Privacy Policy

Last updated: 3 October 2026

This Policy explains what personal data we process in EchoInsight (https://echoinsight.me), why, on what legal basis, who we share it with, how long we keep it and what rights you have. It applies from 3 October 2026. The Polish version is legally binding; this English version is provided for information.

1. Data controller

The controller of your personal data is Jakub Kolada, running a sole proprietorship under the business name Jakub.Solutions, NIP (Polish tax ID) 9512416493, business address: al. Solidarności 68 lok. 121, 00-240 Warszawa, Poland (https://jakub.solutions). For any matter concerning personal data, write to jakubkoladadev@gmail.com or use the form on the “Contact” page.

The essentials

  • You are talking to an artificial intelligence system (Google Gemini). Your messages are sent to Google to generate replies.
  • Conversations about spirituality may reveal your religious or philosophical beliefs and information about your health. We process them only on the basis of your explicit consent.
  • We do not sell your data, do not use conversations for advertising and do not train AI models on them.
  • In your Profile you can download your data (“Download my data”) and delete your account (“Delete account”) at any time.

2. What data we process

The Service is free of charge and we do not process payment data. If we introduce paid plans, we will update this Policy before we process any payment data.

  • Account data: e-mail address (account identifier) and, if you sign in with Google, your name and profile photo address from your Google account; display name, language, time zone, theme, message pool and counters.
  • Consents and statements: date and time of the 18+ confirmation, acceptance of the Terms and consent to processing of special-category data, and the version of the Terms.
  • Conversation content: your messages, the chat's replies, their dates and detected language.
  • Context profile: a summary of earlier conversations (section 4).
  • Moderation data: number of violations, date of the last violation and any suspension.
  • Usage metadata (no content): message length, language, number of tokens and cost of a reply, error information.
  • Contact form messages: name or nickname, e-mail address, subject and content.
  • Technical data: in server logs – IP address, date and time, requested address (with the account identifier masked) and browser type; in application logs – a pseudonymous account identifier (a one-way hash), never the content of messages; in abuse-protection counters – IP address or e-mail address.
  • Google Analytics data – only after you consent (section 10).

3. Special-category data and your consent

EchoInsight is for conversations about spirituality and personal matters, so your messages may reveal religious or philosophical beliefs and information about your health, including mental health. These are special categories of data (Art. 9 GDPR).

We process them only on the basis of your explicit consent (Art. 9(2)(a) GDPR), to conduct the conversation and build the context profile. You give consent before your first conversation by ticking a separate box. Without it the chat is not available, because a conversation cannot take place without processing its content.

You can withdraw consent at any time by deleting your account (Profile → “Delete account”). Withdrawal does not affect the lawfulness of processing before it. You do not have to share more than you want to – you decide what you tell the chat.

4. Context profile and automated processing

So that EchoInsight remembers the context of earlier conversations, the Google Gemini model periodically summarises them into a context profile. This happens during your next conversation once the history reaches 80 messages or 30,000 characters, or 60 days after the previous summary. Older messages are then deleted and the 20 most recent remain. We keep only the two most recent profiles; the newest is used in conversations.

The profile is used only to continue conversations with you. We do not make decisions based on it that produce legal effects concerning you or similarly significantly affect you. You can download the profile in your Profile (“Download my data”) and delete it together with your account.

The profile may contain:

  • observed personality traits, main conversation topics and expressed spiritual, philosophical or ethical beliefs;
  • your level of knowledge of spiritual topics, languages used, interests (music, hobbies, books and media);
  • social and professional context: family or relationship situation, the roles of people close to you, recurring relationship themes, work situation;
  • up to 5 short quotations of what you said about your values, and a short summary for future conversations.

By design the profile does not contain:

  • other people's names, addresses, phone numbers, e-mail addresses, employer names, names of diagnoses or medication, information about sex life or sexual orientation, political opinions or financial details.

Other automated mechanisms:

  • Every message is checked automatically for obscene or abusive content and attempts to bypass the rules; five violations within 7 days suspend sending messages for 24 hours. You can ask for such a decision to be reviewed by a human.
  • Messages are checked automatically for signs of crisis; if detected, the chat shows helpline numbers.

5. Purposes and legal bases

Your e-mail address is required to create an account, and the consents in section 3 are required to use the chat. Any other data is provided voluntarily.

  • Creating and running your account, providing the Service, message limits – performance of the contract (Art. 6(1)(b) GDPR).
  • Conversation content and the context profile – your explicit consent (Art. 9(2)(a) GDPR) and performance of the contract (Art. 6(1)(b) GDPR).
  • Keeping evidence of consents and acceptance of the Terms, moderation, security, server logs, abuse prevention, establishing and defending legal claims – our legitimate interests (Art. 6(1)(f) GDPR).
  • Handling contact form messages – our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) and, where they concern the contract (e.g. complaints, withdrawal), performance of the contract and legal obligations (Art. 6(1)(b) and (c) GDPR).
  • Google Analytics – your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time in “Cookie settings” in the footer.

6. Recipients of data

We share data only with providers who help us run the Service. They process it on our behalf under data processing agreements, unless stated otherwise. Only the Provider has access to the data in our database. We do not read your conversations unless this is necessary to handle your request, investigate abuse or comply with a legal obligation.

