Echo Privacy Policy

Last updated: 13 May 2026
Effective date: 13 May 2026

This Privacy Policy explains how Echo collects, uses, stores, shares, and protects personal data when you use the Echo music streaming application, website, and related services.

By using Echo, you confirm that you have read this Privacy Policy and understand how your personal data is handled. If you do not agree with this Privacy Policy, you should not use Echo.

1. Who We Are

Echo is operated by Echo Music Global Ltd. In Tajikistan, Echo is represented by LLC Ajoibot.

In this Privacy Policy, "Echo", "we", "us", and "our" refer to Echo Music Global Ltd and, where applicable, LLC Ajoibot. Echo acts as the controller of the personal data described in this Privacy Policy.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data that we process when you create an account, sign in, listen to music, build playlists, mark favourites, support artists, apply to become an artist or rights holder, contact our support team, or otherwise interact with Echo.

This Privacy Policy does not apply to third-party services that you reach through Echo, such as external payment providers, login providers, or content linked from outside Echo. Those services have their own privacy policies.

3. Personal Data We Collect

We collect the following categories of personal data:

Account data: name, email address, phone number, password (stored only in hashed form), preferred language, profile preferences, and the role assigned to your account.
Login provider data: when you sign in with Google or Apple, we receive the provider's user identifier and, in some cases, the email address associated with that provider account.
Session and device data: IP address, user agent, device type, operating system, browser, approximate location derived from IP, authentication tokens, and session activity timestamps.
Listening data: the tracks, albums, and artists you play, the time and duration of playback, downloads for offline listening, search queries, favourites, blacklisted tracks, and the playlists you create or save.
User-generated content: playlist names, playlist descriptions, profile fields, and any other content you submit through Echo.
Consent records: the version of each legal document you accepted, the date and time of acceptance, the IP address and user agent at the time of acceptance, and the locale shown to you.
Payment data: when paid subscriptions are introduced, we and our payment partners will process billing information such as cardholder name, masked card details, billing address, transaction identifiers, and payment status. We do not store full card numbers on our servers.
Rightholder data: if you apply to become an artist or rights holder, we collect your legal first name, legal last name, patronymic (where applicable), date of birth, residential or business address, phone number, and any documents you submit to verify your identity or your rights.
Support data: the content of messages you send to our support team, including any attachments and contact details you choose to share.

4. How We Collect Personal Data

We collect personal data from the following sources:

directly from you, when you register, sign in, fill in a form, listen to content, contact support, or otherwise interact with Echo;
automatically, when you use Echo, through your device, your browser, and the requests that Echo receives from you;
from third-party login providers, such as Google and Apple, when you choose to sign in through them;
from payment providers, when subscriptions and tips are introduced;
from rights holders, distributors, and partners, when the data they provide relates to your account or your activity.

5. Why We Use Your Personal Data

We use personal data for the following purposes:

to create and manage your account;
to authenticate you and keep your account secure;
to deliver music, playlists, recommendations, and other features of Echo to you;
to enable offline listening and verify your subscription status when paid plans are introduced;
to process payments, refunds, and chargebacks;
to operate, analyse, debug, and improve the Echo service;
to personalise the service, including recommendations, the home feed, search results, and editorial content;
to compile aggregated statistics about how Echo is used;
to communicate with you about your account, security, legal documents, service updates, and customer support;
to send marketing or promotional messages where permitted by applicable law and your preferences;
to detect, prevent, and investigate fraud, abuse, copyright infringement, and other violations of our terms;
to comply with legal obligations, court orders, and lawful requests from competent authorities;
to establish, exercise, or defend legal claims.

6. Legal Bases for Processing

Where applicable law requires a legal basis for processing personal data, we rely on the following bases:

Performance of a contract: to provide Echo to you in accordance with our Terms.
Consent: for marketing communications, optional features, and other processing that requires consent under applicable law. You may withdraw consent at any time.
Legitimate interests: to operate, secure, and improve the service, to detect and prevent abuse, and to communicate with you about your account.
Compliance with legal obligations: to retain records, respond to authorities, and meet tax, accounting, and other regulatory requirements.

7. Account Registration and Login Providers

You can register and sign in to Echo using your email and password, your phone number, your Google account, or your Apple account.

