Privacy Policy
Last updated: 4 November 2026
Echodu is an app for learning German. This page explains what personal data we collect, why, who receives it and what you can do about it. We don't sell your data, we don't show ads, and we use no advertising or social media trackers.
Who is responsible
Echodu is run by Mo Ravaei, who is responsible for your data. Write to hello@echodu.com with any question about it.
What we collect and why
Your account
Your email address, language and appearance settings, your answers when you start (how much German you know, which chapter you start from), and when you joined and last signed in. We need this to sign you in and run your account (GDPR Art. 6(1)(b)). We keep it until your account is deleted.
Signing in
When you ask for a sign-in code we store your email address and the code in protected form, and delete them soon after the code expires. Codes and links are the only emails we send.
Your progress
Your lessons, steps, Echo points and level, stored on our server and in your browser so they follow you between devices (Art. 6(1)(b)). We keep them until your account is deleted.
How the app is used
For everyone who visits, signed in or not, we log each page request and what happens in the app:
- your IP address, country, browser, operating system, device type, screen size, connection type, language and time zone;
- the page or link that brought you here;
- pages and lesson steps opened, buttons and links tapped, time spent, sentences finished and words missed, quiz progress, whether the microphone is allowed, errors and loading times.
We use this to see how people learn, fix what breaks and keep the service safe from attacks, which is our legitimate interest (Art. 6(1)(f)). You can object at any time. We delete these records after 7 days. For accounts we keep a summary per day (for example active minutes, steps done, errors) for 90 days.
When you write to us
Your email address and your message, for as long as we need them to answer you (Art. 6(1)(f)).
Your voice
Some steps follow your voice as you speak German. Your browser asks for microphone permission first. If you don't allow it, you can tick sentences off by hand.
- On a computer, speech is recognized inside your browser and no audio leaves your device. If that can't load, your browser's speech service is used instead, as on a phone.
- On a phone or tablet, your browser's own speech service does the listening. Your audio goes to its maker, such as Apple in Safari or Google in Chrome, under their privacy terms. We never receive that audio, and we don't store the words it hears.
- Recordings: we only record your voice if you have personally agreed with us, as some beta testers have (Art. 6(1)(a)). Their spoken sentences, with the words recognized, are stored on our server so we can replay them and improve how Echodu follows speech, and are deleted after 30 days. You can withdraw at any time by writing to us. Without that agreement, nothing is recorded.
Cookies and browser storage
We use no advertising cookies. These are ours:
| Name | What it does | Kept for |
|---|---|---|
echodu.auth | Keeps you signed in | 90 days, renewed on each visit |
.AspNetCore.Antiforgery.* | Protects forms against forgery | Until you close the browser |
.AspNetCore.Culture | Remembers your language | 1 year |
echodu.theme | Remembers light or dark when you're signed out | 1 year |
tz | Your time offset, so your days count correctly | 1 year |
echodu.did | A random ID for this browser, to tell visits apart in our usage records | 1 year |
echodu.scr | Your screen size, for our usage records | 1 year |
echodu.src | Which link brought you here, for example a social media post | 90 days |
Lessons also keep your progress and settings in your browser's local storage, and Cloudflare may set its own security cookies. You can clear all of this in your browser's settings, but you will be signed out.
Who receives your data
Only the services we need to run Echodu:
- Hetzner (Germany) hosts our server and database.
- Cloudflare protects and delivers the site, and so handles every request, including your IP address.
- Resend sends sign-in emails and receives your email address.
- Purelymail hosts our mailbox and receives what you write to us.
- Google Fonts serves the site's fonts. Your browser contacts Google, which sees your IP address.
- jsDelivr and Hugging Face serve the speech engine and German language model, downloaded once on computers. They see your IP address.
- Apple, Google or another browser maker provides speech recognition on phones and tablets, as described above.
Some of these companies work outside the EU, mainly in the US. Those transfers rely on safeguards the GDPR allows, such as the EU–US Data Privacy Framework or standard contractual clauses.
Our pages on Instagram, Facebook and other platforms fall under those platforms' own privacy policies. We receive no data from your accounts there when you follow a link to Echodu, only that the link came from them.
Your rights
You can ask us for a copy of your data, and to correct, delete, restrict or transfer it. You can object to our use of it based on legitimate interest and withdraw any consent. Write to hello@echodu.com and we will answer within one month. You can also complain to a data protection authority.
Delete your account and data
Email hello@echodu.com from your account's address with the subject "Delete my account". Within 30 days we delete your account, your progress and any recordings. Usage records run out on the schedule above. This can't be undone.
Children
Echodu is meant for people aged 16 and over. If you think a child under 16 has signed up, write to us and we will delete the account.
Changes
When we change this policy we update the date on top. If a change matters to you, we will also tell you in the app or by email.