PRIVACY POLICY PURSUANT TO ART. 13, 14 GDPR — AS OF: 20.03.2026
1. Controller
Jaroslav Kreps, Nicolaistraße 8, 02708 Löbau, Germany
Email: SoulEchoAIAdmin@gmail.com
2. Data Minimization Principle
SoulEcho processes personal data exclusively to provide the service. Only data strictly necessary for operation is collected.
3. What Data Is Collected
3.1 Registration Data
Email address, username, hashed password (email reg.) or Google OAuth data. Legal basis: Art. 6(1)(b) GDPR.
3.2 Journal Entries
Title, text, mood value (1–10), sleep and energy values, weather data, tags. Locally encrypted with AES-256-GCM and synchronized to Firebase Firestore. Legal basis: Art. 6(1)(b) GDPR.
3.3 Usage Data
XP points, level, streaks, badges, privacy PIN (FNV-1a hash), app settings. Legal basis: Art. 6(1)(b) GDPR.
3.4 AI Analysis Data
As journal entries may contain particularly sensitive data (thoughts, feelings, health-related content) within the meaning of Art. 9 GDPR, AI processing is carried out exclusively on the basis of your explicit consent (Art. 9(2)(a) GDPR), granted during onboarding and by enabling AI Reflection. Transmission exclusively via a server-side Firebase Cloud Function — the API key is never visible in the browser.
The following user data flows into the AI prompt depending on the activated function:
• Daily Impulse: Entry text, first name (from registration), streak days, mood trend (3-day average), strongest and weakest soul dimension (as label), if applicable the most notable relationship pattern label (only with Dynamics Pack active)
• Weekly / Monthly Analysis: Entry snippets (max. 200 chars/entry), first name, dimension labels
• Character Profile: Last 7 entries; with Dynamics Pack additionally assessment of 6 relationship pattern axes (scores 0–1)
• Dynamics Analysis (Dynamics Pack): Entries in which relationship patterns were detected; analysis yields a short reflection text per axis
• Echo Dialog (Premium): Entry, current dialog rounds; with existing character profile additionally strengths/growth areas as silent context
The AI-generated results — daily impulses, character profile (aggregated dimension values 0–1), relationship pattern scores, weekly and monthly reports, and dialog content — are stored in Firebase Firestore under the user ID. Raw texts are not permanently retained server-side. No automated decision-making with legal effect takes place (Art. 22 GDPR). Legal basis: Art. 6(1)(b) GDPR.
4. Recipients and Third-Country Processing
Firebase / Google Cloud
Authentication and storage in region europe-west1. Google is a processor under Art. 28 GDPR; EU standard contractual clauses applicable.
Anthropic (Claude API)
Transmission only when AI function is activated. Anthropic does not permanently store user data. Basis: Art. 49(1)(a) GDPR (explicit consent).
5. Data Security
5.1 Standard
Entries are transmitted to and stored in Firebase Firestore for synchronization. Transmission exclusively via TLS/SSL.
5.2 Optional End-to-End Encryption (Ultra)
AES-256-GCM on device; key derived via PBKDF2, never stored. Applies to: journal entries and all AI analyses (daily impulse, weekly analysis, monthly synthesis, character analysis, dynamics). The user is solely responsible for safeguarding their passphrase. Due to the zero-knowledge architecture, recovery of data by the Operator is technically impossible. Loss of passphrase results in irreversible data loss for encrypted content.
6. Retention Period
Entries are marked as inactive and hidden from all views. They remain in the database so that ongoing AI analyses function correctly. Full data deletion occurs with account deletion within 30 days.
7. Rights of the Data Subject (Art. 15–21 GDPR)
- Access (Art. 15): What data is stored about you
- Rectification (Art. 16): Correction of incorrect data
- Erasure (Art. 17): "Right to be forgotten"
- Restriction (Art. 18): Restriction of processing
- Data portability (Art. 20): Export as PDF/JSON via Profile → Export
- Objection (Art. 21): Objection to processing
- AI Withdrawal: Disable AI function at any time in Settings → AI Reflection
Requests to: SoulEchoAIAdmin@gmail.com
8. Right to Complain
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — competent authority based on your place of residence.
9. Automated Decision-Making
AI impulses, analyses, and dialogs do not constitute automated decision-making under Art. 22 GDPR. They produce no legal effect and are non-binding reflection prompts. The local soul dimensions analysis runs entirely on the device without data transmission.
10. Cookies and Tracking
SoulEcho uses no tracking cookies, no third-party analytics tools, and no advertising tracking. Only functionally necessary localStorage. No profiling.
11. EU AI Act (Regulation (EU) 2024/1689)
Labeling obligation under Art. 50 AI Act:
All AI-generated texts in SoulEcho — daily impulses, weekly analyses, monthly syntheses, and Echo dialogs — are visibly labeled as AI content in the interface (icon "✦ ECHO" or "Generated by AI"). The user is informed before first AI use that they are interacting with an AI system.
No high-risk AI under Art. 6 AI Act:
SoulEcho uses AI exclusively for personal reflection. The system makes no decisions with legal or comparably significant effect (Art. 22 GDPR / Art. 50 AI Act). It is a general-purpose AI system (GPAI) with purely supportive character.
Operator obligations under AI Act:
As a provider, SoulEcho transparently informs about AI use (this statement and in-app notices), makes no misleading claims about AI capabilities, and complies with applicable requirements for GPAI systems.