Work Echo
Get started free
Legal

Privacy Policy

This policy explains how SmartHaggle AI Inc., the operator of Work Echo (workecho.co), handles your information, including data from Gmail received through Google APIs. Effective date: To be set at public launch.

Summary

  • Work Echo reads the email you choose to connect, with read-only access, to find useful work details (preferences, commitments, decisions, follow-ups) and remind you of them while you write.
  • We keep short memories and small source excerpts, not a copy of your inbox.
  • We do not sell your data, use it for advertising, or use Gmail data to train AI models.
  • You can disconnect a mailbox, delete memories, or delete your account at any time.

Information we collect

  • Account information: your name, email address and password (stored only in hashed form), and optional profile details such as job title, company and time zone.
  • Connected mailbox data (Gmail or Outlook, only if you connect one): see the next section.
  • Browser extension data: when you write a draft in Gmail or Outlook on the web, the extension reads that draft's recipients, subject and text so it can find matching memories.
  • Notes you add yourself with Add memory.
  • Billing information: payments are handled by Stripe. We store your subscription status and Stripe customer reference; we never see or store your full card number.
  • Technical information: essential sign-in cookies and basic server logs used to run and secure the service. We do not use advertising or third-party analytics trackers.

Google user data (Gmail)

If you choose to connect Gmail, Work Echo asks Google for these permissions: your basic profile and email address (openid, email), and read-only access to Gmail (https://www.googleapis.com/auth/gmail.readonly). Work Echo cannot send, delete, label or change any email.

What Gmail data we access

  • Messages in your Inbox and Sent mail within the history period you choose, and new messages that arrive afterwards. Drafts, chats, spam and trash are skipped.
  • For each message: sender, recipients (To and CC), subject, date, message and thread identifiers, labels (used only to skip drafts, chats, spam and trash), and the message text.
  • Your Gmail address, to show which mailbox is connected.

How we use Gmail data

  • Only to provide Work Echo's features to you: finding useful work details in your email, saving them as memories you can review, edit and delete, linking them to the right people, avoiding duplicates, and showing relevant reminders while you write.
  • To do this, message text is sent to our AI processing provider (OpenRouter), only to extract memories for you. It is not used to build advertising profiles.
  • We do not use Gmail data for advertising, sell it, transfer it to data brokers, use it to determine credit-worthiness or for lending, or use it to develop, improve or train generalized AI or machine-learning models.

What we store, and for how long

  • Memories you keep: a short statement, its category, context, tags, and the people and projects it relates to. Kept until you delete them or your account.
  • Source details for each memory: the subject, date, message identifier and a short excerpt (up to 400 characters). Deleted together with the memory.
  • People mentioned in memories: name and email address. Deleted when you delete your memories or account.
  • Processed-message records: message identifiers only (no content), so the same email is never processed or charged twice. Deleted with your account.
  • Access tokens from Google: stored encrypted (AES-256-GCM) in a restricted part of our database that only our server can read. Deleted immediately when you disconnect the mailbox or delete your account.
  • Full email bodies are not stored. Message text is read during processing and only the memory and short excerpt above are kept.

Sharing of Gmail data

We share Gmail data only with service providers that help us run Work Echo, only as needed to provide its features, and under their data-processing terms:

  • OpenRouter: AI processing of message text to extract memories and match reminders.
  • Hostinger: hosts the server and database where your data is stored.

We may also disclose data if required by law, or to protect the security of users and the service. We do not otherwise share, sell or transfer Gmail data. No person at Work Echo reads your email unless you ask us to for support, it is needed for security or abuse investigations, it is required by law, or the data is aggregated and anonymized for internal operations.

Limited Use

Work Echo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft Outlook data

If you connect Outlook, Work Echo uses Microsoft's read-only mail permission (Mail.Read) together with User.Read, openid, profile, email and offline_access. Outlook data from your Inbox and Sent Items is used, stored, shared and deleted in the same way as Gmail data described above. Work Echo cannot send email from Outlook.

Browser extension

The Work Echo extension runs only on Gmail and Outlook on the web. While you write, it sends the draft's recipients, subject and text to Work Echo to find matching memories; this text is also processed by our AI provider for matching. We keep a record of which memories were shown, with the recipient and subject, so you can see when a memory was used. Draft text itself is not stored. The extension stores only its connection code in your browser.

Other service providers

  • Resend sends account emails such as sign-up confirmation and password reset (your email address and the message).
  • Stripe processes payments for paid plans.

These providers receive only what they need for their task. Gmail and Outlook message content is not shared with them.

Security

Data is transmitted over HTTPS. Mailbox access tokens are encrypted at rest. Database access is restricted so each user can only reach their own data, and the database is not exposed to the internet. Encrypted daily database backups of the server are kept for up to 7 days.

Retention and deletion

  • Disconnect a mailbox (Integrations or Settings → Data controls): Work Echo's stored access to that mailbox is deleted immediately and no further email is read. Memories you already kept stay until you delete them.
  • Delete memories (Settings → Data controls): removes your memories, their source excerpts, and the linked people and projects.
  • Delete your account (Settings → Data controls): permanently removes your account and all associated data, including mailbox connections, memories, sources and usage records.
  • Deleted data may remain in server backups for up to 7 days before those backups expire.
  • You can also remove Work Echo's access at any time in your Google Account (myaccount.google.com/permissions) or Microsoft account settings.

Your choices and rights

You can view, edit and delete your memories in the app, disconnect mailboxes, and delete your account. Depending on where you live, you may have additional rights to access, correct, export or delete your personal data. Contact us to make a request.

Children

Work Echo is a work tool and is not intended for anyone under 16.

Changes to this policy

We will update this page if our practices change, and notify account holders of material changes by email or in the app.

Contact

SmartHaggle AI Inc., operator of Work Echo. Questions or requests about your data: tke@smarthaggle.ai.