  • Hetzner Online GmbH (Germany) – server and PostgreSQL database; data stored in Hetzner's data centre in Helsinki (Finland, EU).
  • Google (Google Gemini API) – generating replies, building the context profile, moderation, language detection and translation. Google processes message content and the context profile as a processor, does not use them to improve its products and keeps them for a limited time solely to detect violations of its policies.
  • Google (Firebase Authentication) – sign-in with a Google account.
  • Google (Google Analytics 4) – visit statistics, only after consent.
  • Google (Gmail) – the mailbox that receives contact form messages and e-mails sent to us.
  • Resend – sending e-mails: sign-in links and contact form messages.
  • Public authorities – only where required by law.

7. Transfers outside the EEA

Google and Resend may process data in the United States. Transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) for recipients participating in it, or on standard contractual clauses approved by the Commission. You can obtain a copy of the safeguards by writing to the address in section 1.

8. How long we keep data

  • Account data, consents, settings and counters – until the account is deleted.
  • Conversation history – recent messages until the next summary (section 4), after which the 20 most recent remain; all of it until the account is deleted.
  • Context profiles – the two most recent, until the account is deleted.
  • Usage metadata – until the account is deleted; it is then anonymised (the link to the account is removed) and may be kept as statistics.
  • Server logs – up to 30 days.
  • Database backups – 14 days, after which they are deleted automatically. Data deleted from the database disappears from backups at the latest after this period.
  • Sign-in links – valid for 15 minutes and single-use; expired links and abuse-protection counters are deleted automatically within 7 days.
  • Contact messages – until the matter is resolved, or, where they concern complaints, withdrawal or claims, until the limitation period for claims expires.
  • Data in Google Analytics – 2 months (cookie lifetimes – section 10).

9. Your rights

  • Access and a copy of your data – in your Profile (“Download my data”: a JSON file with your account data, conversation history, context profiles and counters) or on request.
  • Rectification – change your name and language in your Profile, other data on request.
  • Erasure – in your Profile (“Delete account”). We delete your account, conversation history, context profiles, counters, sign-in links and abuse-protection counters, and anonymise usage metadata.
  • Data portability – the JSON file from “Download my data”.
  • Restriction of processing – on request.
  • Objection – to processing based on our legitimate interests, on grounds relating to your particular situation.
  • Withdrawal of consent – at any time: consent to special-category data by deleting your account, consent to Google Analytics in “Cookie settings”.

Requests and complaints

Send requests to jakubkoladadev@gmail.com or via the contact form. We will reply within one month (in specific cases this may be extended as allowed by the GDPR). We may ask you to confirm that the request comes from the account holder. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland) or with the supervisory authority in your EU country of residence.

10. Cookies and browser storage

We use cookies and browser storage (localStorage, sessionStorage, IndexedDB) that are necessary for the Service to work. Google Analytics cookies are set only after you click “Accept” in the banner. You can change your choice at any time in “Cookie settings” in the footer. We do not use advertising cookies.

Necessary (name – purpose – lifetime – provider):

  • cookie-consent (localStorage) – your analytics choice – until you change it or clear browser data – EchoInsight
  • access_token, refresh_token (localStorage) – keeping you signed in – access token valid for 1 hour, refresh token for 30 days; removed on sign-out – EchoInsight
  • user, pendingUser, emailForSignIn (localStorage) – profile data needed to display the Service and the e-mail address to complete link sign-in – until sign-out or sign-in – EchoInsight
  • oauthInProgress, oauthRedirectComplete, isLoggingOut (sessionStorage) – handling Google sign-in and sign-out – until the tab is closed – EchoInsight
  • firebaseLocalStorageDb (IndexedDB) – Google sign-in session – until sign-out – Google (Firebase)
  • NEXT_LOCALE (cookie) – selected language – until the browser is closed – EchoInsight
  • theme, selectedCurrency, lastPricingLocale (localStorage) – theme and the currency shown on the “Pricing” page – until changed or browser data is cleared – EchoInsight
  • echoinsight_comments (localStorage) – your private notes on blog posts, stored only in your browser – until browser data is cleared – EchoInsight

Analytics – only with your consent:

  • _ga (cookie) – distinguishing users in Google Analytics 4 – 2 years – Google
  • _ga_<ID> (cookie) – keeping session state in Google Analytics 4 – 2 years – Google

Google sign-in pages use their own cookies under Google's policy.

11. Security

Connections to the Service are encrypted (HTTPS). The server and database are located in the EU. We do not use passwords – you sign in with a single-use link or a Google account, and sign-in links are stored only as a hash. Conversation content is not written to logs. Only the Provider has access to the server and database.

12. Age 18+

The Service is intended only for people aged 18 or over. We do not knowingly collect data from minors. If we learn that an account belongs to a minor, we will delete it.

13. Changes to this Policy

We update this Policy when the way we process data or the law changes. We will inform you of significant changes by e-mail and in the Service before they take effect. If a change requires new consent, we will ask for it.

EchoInsight.Me - Reflection. Realized.