording needs and ensure you have permission to submit information about other people.

To prevent abuse and verify access, our backend also processes connection information, app and device verification information, and necessary subscription proofs. These verification details are not provided to the AI model as prompt content. Device verification identifiers and their derived hashes can associate requests, subscription tiers, diagnostics, and quota use with the same app installation. They are not advertising identifiers.

If you have allowed location access and AI identifies an event as happening where you spoke, the app may fill in that location on your device and request weather when saving. A specific place suggested by AI may be sent to your device's geocoding service to find coordinates. See "Third-Party Services" for those services' data handling.

Purchases and subscription verification

Apple processes payment. To verify Plus or Pro access, restore purchases, and apply the appropriate AI quota, we process Apple-signed subscription proofs. These may include the product identifier, transaction and original transaction identifiers, subscription status, and purchase or expiry times. We may keep the verified membership tier with the related request and device verification record. We do not receive your payment card or bank account details from Apple.

When usage statistics are enabled, membership tier and subscription status are also included in installation-based analytics. This use is separate from subscription verification, which is needed to provide paid features.

Recipients and processing locations

The relevant content is sent first to servers in Canada operated by Feng Gao under the Breeze Works name, then to the AI service enabled for the feature. You can contact this Canadian recipient at [email protected] to exercise your privacy rights. AI services may be provided by OpenAI, Anthropic (Claude), or Google (Gemini), as identified in the notice before use and by the service actually enabled. Providers may process data outside Canada, including in the United States. Hosting our servers in Canada does not mean all processing occurs only in Canada.

Provider privacy contacts and data-handling information are available here:

• OpenAI: privacy policy and contacts and API data controls.
• Anthropic (Claude): privacy policy and contacts and Commercial Customers Privacy Center.
• Google (Gemini): privacy policy and contacts and Gemini API terms and data use.

These general privacy policies do not replace the applicable API commercial contracts and data-processing arrangements. Specific locations, retention, model-improvement use, and privacy controls depend on the service, agreement, and configuration. We do not make a blanket promise that every provider retains no data or never uses data to improve models.

When a model uses web search, relevant queries may also be processed by a search provider. Before adding an AI or search recipient, expanding the data sent, or changing its purpose, the specific recipients and processing notice must be updated and applicable consent obtained again. Unnamed "other providers" are not treated as authorized by this policy.

Your choices before use and withdrawal

In versions that include AI consent settings, the app shows a separate notice before you first use AI, covering what is sent, who receives it, and where it is processed. To consent to the AI processing and cross-border transfers described above, you tick that you have read and agree to the Terms of Use and this policy, then confirm on that screen. The box is not preselected. AI stays disabled until you do this. Buying Plus or Pro or enabling analytics does not replace this consent.

You can withdraw AI processing and cross-border transfer consent by turning off AI Quick Capture under More → AI Features. Refusal or withdrawal blocks new AI requests and attempts to cancel AI requests still in progress. You can still create, edit, and view records manually. Withdrawal cannot recall data already sent to a server or provider and does not automatically delete data previously processed lawfully. For deletion, contact us as explained under "Data Deletion."

Your choices, notice version, and choice time are saved on your device. A change to the disclosed recipients or processing scope requires a new choice. Older app versions may not have these controls; please update to a version with AI consent settings. Until then, do not use AI features if you do not want to send data.

AI service records and retention

For the public AI release in version 1.5.0, we commit to keeping AI request content on our own servers and AI Gateway for no longer than 24 hours from receipt of the request. This covers submitted text, original audio, transcripts, generated results, and copies of that content in diagnostic records, temporary files, response caches, and backups under our control. The retained content is used only to deliver the requested feature, monitor service operation and security, and investigate errors. It is not used by us to train AI models or for advertising. Content will be automatically deleted within that period; it will not be kept longer merely for routine monitoring or troubleshooting.

Under this commitment, human access to retained AI content is limited to authorized staff assigned to security duties, and only when necessary for security monitoring or fault investigation. This is a commitment about our own operations, not a statement that only our staff can access data held by an upstream provider.

Before these commitments take effect, the AI service uses separate retention settings for request history, gateway diagnostics, audio files, caches, and backups. The request-history default is 24 hours; it does not establish a 24-hour limit for every copy held by the gateway or in backups. You can contact [email protected] to ask about a specific request and seek deletion.

Operational metadata is distinct from AI content. Necessary request records include time, request identifier, model, status, duration, usage, verified membership tier, and a derived device-verification identifier. Request history has a configurable retention period, with a default of 24 hours. App or device verification registrations, subscription verification records, quota counters, and historical trial identifiers are retained for their respective verification, security, and usage-control purposes. They are not covered by the AI content limit. Analytics has the separate periods stated below. These exceptions do not permit retaining AI text or recordings as metadata.

The 24-hour commitment does not set the retention periods of OpenAI, Anthropic, Google, or other infrastructure they control. The applicable API service, agreement, and data controls govern their processing and retention, including security and abuse monitoring; use the provider links above for details. If law requires preservation of specific data, we will restrict its use to that obligation and delete it when the obligation ends. After a failed request, a recording may remain on your device for retry or manual saving; you control that local copy.

