Privacy Policy

Fabio Jonathan Arifin (EchoForge). Email support@echoforge.to.

On your phone, entries, decisions, commitments, tasks, and transcripts are stored in a local database encrypted at rest with SQLCipher, keyed from the iOS keychain, with an optional Face ID lock. So Almanack works on your phone and at your desk, your memory also syncs to a database we operate (hosted on Supabase, encrypted at rest and in transit). Row-level security enforced by the database itself isolates your rows to your account: queries from any client can only ever return your own data. Files you attach (screenshots, documents) are stored in a private Cloudflare R2 bucket, accessible only through short-lived signed links generated for your authenticated session. We do not read your memory, and it is never used to train any model.

Quick voice notes are transcribed on your device using a local Whisper model. That audio is not uploaded, and it is purged from your device per your audio-retention setting. Meetings and the optional High Accuracy mode send the recording to our transcription provider (DeepInfra) over an encrypted connection, which transcribes it and does not retain the audio afterward. In every case the resulting text becomes part of your memory, which syncs encrypted to your account (see Where your memory lives).

Two features require a network call: structuring your spoken notes into decisions, commitments, and tasks, and answering questions about your own history. For these, transcript text (and the relevant stored text needed to answer a question) is sent from your device to a Cloudflare Worker proxy we operate, which forwards it to AI providers (OpenAI and Anthropic models accessed via OpenRouter) solely to generate the structured output or answer. If you choose to attach a photo or screenshot to a capture, that image is sent the same way, once, to be read into the structured note; the image itself is stored in your private attachment storage. The proxy does not store your content. These providers process text under their API terms. We do not use your content to train models, and these API providers state that API inputs are not used to train their models. See OpenRouter, OpenAI, and Anthropic privacy policies.

You sign in with Apple or Google (handled by Supabase Auth). We store the email address and authentication identifiers your provider shares, nothing more. The account exists so your memory can sync between your phone and the web app and so your data can be isolated to you. Your subscription is tied to your Apple ID through the App Store and can be restored on any device signed into that Apple ID.

If you create an API key in Settings to query your memory from an AI assistant, only a hash of that key is stored; the key itself is shown to you once. Anything an assistant retrieves through that key flows to the assistant you connected, under that provider's terms. Entries you mark personal are never returned through this surface. You can revoke any key instantly in Settings.

All purchases are processed by Apple through the App Store. We never receive or store your payment card data. Subscription status is managed via RevenueCat, which receives a pseudonymous app user identifier and your entitlement status, not your name or payment details. See RevenueCat's privacy policy.

Almanack may collect optional anonymous product analytics via PostHog (for example, which features are used and in-app errors) to fix bugs and prioritize improvements. Analytics events never include your entries, decisions, commitments, or transcripts, and are not linked to your real-world identity. See PostHog's privacy policy.

• We do not sell your data. Ever.
• We do not show ads or share data with advertisers.
• We do not retain your audio. Quick-note audio is transcribed on your device; meeting and high-accuracy audio is sent to our transcription provider only to transcribe it, and is not kept.
• We do not read your memory or mine it for any purpose.
• We do not use your content to train AI models.
• We do not hold your data hostage: export everything as markdown anytime.

You can export your entire memory as a markdown file anytime from Settings. Deleting your account in Settings (Delete all data) permanently erases everything, on your device and on our servers: every entry, transcript, attachment, and API key, with no retention window and no recovery. To also remove anonymous analytics events or RevenueCat purchase records, email us at support@echoforge.to.

On device, your memory is encrypted at rest with SQLCipher, keyed from the iOS keychain, and protected by your device's own security (passcode, Face ID, Secure Enclave). On the server, your data is encrypted at rest and in transit, isolated to your account by database-enforced row-level security, and administrative credentials never ship to any client. No system is perfectly secure, but every layer here is designed so that a failure in one does not expose your memory.

Almanack is not directed to children under 13 and children under 13 are not permitted to use it. We do not knowingly collect any data from children under 13. If you believe we have, email us and we will delete the records.

Our third-party service providers are located primarily in the United States. By using the AI structuring and question-answering features outside the United States, you acknowledge that transcript text may be processed in the United States.

We may update this policy from time to time. Material changes will be communicated through the app and reflected in the effective date above.

Questions or requests: support@echoforge.to.