EchoFox

GDPR overview

There is no GDPR implementation to report, and the point deserves to be stated plainly: across the eleven pages collected, the words GDPR and CCPA do not appear once. The privacy policy is a short generic document naming no legal basis for processing, no right of access, rectification, erasure or portability, no supervisory authority, no Article 27 EU representative and no data protection officer. It carries no effective date and no revision history, so nothing indicates when it was last reviewed. This is silence rather than refusal: EchoFox nowhere claims to be exempt or non-compliant, it simply never addresses the subject. A privacy contact does exist, privacy@echofox.pro, and it is the only route open to a European user wanting to exercise a right.

Who owns the data?

The terms assign EchoFox and its licensors ownership of the service and of the material it contains — software, text, graphics, logos — but they never state who owns the transcriptions produced for you. No licence over that output is granted to the user, and none is claimed by the vendor either: the question is simply left unaddressed. The privacy policy adds that anonymised audio samples and transcriptions may be collected to improve the service, and that information may be shared with third-party service providers, with law enforcement on legal request, and with an acquirer in the event of a merger, reorganisation or sale of assets. Ownership of your own transcripts therefore rests on nothing written.

Reuse rights

Nothing in the terms restricts what you do with a transcription you receive: no licence condition, no attribution requirement and no resale clause is attached to the output, so reuse is unrestricted in practice. That silence cuts both ways — the permission is implicit rather than granted, and there is no clause you could point to if it were ever contested. The restrictions that are written concern the service itself: you may not reproduce EchoFox's software, text, graphics or logos without written consent, and you agree to use the service only for lawful purposes. In the other direction, the vendor reserves the right to collect anonymised audio samples and transcriptions to improve the service, and no opt-out is described anywhere.

Data retention & training

Hosting summary

EchoFox publishes nothing about where user data is hosted. None of the eleven pages collected names a country, a region, a cloud provider or a data centre, and the site has no trust or security page. The privacy policy limits itself to saying that reasonable measures are taken to protect information from loss, theft, misuse and unauthorised access, without describing a single one of them. No subprocessor is named, even though the terms acknowledge that information may be shared with third-party service providers. One technical detail should not be mistaken for an answer: the domain resolves to an anycast address served by Fastly with GitHub Pages headers, which describes the marketing website only and says nothing about where audio, transcriptions or account data are processed and stored. Anyone with a jurisdictional requirement will have to ask privacy@echofox.pro directly, because the published documentation does not answer the question.