Privacy Policy

Last updated: September 24, 2026

1. Introduction

Volcano Island Haven LLC ("we," "us," or "our") operates Echoith ("the Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Service. By using Echoith, you consent to the practices described in this Privacy Policy.

2. Information We Collect

Account Information: When you create an account, we collect your name and email address through our customer relationship management platform. Your email address is used for authentication, and your name is used for account identification and personalized communications.

Billing and Payment Information: When you subscribe to a paid plan, our third-party payment processor collects your payment details (such as credit card number, billing address, and related information). We do not store your full payment card details on our servers. We receive and store transaction records, subscription status, plan type, and billing history to manage your account.

Conversation Data: Messages you send to Echoith and the AI-generated responses are processed to provide the Service. Conversations are stored by our AI infrastructure providers and are associated with a pseudonymous user identifier, not your email address directly.

Memory Data: When you explicitly ask Echoith to remember something, that information is stored in our systems under a pseudonymous key derived from your email via a one-way cryptographic hash (SHA-256). Memory entries include a label, category, and content you provided.

Image and File Data: If you upload images or files, they are processed by AI vision models to generate text descriptions that are included in your conversation. The original files are not permanently stored; only the generated text descriptions are retained temporarily to facilitate your conversation.

Technical Data: We automatically collect certain technical information, including your IP address, browser type, device type, operating system, and general usage patterns (such as timestamps of interactions). This data is used for security, troubleshooting, and service improvement.

Push Notification Data: If you opt in to push notifications, we store your push subscription endpoint, encryption keys, and timezone preference to deliver notifications.

3. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the Service
Authenticate your identity and manage your account
Process payments, manage subscriptions, and maintain billing records
Store and retrieve your memories as you direct
Process uploaded images and files to facilitate your conversations
Deliver push notifications if you have opted in
Send you account-related communications, such as subscription confirmations, renewal notices, and service updates
Monitor and improve the performance, security, and reliability of the Service
Detect, prevent, and address fraud, abuse, security issues, and technical problems
Comply with legal obligations and enforce our Terms of Service

4. How We Protect Your Information (Pseudonymization)

We take your privacy seriously and employ the following protections:

Pseudonymous Identity: Your email address is never stored alongside your conversations or memories. Instead, we derive a one-way cryptographic hash (SHA-256) of your email to create a pseudonymous user key. This key cannot be reversed to reveal your email.
Encryption at Rest: Your data is stored on globally distributed infrastructure that encrypts data at rest using AES-256 encryption.
Encryption in Transit: All communications between your device and our servers are encrypted using TLS (HTTPS).
No Plain-Text Email Storage: Your email address is used only during authentication. It is not stored in conversation logs, memory entries, or analytics data.
Session Security: Authentication sessions are secured with HMAC-signed cookies transmitted only over HTTPS.

5. AI Model Training

We do not use your conversations or memories to train AI models. Your personal data is used solely to provide the Service to you. The underlying AI model is provided by a third-party provider and is subject to its own data handling practices. We inject your memory data into requests solely to personalize your experience and do not transmit your email address to the AI provider.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:

Service Providers: We use trusted third-party services to operate Echoith. These include cloud hosting and infrastructure providers, AI model providers for generating responses, a customer relationship management platform for account management and authentication, and a payment processor for subscription billing. These providers process data on our behalf under contractual obligations and are subject to their own privacy policies and data protection standards.
Payment Processors: When you subscribe to a paid plan, your payment information is collected and processed directly by our third-party payment processor. We do not have access to your full payment card details.
Legal Requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

7. Data Retention

Conversations: Stored as long as your account is active. You can delete individual conversations at any time through the sidebar menu. Deleted conversations are removed from our systems.
Memories: Stored until you delete them, or until you delete your account. If you stop using Echoith, your memories are automatically deleted five years after your last use. You can view, export, and delete individual memories or all memories at any time through Settings.
Demo conversations: If you try Echoith before subscribing, those demo messages are kept for one year and then deleted.
Billing Records: Transaction history and subscription records are retained as long as your account is active and for a reasonable period afterward as required for accounting, tax, and legal purposes.
Account Data: Retained as long as your account is active. You can delete your account yourself at any time through Settings → Delete Account. Deletion is immediate: your conversations, memories, sign-in, notification subscriptions, and usage records are removed, your subscription is cancelled, and your Echoith access is removed from our customer records. A record of the deletion itself (the date and a hashed identifier, no personal data) is kept for one year; billing records are retained as required by law.
Technical Logs: Retained for a limited period (typically up to 30 days) for security and troubleshooting purposes, then automatically deleted.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access: You can view your stored memories at any time through Settings → View My Memory.
Export and Portability: You can export all your memory data as a JSON file through Settings → Export My Data. You may request a copy of other personal data we hold about you.
Correction: You can request that we correct inaccurate personal information we hold about you.
Deletion: You can delete individual memories, all memories, or individual conversations at any time. You can delete your entire account and all associated personal data yourself through Settings → Delete Account. If you can no longer sign in, contact us and we will do it for you.
Push Notification Control: You can enable or disable push notifications at any time through your browser or device settings.
Communication Preferences: You may opt out of non-essential communications at any time. Account-related communications (such as billing notices and security alerts) cannot be opted out of while your account is active.
Withdraw Consent: You can stop using the Service at any time by logging out and not returning.

To exercise any of these rights or for any privacy-related requests, contact us at info@volcanoislandhaven.com. We will respond to your request within 30 days.

9. Cookies and Local Storage

We use a single session cookie (echoith_session_v4) for authentication purposes only. This cookie is secure (HTTPS-only), signed with HMAC, and contains only your session information. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We use browser local storage to save your UI preferences (such as install banner dismissal and push notification preferences).

10. Children’s Privacy

The Service is not directed at and is not intended for children under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe a child under 18 has provided us with personal information, please contact us at info@volcanoislandhaven.com.

11. International Data Transfers

Your information may be processed and stored on servers located in the United States and other countries through our infrastructure providers’ global networks. By using the Service, you consent to the transfer of your information to the United States and other jurisdictions, which may have different data protection laws than your country of residence.

12. Third-Party Services

We use the following categories of third-party service providers to operate Echoith:

Cloud Hosting and Infrastructure: For server hosting, data storage, content delivery, and edge computing.
AI Model Providers: For generating AI responses. Your conversation content (under a pseudonymous identifier) is sent to the AI provider to generate replies. Your email address is never sent to AI providers.
Customer Relationship Management: For account management, authentication, course delivery, and automated communications.
Payment Processing: For handling subscription billing and payment transactions securely.
AI Orchestration: For managing conversation flows, knowledge retrieval, and tool routing.

Each provider is subject to its own privacy policy and data protection practices. We select providers that maintain industry-standard security measures, including encryption at rest and in transit.

13. Do Not Sell or Share My Personal Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. If you are a California resident or a resident of another jurisdiction with similar rights, you have the right to opt out of the sale or sharing of your personal information. Since we do not engage in these practices, no action is required on your part.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

15. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Volcano Island Haven LLC
PO Box 384599, Waikoloa, HI 96738
Email: info@volcanoislandhaven.com