Privacy Policy

1. Scope

This policy covers the Echo Stories English website and learning app (https://echostoriesenglish.com). We only collect the data needed to run the Service and improve your learning, and we do not sell personal data.

2. Data we collect

• Account: your email address, display name and sign-in method (Google or email) when you sign in. Passwords are handled by Google's Firebase Authentication — we never see or store them.
• Learning data: your answers, test results, progress on each knowledge item, review schedule, lessons received, topics you type, your learning goal and your answers in the welcome steps.
• Payments: order code, plan, amount, status and time of payment. Card numbers and bank details are handled by the payment gateway; we do not store them.
• Technical: IP address, browser / device type, access times, error logs and sign-in sessions — used for security, abuse prevention and troubleshooting.
• Communication: your notification choices, notification email, and your Telegram identifier if you choose to link Telegram.
• Resource forms: the email and details you enter when you request a downloadable resource.
• Measurement: if measurement tools (Google Tag Manager / Google Analytics) are enabled, aggregated usage data such as pages viewed and buttons clicked; we do not send your email or name to these tools.

3. How we use it

• to provide the Service: saving progress, estimating your level, choosing suitable lessons and review times;
• to process orders, activate plans and support payments;
• to send the notifications you chose (study reminders, lesson ready, new sign-in, receipts);
• to protect accounts and the system and to detect fraud and abuse;
• for aggregated analysis that improves our content and product.

4. Cookies and browser storage

We use essential cookies to keep you signed in and to recognise anonymous learners, and browser storage to remember your language, light / dark theme and (in anonymous mode) your progress. If measurement tools are enabled, they may set their own cookies. You can delete or block cookies in your browser; some functions such as sign-in will then stop working.

5. Sharing

We share data only with processors acting on our behalf, and only as far as needed:

• authentication and hosting infrastructure (Google Firebase, Google Cloud);
• content delivery, website protection and the anti-bot check on forms (Cloudflare, including Turnstile);
• payment gateways (payOS, PayPal);
• email delivery services and Telegram (when you link it) to deliver notifications;
• AI model providers used to write lessons — they receive only the list of items to learn and the topic you type, never your name or email;
• measurement tools (Google Tag Manager / Analytics) if enabled.

We may disclose data when the law requires it or to protect the rights and safety of our users and ourselves.

6. Retention

• Account and learning data: kept until you delete your account. When you request deletion the account is locked immediately; after a 14-day waiting period (sign in again to cancel), your profile, progress, purchased plans, notifications and sign-in account are removed from our system and cannot be restored.
• Sign-in sessions: expire after 30 days of inactivity, 180 days at most; you can sign out of all devices at any time.
• Payment records: paid orders are kept for as long as accounting and tax law requires. After you delete your account they remain only in anonymised form (order code, plan, amount, date, transaction reference) and are no longer linked to you; unpaid orders are deleted.
• Technical logs: kept for the short period needed for security and troubleshooting.

7. Your rights

You may access, correct, request deletion of or receive a copy of your data, withdraw consent and object to processing. You can do the following yourself in the app: edit your name and goal, erase your learning progress, turn each kind of notification on or off, unlink Telegram, and delete your account with all its data (Me page → Danger zone). For other requests (such as a copy of your data) write to [email protected]; we respond within 30 days.

8. Security

Data travels over encrypted connections (HTTPS); administrative access is restricted; questions and answers are processed on the server only. No system is perfectly secure — if an incident affects your data, we will notify you as the law requires.

9. Children and child accounts

People under 16 can't sign up on their own. Children aged 4–15 use Echo only through a “child account” that a parent or guardian creates in a Family group. When creating it, the parent confirms they are the parent / guardian, agrees to the child using Echo, takes responsibility for managing the account and confirms the child's birth year is correct (under Vietnam's Law on Children 2016, Decree 13/2023 and the Personal Data Protection Law). Children aged 7 and over get a plain-language explanation the first time they sign in.

For a child account Echo collects: display name, birth year and username; learning progress (lessons done, words known, exercise results); written work and notes; speaking recordings only if the parent turns ON “let AI grade my child's voice” (off by default). We don't collect the child's email, phone number or photo.

Data is sent to: Firebase (sign-in), Google Cloud (storage), Cloudflare (network protection); when the parent enables voice grading — Google Gemini or OpenAI for grading (never to providers whose terms we haven't reviewed). AI call logs store counts only, never content.

Safe defaults: child accounts can't buy anything, invite people, have a public profile or receive marketing email, and only see age-appropriate content; only the child and the parent can see the child's learning. Recordings are deleted after 30 days.

Parents can delete a child account (with all progress, recordings, writing and notes) at any time in Group → Members — Echo deletes it IMMEDIATELY, without the 30-day wait of regular accounts; turning voice grading off stops sending at once. Requests by support email are handled within 72 hours. If you believe a child is using Echo without a parent's consent, contact us and we will delete the data.

10. International transfers

Some of the providers listed in section 5 operate servers outside Vietnam, so your data may be processed in other countries with protection equivalent to that described here.

11. Changes to this policy

When this policy changes we update the effective date at the top of the page and give notice of significant changes.

12. Contact

Questions or requests about your personal data? Write to [email protected].