When you sign in through Google or Apple, we receive a stable identifier from that provider, and, in many cases, the email address associated with the provider account. We use this information to create or link an Echo account for you. We do not receive your provider password.

You can disconnect a linked login provider from your Echo account at any time, provided that you keep at least one working sign-in method.

8. Listening Activity and Analytics

Echo records information about the music you play, search for, save, blacklist, or download for offline listening. We use this information to:

power playback features such as resume, history, and recommendations;
calculate aggregated play counts, popularity rankings, and editorial charts;
report aggregated playback statistics to artists, rights holders, distributors, and partners as required by our agreements;
detect abusive playback patterns, such as artificial streams or fraud.

Artists and rights holders receive aggregated or pseudonymised statistics about plays and downloads. They do not receive your name, email address, IP address, or other directly identifying information.

9. Playlists, Favourites, and User Content

Playlists that you create on Echo, including their names and the tracks they contain, are stored on our servers under your account.

Depending on your settings and the features available in the app, some user content, such as public playlists or your display name, may be visible to other users.

You are responsible for the content you submit through Echo. Echo may review, edit, restrict, or remove user content that violates our Terms, our community rules, applicable law, or the rights of others.

10. Cookies and Similar Technologies

Echo uses cookies, local storage, and similar technologies to:

keep you signed in and maintain your session;
remember your language, theme, and other preferences;
secure the service and protect against fraud and abuse;
measure how Echo is used and improve its performance.

On the Echo website, we use a small number of strictly necessary cookies for authentication and session handling. Where required by applicable law, we will ask for your consent before using optional cookies for analytics or marketing.

You can control cookies through your browser settings, but disabling strictly necessary cookies may prevent parts of Echo from working correctly.

11. Device and Technical Data

When you use Echo, our servers automatically receive technical information that is necessary to deliver the service, including:

your IP address and an approximate location derived from it;
your device type, operating system, browser, and app version;
the requests you make, the responses we send, and any errors that occur;
performance metrics such as load times and crash reports.

We use this information to operate, secure, and improve Echo, and to investigate incidents.

12. Payment Data

When paid subscriptions, tips, or donations are introduced, payments will be processed by third-party payment providers.

Payment providers receive the information necessary to complete a transaction, such as your name, card details, billing address, and transaction amount. Echo does not store full card numbers on its own servers. We receive only the information needed to manage your subscription, such as a payment status, a tokenised reference to your card, and the last four digits of the card number.

Payment providers act as independent controllers of your payment data and apply their own privacy policies.

13. Rightholder and Artist Application Data

If you apply to become an artist, label, or rights holder on Echo, we collect additional personal data necessary to verify your identity and your rights, including your legal first name, legal last name, patronymic (where applicable), date of birth, address, phone number, and any supporting documents you submit.

We use this data to:

verify your identity and your rights to the content you submit;
process payouts, when monetisation features are introduced;
comply with tax, accounting, anti-fraud, and other legal obligations;
communicate with you about your artist or rights holder account.

We retain this data for as long as your artist or rights holder relationship with Echo continues and for the period required by applicable law after that relationship ends.

14. Storage of Audio and Media

Audio files, cover art, and analysis data uploaded to Echo are stored in our object storage and delivered through a content delivery network. These files are linked to the rights holders who provided them and to the tracks they belong to, not directly to consumer accounts.

15. Communications and Marketing

We may use your contact details to send you:

service messages, such as account verification, security alerts, password resets, and legal updates;
operational messages about features, changes, or incidents;
marketing messages about Echo and related offers, where permitted by applicable law and your preferences.

You can opt out of marketing messages at any time using the unsubscribe link in the message or by contacting us. Service and operational messages cannot be opted out of while you have an active account.

16. Sharing of Personal Data

We share personal data only as described in this Privacy Policy. We do not sell personal data.

