PRIVACY POLICYLast updated
October 30, 2026
October 30, 2026
Your data, plainly.
Echo translates captions and live audio on YouTube, Twitch and Kick. This page explains what data is processed, where it goes, why, and what we do not do with it.
We don't sell dataNo selling, renting, or ad profiles. Ever.
You decide firstEcho sends nothing until you allow it. Usage statistics stay off unless you turn them on.
No keys to manageEcho handles the AI, so there are no API keys to configure, store, or leak.
CONTROLLER
Who we are
Echo Captions
Echo Captions is the data controller for the extension and this website (in Türkiye: the veri sorumlusu under the KVKK). It is run by its developer in Türkiye. Write to support@echolocalize.xyz for anything about your data.Paddle, for payments
Paid plans are sold by Paddle, the Merchant of Record. Paddle handles checkout, payment and tax, and is responsible for your payment data under its own privacy policy. Echo never sees your card.DATA
What Echo collects
Live audio from the tab you watchLIVE
Only on live streams (YouTube Live, Twitch, Kick) and past broadcasts on Twitch and Kick, after you click Echo, and only if you allowed live captions. The sound, with the stream’s title and channel name, streams to a speech-recognition service (Soniox, or AssemblyAI as the backup) while live captions run. Soniox tells speakers apart by voice to give each one a color. Echo keeps no recording and no voice profile, and these labels last only for that stream.YouTube captions and video titlesVOD
Echo gets the video’s captions from YouTube through the player on the page. To translate them, the caption text, the video’s title and a sample of the transcript (up to about 6,000 characters) go to Echo’s server and on to an AI model through OpenRouter.Twitch and Kick chatCHAT
Paid plans only, and only if you allowed chat translation. The chat messages on screen, yours and other viewers’, go to an AI model through OpenRouter to translate them. What you type is translated only when you press Echo’s button.Settings and watch time, on your deviceLOCAL
Your target language, caption style, theme and similar settings, and the minutes you watched with Echo per platform and channel (for the monthly summary, kept up to 13 months), are stored in the extension on your device. They are not sent to us.Account dataAUTH
If you sign in with Google, Supabase stores your email address, sign-in state, plan and subscription state. Echo uses them to sign the extension in and to apply your plan. Echo also stores the random ID of the Echo installation you signed in from, when you last opened a checkout and which Echo link led to it, to see how people move from the free version to a paid plan.Usage recordsMANAGED
For each translation and speech request, Echo records the time, plan, mode and the amount used, with a keyed hash of your IP address and your browser’s user-agent string, to apply daily limits and stop abuse. Echo’s servers do not store transcripts, translations or video IDs.Usage statisticsANALYTICS
Only if you turn them on in Echo. Anonymous events, such as which settings are used, go to Google Analytics with a random ID for your installation, never your account, email, audio, captions or translations. A few steps toward a paid plan, such as the first translation, reaching the daily limit or a click on the limit notice, also go to Echo’s server with no ID and are deleted after 180 days. On this website, analytics run as the cookie banner allows (see Cookies).Feedback for a rewardREWARD
If you send in-app feedback to claim a free month of Echo Lite, Echo stores what you wrote with your account email, to check it and grant the month. Versions before 2.4.7 could also send the name on your Chrome Web Store review. These entries are kept while your account exists.EmailsEMAIL
After you sign up, Echo sends a few emails in your first week about using it and about the plans, through Resend. Every email has a one-click unsubscribe link.Error reportsMANAGED
After you allow what Echo sends, Echo reports when it is installed or updated and when a step fails, such as missing captions or a failed translation. Each report has your browser’s name and version, your operating system, Echo’s version, your language, the site (YouTube, Twitch or Kick) and a short error code. No ID, no IP address and no caption text are kept. Echo uses them to find which browsers have problems, and deletes them after 180 days.LEGAL BASIS
Why we use it
To give you the service you asked for
Captions, translation, live captions, chat translation, your account and your plan: to perform our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).Other people’s voices and chat messages
Streamers’ voices and other viewers’ messages are processed only to show you the captions you asked for, and Echo keeps none of them: our legitimate interest in providing that translation (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).Limits, abuse prevention and security
The IP hash, the user agent and the usage records: our legitimate interest in a service that stays fair and safe (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).Usage statistics, website analytics and the referral cookie
Your consent (GDPR Art. 6(1)(a) and the cookie rules; KVKK Art. 5(1)). Withdraw it at any time: in Echo’s settings under Your data choices, or with Cookie settings at the bottom of this site.Billing records
Tax and accounting law. Paddle keeps the invoices.Error reports
Our legitimate interest in finding and fixing what breaks (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). The reports name no person.PROVIDERS
Third parties that receive data
Echo shares data only with the providers that make captions, translation, sign-in, billing, email and statistics work.
