We do not sell user data
Echo does not sell, rent, or use user data for advertising profiles.
// privacy
Privacy policy
Echo translates captions and live audio for YouTube, Twitch, and Kick. This page explains what data is processed, where it goes, and what we do not do with it.
Last updated: May 4, 2026
Your keys stay local
Bring-your-own API keys are stored in Chrome storage and are not sent to Echo servers.
Content is processed only to translate
Audio, captions, and transcripts are used only to provide subtitles and translations.
data
What Echo collects
Audio from the active video tab
Only after you click Echo on YouTube, Twitch, or Kick. Audio is streamed in short chunks to the speech-to-text provider you selected and is not stored on servers we control.
YouTube caption track data
When a video has captions, Echo reads the caption track from the page so it can display and translate it without re-transcribing the video.
User preferences
Target language, subtitle style, theme, prompt settings, provider choices, and similar settings are stored with chrome.storage.
BYOK API keys
OpenRouter, AssemblyAI, Groq, and DeepInfra keys are stored in Chrome storage and are used only for direct requests to the provider you chose.
Account data
If you sign in, Supabase stores your email, auth state, and plan/subscription state. Echo uses this to authorize the extension and enforce plan access.
Usage metrics
For Pro, Pro Plus, and Pro Max managed requests, Echo records request timestamps, plan tier, mode, target language, and token counts. We do not store source transcripts, translations, or video IDs.
providers
Third parties that receive data
Echo shares data only with providers required to make subtitles, translation, account access, and billing work. We do not sell user data.
Authentication and databaseSupabaseReceives account email and stores subscription state.Speech-to-textAssemblyAIReceives live audio chunks when AssemblyAI transcription is used.Translation routingOpenRouterReceives transcript text and translation prompts for managed translation requests.Optional OAuth sign-inGoogleReceives and returns Google account identity data only when you choose Google sign-in.Payments when paid plans launchLemon SqueezyHandles checkout and billing. Echo receives billing status, not raw payment card data.
limits
What Echo does not do
✓We do not sell or rent user data.
✓We do not use your data to train models.
✓We do not use user data for personalized advertising or ad targeting.
✓We do not use user data to determine creditworthiness or for lending.
✓We do not track which videos or streams you watch.
✓We do not inject ads, affiliate links, or unrelated content into pages.
control
Retention and deletion
Audio, transcripts, and translations
Audio is transit-only. Transcripts and translations are not stored on Echo servers; they live in your browser while the page is open.
Account data
Account and subscription data stays while your account exists. You can delete your account from echolocalize.xyz/account.
Usage metrics
Managed-plan usage aggregates are kept for billing, abuse prevention, and quota reconciliation, then deleted when no longer needed.
Local extension data
Local settings and BYOK keys are removed when you uninstall Echo or clear extension storage in Chrome.
security
Security
✓All network traffic uses HTTPS or WSS.
✓Auth cookies are HTTP-only, Secure, and SameSite=Lax.
✓BYOK API keys do not transit Echo servers.
✓Subscription and usage writes are performed only by trusted server-side code.
legal
Children, international users, and changes
Children
Echo is not directed at children under 13. If you believe a child provided data, contact us and we will delete it.
International rights
Users in the EU/EEA, UK, California, and similar jurisdictions can request access, correction, export, or deletion.
Policy changes
If we make material changes, we update this page and notify signed-in users when appropriate.
Contact
Questions or deletion requests: support@echolocalize.xyz.
This policy is provided for Chrome Web Store review and for Echo users. It reflects the current behavior of the extension and website.