We may share personal data with:

Service providers that help us operate Echo, such as cloud hosting, content delivery, email delivery, analytics, customer support, security, and fraud prevention providers. These providers act on our instructions and are bound by appropriate confidentiality and data protection commitments.
Payment providers, when subscriptions and tips are introduced, to process payments and prevent fraud.
Login providers, such as Google and Apple, only to the extent necessary to authenticate you when you choose to sign in through them.
Artists, rights holders, distributors, and partners, in the form of aggregated or pseudonymised playback, download, and audience statistics, in accordance with our agreements with them.
Authorities and legal advisers, when we are required to do so by law, court order, or a lawful request, or when we need to establish, exercise, or defend legal claims.
Acquirers and successors, in connection with a corporate transaction such as a merger, acquisition, restructuring, or sale of assets, subject to appropriate safeguards.

17. International Data Transfers

Echo operates internationally. Personal data may be processed, stored, and accessed in countries other than your country of residence, including in jurisdictions that may have different data protection rules.

When we transfer personal data across borders, we take steps to ensure that the data continues to receive an appropriate level of protection, for example through contractual safeguards with our service providers.

18. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy and for the periods required by applicable law.

In general:

account data is retained while your account is active and for a reasonable period after closure for legal, security, and accounting purposes;
listening data is retained in identifiable form for the period needed to operate features such as history and recommendations, and is then aggregated or deleted;
consent records are retained for as long as needed to demonstrate that you accepted the relevant legal documents;
payment and billing records are retained for the period required by tax and accounting law;
rightholder records are retained for as long as the relationship continues and for the period required by applicable law after it ends;
support communications are retained for as long as needed to handle the request and to comply with our legal obligations.

When personal data is no longer needed, we delete it or anonymise it so that it can no longer be linked to you.

19. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, and destruction.

These measures include encryption in transit, password hashing, access controls, signed URLs for private audio files, network protections, monitoring, and internal policies and training.

No security measure is perfect. If you have reason to believe that your account or your personal data has been compromised, please contact us immediately at help@echo.tj.

20. Children's Privacy

Echo is not directed at children under 13 years old, or under the minimum age required by the law of your country, whichever is higher. We do not knowingly collect personal data from children who do not meet this minimum age.

If you believe that we have collected personal data from a child who does not meet the minimum age, please contact us at help@echo.tj so we can review the account and delete the data where appropriate.

21. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

Access: to ask whether we process personal data about you and to receive a copy of that data.
Correction: to ask us to correct inaccurate or incomplete personal data.
Deletion: to ask us to delete personal data, subject to legal exceptions such as our obligation to keep certain records.
Restriction: to ask us to restrict the processing of your personal data in certain circumstances.
Objection: to object to processing that is based on our legitimate interests, including for direct marketing.
Portability: to receive certain personal data in a structured, commonly used, machine-readable format and, where technically feasible, to ask us to transmit it to another controller.
Withdrawal of consent: where processing is based on consent, to withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.
Complaints: to lodge a complaint with a competent data protection authority in your country of residence.

22. How to Exercise Your Rights

You can exercise your rights by contacting us at help@echo.tj. We may ask you for additional information to verify your identity before responding to a request.

We will respond within the time limits required by applicable law. Some requests may be refused or limited in scope where the law allows or requires us to do so, for example where deletion would conflict with our legal obligations.

Many account-level changes, such as updating your name, language, or favourites, can be made directly in the Echo app without contacting us.

23. Automated Decision-Making

Echo uses automated systems to personalise recommendations, build charts, detect abuse, and prevent fraud. These systems do not produce legal effects or similarly significant effects on you without human involvement.

24. Third-Party Services

Echo uses or connects with third-party services, including cloud hosting and content delivery providers, login providers (such as Google and Apple), payment providers, analytics tools, and other technology partners.

Echo is not responsible for the privacy practices of those third parties. Where you interact with a third-party service through Echo, that service's own privacy policy applies.

25. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our service, our practices, or applicable law.

When we make material changes, we will provide reasonable notice, for example through the Echo app, the website, or by email. The "Last updated" and "Effective date" at the top of this Privacy Policy show when the latest version took effect.

Your continued use of Echo after the updated Privacy Policy takes effect means that the updated version applies to your use of Echo. If you do not agree with the updated Privacy Policy, you should stop using Echo.

26. Contact Us

If you have any questions, requests, or complaints about this Privacy Policy or about how your personal data is handled, you can contact us at:

Echo Privacy
Email: help@echo.tj