SupabaseSign-in and database: your email address, sign-in state, plan, usage records and feedback entries.
VercelHosting of this website and Echo’s server, and Vercel Analytics (visitor statistics) where the cookie banner allows it.
SonioxSpeech recognition: the live audio, with the stream’s title and channel name, while live captions run. It also translates the speech when it can.
AssemblyAIBackup speech recognition: the live audio, only when Soniox is unavailable.
OpenRouterAI routing: caption text, video titles, transcript samples and chat messages to translate. It sends them to an AI model: Google Gemini by default, and on free plans also other models available through OpenRouter. Each model provider handles the text under its own terms.
GoogleSign-in with Google: your Google account’s name and email address, when you choose to sign in.
PaddlePayments: Paddle is the Merchant of Record (seller of record) and handles checkout, billing and tax. Echo receives the billing status, never card data.
Google AnalyticsStatistics: anonymous events from the extension if you turn them on, and visits to this website as the cookie banner allows.
ResendEmail: your email address and the emails Echo sends you.
TRANSFERS
Transfers abroad
Most providers are in the United States
Your data is processed in the United States and in the other countries where these providers run their services. This is a transfer abroad for data from the EU, the UK and Türkiye.From the EU and the UK
Transfers rely on the provider’s certification under the EU-US Data Privacy Framework (and its UK extension) where it has one, and otherwise on the standard contractual clauses approved by the European Commission in the provider’s data processing terms.From Türkiye
Transfers abroad rely on the standard contracts of the Personal Data Protection Board (KVKK Art. 9), which we are putting in place with each provider.LIMITS
What Echo does not do
✓We do not send anything before you allow it on the “What Echo sends” screen.
✓We do not sell or rent user data.
✓We do not use your data to train AI models.
✓We do not use user data for personalized advertising or ad targeting.
✓We do not use user data to determine creditworthiness or for lending.
✓We do not keep a history of the videos or streams you watch on our servers.
✓We do not put ads or affiliate links into the pages you visit. Echo’s own notices, such as the daily limit, are marked as Echo’s and can be closed.
CONTROL
Retention and deletion
Audio, transcripts and translations
Echo’s servers keep none of them. To avoid translating the same video twice, finished translations of recently watched videos (about 50 per platform) are kept in the extension on your device; the oldest go first, and uninstalling Echo deletes them all.Account data
Kept while your account exists. Delete your account at echolocalize.xyz/account: everything tied to it is deleted, except Paddle’s invoices (tax law) and a one-way hash of your email address, kept to spot repeated sign-ups. You can download your data there too.Usage records
Daily usage counters are deleted after 90 days, rate-limit entries after about an hour, sign-in attempts after 24 hours, and security events (with the user agent) after 90 days.Feedback and emails
Feedback entries and the record of which emails were sent are kept while your account exists, and are deleted with it.Data in the extension
Removed when you uninstall Echo or clear its storage in Chrome.Cookies the site needs
Sign-in (Supabase), your language and theme, and your cookie choice. These run for everyone, because the site does not work without them.Statistics
Google Analytics and Vercel Analytics, to see how the site is used.Referral cookie
Kept for 45 days, to count the sign-ups that come from our ads and referral links.Your choice
In the EU and the EEA, the UK, Switzerland and Türkiye, statistics and the referral cookie run only after you click Accept. Elsewhere they run unless you turn them off. Change your choice at any time with Cookie settings at the bottom of every page. The extension uses no cookies.SECURITY
Security
✓All network traffic uses HTTPS or WSS.
✓Sign-in cookies are Secure and SameSite=Lax.
✓Subscription and usage writes are performed only by trusted server-side code.
RIGHTS
Your rights
Your rights
You can ask for access to your data, a copy of it, correction or deletion, and object to or restrict its use (GDPR Art. 15–22; KVKK Art. 11). Download your data or delete your account at echolocalize.xyz/account, or write to support@echolocalize.xyz. We answer within 30 days. Where we rely on your consent, you can withdraw it at any time.Complaints
You can complain to your data protection authority: in the EU, the authority of your country; in the UK, the ICO; in Türkiye, the Personal Data Protection Authority (KVKK).Children
Echo is not directed at children under 13, or under the age of digital consent where you live. If you believe a child gave us data, contact us and we will delete it.Policy changes
If we make material changes, we update this page, and Echo asks again before it sends any new kind of data.Questions, requests or complaints:support@echolocalize.xyzThis policy describes the current behavior of the Echo extension (version 2.5.0) and this website, and is also provided for Chrome Web Store review.