Privacy Policy

What Echo does

Echo is an iOS app that reads your recent Strava activities and Apple Watch heart rate data, combines them into one complete activity, and uploads the result back to Strava. Echo also reunites split or interrupted recordings into a single activity. All processing happens on your device. Echo does not store any activity data.

Data Echo accesses

Source	What's accessed	Why
Strava API	Recent activity summaries, stream data (power, cadence, speed, heart rate, distance), activity metadata	To identify activities that belong together and to build the combined FIT file
Apple HealthKit	Heart rate samples and activity start/end times from Apple Watch	To add heart rate data to your activities and to identify split activities that belong together

How your data is handled

• All activity processing happens on your device, in memory, while the app is running.
• Apple Health data is read directly on your device. It is never transmitted outside your iPhone.
• Strava data is fetched via the Strava API to your device only — not forwarded to any third party or stored beyond the current session.
• When you upload an activity, Echo sends a FIT file to Strava on your behalf. This is the only moment activity data leaves your device — and it goes directly to Strava, not to Echo.
• Your Strava OAuth tokens are stored in your device's iOS Keychain and never transmitted to Echo.

What Echo sends

FIT files	Uploaded directly to Strava via their API on your behalf. No copy is retained.
Bug reports	If you choose to send one, it's composed in your own Mail app and sent to echo@stephankurz.com. The optional diagnostic log contains activity names and device details to help with debugging. It does not contain health data.
Usage statistics	Anonymous events sent to a self-hosted endpoint (echo.stephankurz.com). See Anonymous analytics below for details.

Third-party services

Strava	Echo uses the Strava API to read activity data and upload merged results. Governed by Strava's Privacy Policy.
Apple HealthKit	Echo requests read access to heart rate and activity data. Governed by Apple's Privacy Policy.

Echo does not include any third-party analytics SDKs, advertising frameworks, or crash reporting services. Analytics are sent to a self-hosted server that stephan operates directly.

Anonymous analytics

Echo collects anonymous usage statistics to understand how the app is used and to identify problems. This data helps answer questions like "are merges succeeding?" and "what equipment are people using?" — without knowing who you are.

What is collected:

• Six event types: app opened, setup completed, activities found, activity uploaded, upload failed, search failed
• Equipment brand category (e.g. "concept2", "apple_watch") and manufacturer device identifier (e.g. "Concept2 RowErg", "Watch7,5") — these are model names assigned by manufacturers, not personal information. Used to improve device compatibility.
• Recording app category (e.g. "runna", "strava") — identifies which app recorded the activity. These are app names, not personal information.
• Error category when something fails (e.g. "no connection", "Strava busy")
• How long key operations take, in milliseconds
• Date only (e.g. "2026-03-18") — no exact times

What is NOT collected:

• No activity names or descriptions
• No account identifiers from Strava or Apple
• No health data — no heart rate values, no calories, no durations
• No location data

Identification:

When you first open Echo, a random identifier is created on your device and stored securely in the iOS Keychain. It is not derived from your Strava account, Apple ID, or any personal information, and is not synced across devices. This identifier allows counting unique devices — not identifying people.

Where data is sent:

Events are sent to echo.stephankurz.com, which stephan operates directly. No third-party analytics services are involved, and IP addresses are used only for rate limiting and are never stored.

Permissions Echo requests

Strava (OAuth)	Read your activities and upload new ones on your behalf. Required for the app to function.
Apple Health	Read heart rate samples and activity metadata. Optional — you can skip this and Echo will work with Strava data only.

Data retention

Echo does not retain any data on its servers. On your device, Echo stores the following between sessions:

• Your Strava login credentials (OAuth tokens), stored securely in the iOS Keychain
• A random device identifier for anonymous analytics, also stored in the Keychain
• Your preference for hiding original activities after uploading

You can revoke Echo's Strava access at any time from your Strava account settings. Deleting the Echo app removes all stored data from your device.

Anonymous usage statistics on the server cannot be linked back to you after deletion, since the device identifier is random and not tied to any account.

Under Swiss data protection law (nDSG Art. 25) and the GDPR (Art. 15, 17), you have the right to request access to your data and to request its deletion. In practice, Echo stores almost nothing server-side — only anonymous analytics events tied to a random identifier, with no way to connect them to you. The most effective steps are: revoke Echo's Strava access from your Strava account settings, or delete the app. For any data request, email echo@stephankurz.com.

Who operates Echo

Echo is designed and built by stephan kurz, a designer based in Zurich, Switzerland. There's no company behind it, just one person and the app. Swiss data protection law (nDSG) applies. For users in the European Economic Area, the General Data Protection Regulation (GDPR) also applies.

Children

Echo is not directed at children under 13 and does not knowingly collect data from anyone under 13.

Changes to this policy

If Echo's data practices change in a meaningful way, this page will be updated with a new effective date.