International Processing and Regional Rights

Data protection, available remedies, and government-access rules in your region may differ from those in Canada or the provider's processing location. Transfer consent does not replace legally required transfer mechanisms, assessments, or other safeguards.

For users in the European Economic Area, Canada's adequacy recognition covers commercial organizations within its scope, rather than any server hosted in Canada. Onward transfers elsewhere still require applicable safeguards. Subject to applicable law, you may request access, correction, erasure, restriction, portability, or object to processing, withdraw consent-based processing, and complain to your local data protection authority.

For users in mainland China, notice before an overseas transfer should identify the overseas recipient and its contact details, purposes and methods of processing, categories of personal information, and how to exercise rights with that recipient. Separate consent, a personal information protection impact assessment, and applicable transfer procedures are required where the law calls for them. An exemption from a filing, standard-contract, or certification procedure does not waive other applicable obligations. You may request access, copies, correction, completion, or deletion, restrict or refuse processing, withdraw consent, and request an explanation of processing rules, as provided by law.

Inputs containing sensitive information, such as health or financial-account details, may require additional notice and separate consent. Contact [email protected] to ask about processing arrangements, exercise your rights, or make a complaint. We will respond within the period required by applicable law and ask only for information necessary to verify the request.

Usage Statistics and Crash Reports

Moment Echo for iOS sends installation-based usage statistics and crash reports to an analytics service we operate ourselves, so we can see which features are used and where the app fails. It sees how the app is used, never what you record in it. Usage statistics are on by default. You can turn them off at any time under More → About Moment Echo → Data & Privacy. Turning them off stops sending immediately and discards anything not yet sent.

What is not sent through analytics

• Event titles, descriptions, notes, and any other text you write.
• Photos, videos, recordings, files, and links.
• Location names, map coordinates, and amounts.
• Which events you have, their dates, or what they are about.
• iCloud account details, your Apple ID, name, email address, phone number, or anything else that identifies you as a person.
• Advertising identifiers or any device identifier that persists across apps.

Moment Echo has no user-facing account system. The analytics installation identifier does not directly contain your name or similar identity details. It persists in the device Keychain and lets us associate analytics events and error reports from the same installation; it is therefore not fully anonymous. Analytics requests also create the connection logs described below.

What is sent

Only the following four kinds of data, none of which contain anything you typed:

• Installation and version: a random installation identifier generated on your device (not derived from your Apple ID, serial number, or advertising identifier, and replaceable at any time, see "Deleting reported data"), the app version and build number, whether the app came from the App Store or TestFlight, whether the installation carries the free-period Pro marker, and the current membership tier and subscription status.
• Device environment: device model, iOS version, language, region, and time zone.
• Feature usage: which screens and features are used and whether they succeed; the outcome, failure category, and approximate duration range of backups and iCloud sync; the current values of your settings, such as whether iCloud Sync is on, the reminder mode, and the media compression level. When you save an event, only its shape is sent: the mood category, whether it has a location, an amount, a reminder, or weather, and the number and kind of attachments in ranges (for example "2 to 3 attachments, images").
• Error and crash reports: the error type and message, the call stack, and the kinds of actions taken shortly before the error. URLs, file paths, user names, coordinates, and similar details are removed before a report leaves your device.

Server-side handling

Like any internet service, our server sees the IP address of each upload request. It is used to limit abuse and to derive a country or region estimate for delivery diagnostics. The request log that holds the IP address and that estimate is deleted after 48 hours, and the IP address is not stored with your usage events.

Raw events and error reports are kept for at most 90 days. Aggregated statistics, such as how many installations used a feature on a given day, no longer contain the installation identifier and are kept for up to two years.

The installation identifier links records from the same installation but is not used to track you across other apps or websites. We do not share this data with advertising or analytics companies.

Deleting reported data

Under More → About Moment Echo → Data & Privacy you can request deletion of the data reported by this installation. The request removes the events, error reports, and request logs tied to your installation identifier from the server, and the app then generates a new identifier. Counts that were already added to aggregated statistics cannot be traced back to an installation and are not affected.

Tracking and Advertising

Moment Echo does not show ads, does not sell your data, and does not track you across other apps or websites.

Data Deletion

You can request deletion through our data deletion request page or [email protected], including requests about related data held by us or an AI provider. Please provide enough timing and context to locate the request without resending complete recordings or sensitive content. We will explain what can be located and deleted and any applicable legal or necessary retention limits.

The in-app option to delete reported data covers analytics only. It does not automatically delete AI request records or provider data. Withdrawing AI consent and deleting data are separate actions.

You can delete events in the app, permanently delete items from Trash, disable iCloud Sync, delete local backups you created, request deletion of reported usage statistics under Data & Privacy, or remove app data by deleting the app.

Data already synced to iCloud may also need to be managed from your Apple iCloud account or by using the app while signed in to the same iCloud account.

Changes to This Policy

When this policy changes, the date at the top is updated and the new text is published at the same address. Changes that affect what is collected are also noted in the app's release notes. When a change to AI recipients, transferred data, or processing purposes requires renewed consent, we will provide a new notice and obtain that consent before continuing the affected processing. Continued use of the app alone is not consent to new AI processing.

Contact

For privacy questions, contact Feng Gao, operating as Breeze Works, at [email protected]. You can also use the support channel listed on the app's App Store or Google Play product page.