Last updated: November 5, 2026
Echo Plus is a private chat app. This policy explains in plain English what we collect, why, and what we never do. "We" means Kingman Legacy Holdings CA01, LLC, the company that runs Echo Plus.
Server and hosting logs, including IP addresses, are kept by our hosting provider for up to 30 days under our configuration. Billing records are held by the Apple App Store and Google Play under their policies. Encrypted server backups of account and system records (never your chat history or private keys), if any, are kept for up to 30 days and then deleted. AI requests are not stored by Echo Plus; Google keeps them for a limited time under its terms (for the paid Gemini API, currently up to about 55 days, which Google may change).
We use a small set of providers only to run Echo Plus. They process the limited information described here to provide their service to us; this policy does not authorize them to use it for their own advertising.
Your message history, contact nicknames and your helper's "About" memories stay on your device. They are not uploaded to us. Echo Plus does not offer cloud chat backups — your message history and private decryption keys live only on your phone, and if you lose or reset your phone without transferring them, old chats cannot be recovered.
Contacts: Echo Plus never uploads or reads your phone address book; you connect by username or invite link. Only your public encryption keys are stored on our server so contacts can encrypt to you; your private decryption keys and contact nicknames stay only on your phone.
Echo Plus helpers suggest replies using Google Gemini. This also covers Translate, Fix typos/Reword, link summaries and voice-note help when you choose those features: when you tap Translate or ask for a rewrite, the text you select is sent for that request. When you use a helper, we send Gemini only:
Each person controls their own messages. If the person you're chatting with turns their setting down or sets it to 0, their messages are never sent, even if your setting is higher.
We use Gemini's paid API. Under Google's terms, Google does not use this data to train its models and keeps it for about 55 days to check for abuse. Echo Plus does not store your helper requests. You don't have to use the helper at all.
If a chat's disappearing-messages timer is on, new messages are removed from participating phones after the chosen time (5 minutes, 1 hour, 1 day or 1 week). A person who receives a message can still copy, save, screenshot or photograph it, or use another device before it disappears, so disappearing messages are not a guarantee that every copy will be erased.
Voice and video calls are end-to-end encrypted, peer to peer: the audio and video travel directly between the callers' phones, and when a relay is needed the call goes through Cloudflare's network — the relay cannot hear the call. Group calls use the same peer-to-peer encryption between each pair of phones. We don't record calls. Echo Plus is not a replacement for your phone service and does not connect to 911 or other emergency numbers. In an emergency, use your phone's regular dialer or another telephone service.
We work to protect the limited account data we hold, investigate security incidents promptly, and notify affected users and authorities when required by law.
Because our servers relay message content as ciphertext and do not hold the decryption keys, we do not have readable message content to provide. What we may have is metadata (account identifiers, sender and recipient, timestamps, delivery status, device and push tokens, and IP addresses), abuse reports (account and timestamp metadata only), and content you chose to send to an AI feature. If we get valid legal process (such as a subpoena or court order), we will provide only what we actually have that the process covers. We review every request and push back on requests that aren't valid. Where legally permitted, we notify users of valid legal requests for their account information before or after responding, unless prohibited by law or court order or in an emergency involving danger of death or serious physical injury.
We have zero tolerance for child sexual abuse and exploitation and for the other conduct banned by our Terms of Use. You can block anyone and report abuse in the app. When you report someone in the app, we receive only account and timestamp metadata so we can flag their account for abuse review. A report never sends message text, photos, or chat history, and the person you report is not told. We may suspend accounts that break our Terms. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children and to law enforcement, and preserve the related records for at least one year. If an intimate image of you is shared without your consent, reporting it in the app flags the sender's account for abuse review; to ask for its removal, email us the @username, date and details — never the image itself (see “Intimate images shared without consent” in our Terms of Use). If you contact us by email about abuse or an intimate image, never attach or forward the image itself — share only the @username, date, and locating details.
You can delete your account in the app at Settings > Account > Delete account. If you cannot use the app, use our web account deletion page to request deletion by email. Deleting your account promptly removes your account info, keys, push tokens and any pending messages and media from our servers, normally within 30 days, except where we must keep records by law. Kept records include: abuse reports about you (kept with your account identifier removed), reports related to child sexual abuse material (preserved for at least one year), and store transaction records, which are held by the Apple App Store and Google Play, not by us. Messages already delivered to someone else's phone may remain on that phone. Deleting your Echo Plus account does not cancel a store subscription; cancel that separately in the App Store or Google Play. Data on your phone is erased when you delete the app.
Echo Plus is for people 18 and older. We don't knowingly collect information from anyone under 18. If you think someone under 18 has an account, contact us and we'll delete it.
Depending on where you live, you may have rights to know about and access your information, and to correct or delete it. California residents: under the CCPA/CPRA you may request to know the categories and specific pieces of personal information we hold, access it, correct inaccuracies, or delete it, subject to legal exceptions. The categories we hold are described above: account and contact information, identifiers, encrypted user content we cannot read, usage counts, diagnostic data, subscription status and safety records. We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes beyond those permitted by California law. You or an authorized agent may contact us at the email or mailing address below. We may verify that you control the account or email address before acting, and we will respond within the time required by law. We won't discriminate against you for making a request.
Kingman Legacy Holdings CA01, LLC
Mailing address: c/o California Registered Agent, 1401 21st St Ste R, Sacramento, CA 95811
Email: echoplus@mail.grokbot.com
If we change this policy, we'll update the date above and tell you in the app for important changes.
Echo Plus is run by Kingman Legacy Holdings CA01, LLC. Mailing address: c/o California Registered Agent, 1401 21st St Ste R, Sacramento, CA 95811. Contact: echoplus@mail.grokbot.com. Privacy Policy · Terms of Use · Delete account