Privacy Policy

Last updated: March 2, 2026

EchoRecorder ("we", "us", "our") is a screen recording platform for teams. This policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

Account Information

When you sign up, we collect your email address and name. If you use Google Sign-In, we receive your name, email, and profile photo from Google.

Recordings

When you record, the following data may be captured depending on your settings:

Screen video — the visual content of your screen or selected tab/window
Microphone audio — if you enable your microphone during recording
Tab audio — system or browser tab audio, if enabled
Click events — mouse click positions and timestamps during recording, used for click tracking overlays

View Analytics

When someone watches a shared recording, we collect anonymized analytics: view count, watch duration, approximate location (country/region from IP), and playback engagement data. We do not track individual viewers across recordings unless they are logged in.

2. How We Use Your Data

Storage and delivery — recordings are stored securely and delivered to authorized viewers via our CDN
Transcription — audio is sent to OpenAI Whisper for speech-to-text transcription, generating searchable transcripts
AI document generation — when you explicitly trigger AI docs, select video frames and transcript are sent to OpenAI GPT-4o Vision to generate summaries, action items, or other documents. This only happens on your request, never automatically
View analytics — anonymized viewing data powers your analytics dashboard (view counts, watch time, engagement heatmaps)
Authentication — your email and credentials are used solely for account access and team membership

3. Data Storage and Security

Recordings and files are stored in Amazon Web Services (AWS) S3, delivered via AWS CloudFront CDN. All transfers use HTTPS/TLS encryption
Account and metadata are stored in a PostgreSQL database hosted on Railway, accessed over encrypted connections
Authentication uses JWT tokens in HttpOnly, Secure, SameSite cookies
All data in transit is encrypted via HTTPS. Files at rest are stored using S3 server-side encryption

4. Data Sharing

We do not sell your data. We do not share your recordings or personal information with advertisers or data brokers.

We use the following third-party processors to operate the service:

Amazon Web Services (AWS) — file storage (S3), content delivery (CloudFront), email delivery (SES)
OpenAI — transcription (Whisper) and AI document generation (GPT-4o Vision), only when you use these features
Railway — application and database hosting

5. Data Retention and Deletion

Deleting a recording removes the video file from S3, all associated data (transcript, thumbnails, analytics, comments, AI documents), and the database record. This is permanent and immediate
Free plan recordings are subject to a 30-day retention policy. Recordings older than 30 days may be automatically deleted
Deleting your account removes your profile, all your recordings, and disassociates you from any teams. Contact your team owner or use the account deletion option in your profile settings

6. Your Rights

You have the right to:

Delete recordings — remove any recording you own at any time
Control visibility — set recordings as public or private, password-protect them, restrict access to specific viewers
Delete your account — permanently remove your account and all associated data
Export recordings — download your original recording files at any time

7. Chrome Extension Permissions

The EchoRecorder Chrome Extension requests the following permissions. Here's what each one does and why we need it:

activeTab — access the current tab's content only when you click the extension icon to start a recording. We never access tab content in the background
storage — save your preferences (mic selection, recording settings) locally in the browser. This data stays on your device
offscreen — create a hidden page to run the MediaRecorder API, which captures your screen recording data. Required because Chrome extensions cannot record media directly in the background
scripting — inject the click-tracking script into the recorded tab to capture mouse click positions for the click overlay feature. Only injected when recording starts
tabs — read the current tab's URL and title to auto-name your recording and display which tab is being recorded
identity — support Google Sign-In authentication directly from the extension popup
Host permissions (all URLs) — required so the extension can record any tab you choose and inject the click-tracking overlay. Without this, recording would be limited to specific websites. We only access page content during an active recording that you initiate

8. Social Platform Integration

On supported platforms (such as LinkedIn), the EchoRecorder extension adds an "Attach Recording" button to the message compose area. This feature:

Does not read or access your message content, contacts, or any other platform data
Only inserts a share link to your selected recording into the compose field
Activates only on pages where compose is detected, and only adds a visible UI button
Can be used or ignored — it does not modify any existing platform functionality

9. Contact

For privacy questions, data requests, or concerns:

privacy@getechoinsights.com