Privacy Policy

Last updated: 1 August 2026

Small Echoes is a bedtime ritual: your child records a few seconds about their day, and once a week those recordings become a little audio edition for the family members you have invited. Because the heart of the product is a child's voice, privacy is not a footnote here — it is the design.

Who we are

Small Echoes is operated by [COMPANY DETAILS — legal name, address, CVR number], Denmark ("we"). We are the data controller for the personal data described below. You can reach us at hello@smallechoes.com.

What we collect

• Account data — a parent/guardian's email address (sign-in is passwordless), family language and timezone.
• Child profile — the first name (or nickname) and optional birth month you choose to enter. We deliberately ask for as little as possible.
• Voice recordings — the short clips your child records, and the weekly editions stitched from them.
• Derived audio data — if AI features are enabled: transcripts of clips and short summaries/intro scripts derived from them. These are personal data too and are treated with the same protections and deletion rules as the recordings.
• Listener data — the email addresses of the family members a guardian explicitly invites, and whether a weekly email was opened.
• Payment data — handled by Apple (in-app purchases) or Stripe (web checkout). We never see or store card numbers.

Children's data and consent

Recordings are only ever made in the app by the parent/guardian together with the child, and only after the guardian has given explicit consent in the app. The guardian controls everything: what is recorded, who can listen, and deletion. We never contact children, never show them advertising, and never build profiles of them.

Where your data lives

All recordings, editions and account data are stored on servers in the European Union (Hetzner, Germany/Finland), encrypted in transit and at rest. Audio is kept in private storage — there are no public links; every listen goes through a short-lived, per-person authorised link.

Who processes data for us

What we never do

• Your child's recordings are never used to train AI models — not by us, and contractually not by any processor we use.
• No advertising, no trackers, no analytics cookies — in the app or on this site.
• No public sharing. Only people a guardian explicitly invites can ever listen, and access ends the moment you remove them.
• We never sell or share personal data for marketing.

How long we keep things

Recordings and editions are kept while your account is active, so your family's archive works the way you expect. Deleting a recording, a child's profile, or your whole account removes the underlying audio permanently — including from editions, which are rebuilt or removed. Invited listeners' addresses are kept until you remove them or your account closes. If you stop subscribing, your archive remains yours; delete it at any time.

Your rights

Under the GDPR you can access, export, correct and erase your family's data. Export and permanent deletion are built into the app (Settings → your data) — no email required, though you can always write to us instead. You also have the right to complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

Changes

If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect — never silently.