Privacy
Last updated 2026-10-28
Whose site this is
echosvoice.org belongs to EchosVoice. Write to hello@echosvoice.org about anything on this page, including to see, correct or delete what is held about you.
What is collected, and why
- A click log. When you arrive through one of our short links (echosvoice.org/go/...), the link's id, the time, your browser family and a truncated IP address (the last part removed) are logged, so I can tell which clips bring listeners.
- Same-session memory. The link id is also kept in your browser's session storage until the tab closes, consent or not, so a purchase in the same visit can be credited to the clip that led to it. It leaves the tab only inside the events below.
- Events. When you press a buy button, a streaming link or a store link, or join the beta, the site sends one line (the kind of click, its target, the link id if any) to our own server. No third party receives it.
- The service you chose on the listen page, and Hi-rez or Lo-rez when you pick one on the home's screen, kept in your browser's local storage so they are remembered next time. Neither is ever sent anywhere.
- The list. The address you give, the tags you chose (the list, the beta), the time, and the link id if any. Double opt-in: nothing more is sent until you click the confirmation link, and every email carries a way out.
- Purchases. Stripe runs checkout on its own pages and is the merchant of record. Our server receives the order (what was bought, the amount, the country, your email, the link id) to deliver the files, and keeps the download token, its expiry and how many times it was used. For EchoSound it also keeps the copy number and the developer mode code made for your copy. When you buy the developer mode upgrade, your copy number goes to Stripe as the order's reference, so the order finds your copy.
- Nothing from EchoSound itself. The app has no account; the sound it draws is read on your computer and goes nowhere else. Its developer mode button opens echosvoice.org/upgrade with your copy number in the address.
- Server logs. Like any web server, ours notes each request's IP address and time. It also adds up how much each address downloads in a day, so no one address can run up the bill; an address past its share gets the pages alone, without the previews and pictures, until the next day. The logs are deleted after two weeks.
- Visits. Plausible, self-hosted at stats.echosvoice.org, counts pages and the source of a visit without cookies and without identifying you. It loads only after "Sure".
Who processes it
- Stripe: payments, as merchant of record under Stripe Managed Payments. Your card details go to Stripe, never to us.
- DigitalOcean: the server this site and its database run on, and Spaces, the storage the files you buy are served from.
- Plausible: analytics, self-hosted on that server; no data leaves it.
- Resend: sends the emails (the confirmation, the download link, fresh links, the list's news).
- Metricool: schedules our posts on social platforms. It never sees visitors to this site.
- YouTube: a video on a song page loads from youtube-nocookie.com only after you press play; from then on YouTube's own terms apply.
How long
The consent cookie lasts six months, the src cookie ninety days, a download link thirty days. The list keeps your address until you leave it. Click and event lines are kept to answer the question they were logged for, which clips bring listeners, and no longer. Sale records are kept as long as the rules on keeping sale records ask.
Your rights
Ask at hello@echosvoice.org to see, correct or delete what is held about you. To leave the list, use the link in any email. Nothing here is sold, and nothing is shared beyond the processors above.