KeyEcho Privacy Policy

Last updated: 2026-10-25

KeyEcho plays sounds without storing or sending what you type and needs no account. We keep purchase records and use PostHog for website analytics; you can request deletion.

1. What never happens

• We watch key-down and key-up events only to choose a sound, then forget them. We never store, send or log your typing.
• We use no microphone, account or password. The open-source app sends no usage analytics or crash reports.
• We show no ads and sell no data.
• We use no website session replay or screen recording.
• Website click capture masks text, attributes and link queries.

2. Information we handle

2.1 On your device

We store your selected pack, volume, downloaded or imported packs and license key. We use them to run the app and keep them on-device until you delete a pack or uninstall the app. Delete packs or uninstall to remove them.

2.2 Purchases and your license key

We collect your checkout email, purchase and payment identifiers, key and delivery records. Checkout optionally asks how you heard about KeyEcho. Stripe keeps the answer; analytics receives only the selected category. Your key visibly encodes your purchase identifier and email, so keep it private. Anyone can trigger a restore email but learns nothing about the buyer. We use these records to issue and restore your license under our purchase contract. Stripe takes payment and holds card details. We never see your card number. Cloudflare sends the key and restore emails. Our hosting providers store the purchase record in the United States. We keep your record while KeyEcho is on sale so email restore works. Daily backups and database recovery history keep copies for 30 days, only for disaster recovery. Stripe keeps payment records under its terms. You can request deletion, which ends email restore.

2.3 Server events

Our payment server reports purchases and the optional checkout-answer category to PostHog under our legitimate interest in measuring sales sources. Its separate identifier links to a purchase record, not the browser. It sends no email or amount and disables location lookup. PostHog keeps delivered events under its terms. We keep no separate copy. You can request deletion of sent records.

2.4 Website analytics

We collect visits, clicks, visit duration, public page addresses and queries, referrers, campaigns, browser and device details, errors and performance. Optional survey answers you type carry a random browser identifier. We rely on our legitimate interest in comparing visit sources and fixing broken or slow pages. PostHog receives this data, retains IP addresses and derives approximate country, region and city.

PostHog keeps analytics under its terms. We keep no separate copy. Cookies and browser storage remember identifiers until you clear site data. Checkout and credential pages are excluded from automatic analytics. Stripe receives campaign context and an opaque ad reference, not raw click IDs. Security request logs last up to 7 days. You can request deletion of analytics records. Clearing local data leaves sent records intact. Please omit personal and contact details from surveys.

2.5 Advertising attribution

We collect Google, Microsoft, Meta or TikTok click identifiers on ad landings, based on our legitimate interest in measuring campaign results. Our conversion relay receives them. We can report ad-attributed purchases to the originating ad platform. We delete raw relay identifiers after 90 days. Your browser stores identifiers and a reference until you close the session. You can request deletion of sent records. PostHog retains public URLs containing these identifiers under its terms.

2.6 Downloads and updates

At launch we fetch update information, and installing asks you first. Settings fetches the catalog; previews stream audio. License checks, purchase polling and paid downloads send your key when needed. Hosting providers and GitHub receive your IP to deliver them. Server request logs last up to 7 days. Nothing about typing is sent.

2.7 Support email

We use your email and message to answer requests, under our legitimate interest. We keep them for 12 months after the thread closes.

3. Providers and locations

We use these providers:

• Stripe — checkout, payment and refunds (US).
• PostHog — website analytics and error capture (US).
• Hosting and security providers — hosting and storage (US).
• GitHub — hosts the app downloads and the updater manifest (US).

EU and UK data reaches the United States under each provider's transfer safeguards. Only the listed providers receive data from us.

4. Your rights

Where data-protection law applies, including the EU and UK, you can ask to see, correct, delete, restrict or export your data. You can object to our use of it. You can complain to your local supervisory authority.

Email hi@keyecho.app to exercise these rights. We answer within 1 month. Write from your checkout email. Include your browser identifier for website analytics requests.

5. Children

KeyEcho is not directed at children. We delete purchase records on request.

6. Changes

We update this page before a change affects our use of data and record the change here.

7. Contact

Email hi@keyecho.app or write to WaveApp LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.