Privacy Policy

Effective date: June 13, 2026 · Metaphy LLC

Your data is yours. We built the architecture to reflect that — not just to promise it. Where Echo runs on your hardware, your conversations never reach our servers. Where your avatar lives on your machine, we can't see it. We designed it this way on purpose.

This Privacy Policy explains how Metaphy LLC ("Metaphy," "we," "us," "our") collects, uses, stores, and protects your personal information when you use EchoIsMe.ai and all related products and services — including ECHO, PRISM, Echo Avatar Studio, Echo Everywhere, EchoForge, and any associated websites, applications, and pipelines (collectively, the "Services"). It is incorporated into and forms part of our Terms of Service. By using the Services you agree to the practices described here.

1. Who We Are

Metaphy LLC is a California limited liability company operating under the brand EchoIsMe.ai. We build personal AI desktop companions, avatar pipelines, and local-first AI infrastructure for individual users and small teams.

Our core privacy philosophy is simple: your data is yours, and the architecture enforces it. Primary contact for all privacy matters: logan@metaphysicsandcomputing.com.

2. Information We Collect

We collect only what we need to operate the Services. Here is every category, stated plainly.

2.1 Information you give us directly

• Account registration: your name, email address, and password (stored as a one-way hash — we cannot read it).
• Order & payment information: billing name and address, and payment method. Card data is processed directly by our payment processor and is never stored on Metaphy's servers — we receive only a tokenized reference and the last four digits.
• Custom avatar commission materials: reference photographs or images, written descriptions, and voice samples (if voice integration is selected). Reference photographs containing your likeness constitute biometric information under California law — see §4.3.
• Support communications: your name, email, a description of your issue, and any files you attach.
• Feedback & survey responses you voluntarily provide.

2.2 Information generated automatically

• Technical telemetry (opt-in only): anonymized, aggregated crash reports, feature-usage frequency (which panels you open, not what you type), and performance diagnostics. It does not include conversation content, memory contents, or commission materials. Opt out any time in Settings → Privacy → Telemetry.
• Cloud inference metadata (transient): account identifier, request timestamp, and request count, retained for abuse detection and automatically purged within 72 hours. We do not retain the content of your inference requests.
• Account activity logs: login timestamps/IPs and account changes, retained 90 days for security and fraud detection.
• Cookies & local storage: strictly-necessary cookies (session/auth) and optional preference cookies. No advertising cookies, tracking pixels, or cross-site behavioral analytics.

2.3 Information we do NOT collect

• The content of your conversations with Echo when inference runs locally.
• The contents of your Echo memory when stored locally.
• Your delivered avatar files after delivery.
• Your browsing history, location data, contacts, or device identifiers beyond the above.
• Data about you purchased from third-party data brokers.
• Behavioral profiles for advertising.

3. How We Use Your Information

We use information only for these purposes: providing and operating the Services; processing payments; delivering custom avatar commissions; customer support; detecting and preventing abuse; sending transactional communications; sending product updates (opt-out available); improving the Services via opt-in anonymized telemetry; and complying with legal obligations. We do not use your information for any purpose not listed here without your explicit prior consent.

3.1 Marketing communications

We may send product announcements and early-access offers by email. Every marketing email includes a one-click unsubscribe; requests are processed within 10 business days. We do not sell your email address. Ever.

3.2 No automated decision-making with legal effect

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Sensitive Information

Under the CCPA as amended by the CPRA, the following are sensitive personal information and receive heightened protection: biometric information (facial geometry, voice prints), financial account details, precise geolocation, contents of private communications, and health information.

4.1 Financial information

Payment card details are handled exclusively by our PCI-DSS compliant payment processor and are never stored on Metaphy's infrastructure. We receive only a payment token and the last four digits. Your full card number, CVV, and expiration are never transmitted to or stored by Metaphy.

4.2 Biometric information — avatar commission materials

A reference photograph for a custom avatar may contain your facial geometry, which is biometric information under California Civil Code §1798.100 et seq. It is used solely to generate your custom avatar, is not used to train any model, is not shared with any third party beyond the pipeline operators performing your commission, and is deleted from our working systems within 30 days of delivery. Submitting reference materials constitutes specific, informed, voluntary consent to this processing — and you are never required to submit a photo of yourself; a written description or concept art is always an acceptable alternative. You may withdraw consent any time before active build by emailing us.

4.3 Voice samples

Voice samples for Echo voice integration are biometric information; the same protections apply. They are used solely for your Echo voice model, are not shared beyond the pipeline operators performing your build, and are deleted within 30 days of delivery. Your trained voice model resides on your hardware; Metaphy does not retain a copy after delivery.

5. How We Share Your Information

We do not sell your personal information. We do not rent it, broker it, or exchange it for value. Full stop. We share only in these limited circumstances:

5.1 Service providers

A small number of trusted providers help us operate the Services, accessing your information only as necessary and contractually prohibited from using it for any other purpose:

5.2 Avatar pipeline contractors

Contractors performing specific pipeline steps receive only the reference materials necessary for their step, are bound by confidentiality, do not retain your materials after their step, and may not use your likeness for any portfolio, promotional, or training purpose without your explicit written consent.

5.3 Legal requirements

We may disclose information where required by law (valid court order, subpoena, or legal process; to comply with law; to protect rights, property, or safety where permitted; or in connection with a legal claim). Where legally permitted, we will notify you before disclosing in response to a legal demand.

5.4 Business transfers

In a merger, acquisition, or asset sale, your information may transfer as part of the transaction. We will notify you by email at least 30 days before your information becomes subject to a materially different policy, and you may delete your account before the transfer. Any successor must honor this Policy or obtain fresh consent.

5.5 With your consent

Beyond the above, we share only with your explicit, informed, prior consent, which you may withdraw at any time.

6. EchoForge — Your Private Repository

EchoForge is Metaphy's private, sealed memory and sync infrastructure for Echo Everywhere subscribers.

6.1 Architecture

Each EchoForge instance is a dedicated, isolated repository provisioned exclusively for your account — physically and logically separated from all other customers, accessible only through your authenticated credentials, encrypted at rest (AES-256) and in transit (TLS 1.3), and never pooled or co-mingled with anyone else's data.

6.2 Metaphy access to your repository

We do not access your repository contents except: (a) at your explicit request (e.g., a documented support session — logged, time-limited, revoked at end); (b) infrastructure maintenance that does not expose contents to human eyes (logged); or (c) legal obligation per §5.3. All access is logged with timestamp, accessor identity, and purpose; request your access log any time.

6.3 What lives in EchoForge

Your Echo's persistent memory and context, configuration and personality settings, cross-device session state, and files you explicitly save. It does not store locally-processed sessions never synced to it, your delivered avatar files, or payment/billing information.

6.4 Data portability

Export the complete contents of your repository any time through your account portal, in standard JSON. We will never lock your data in a format designed to prevent you from leaving.

6.5 Retention after cancellation

When your EchoForge subscription ends, your repository remains accessible for 30 days to allow export (with a reminder at 7 days), then is permanently and irreversibly deleted. Export before you cancel — we cannot recover it after deletion.

7. Your Privacy Rights

7.1 Rights available to all users

Regardless of where you live: the right to access (within 30 days), correction (14 business days), deletion (30 days, subject to §7.3 exceptions), data portability (30 days), withdraw consent, and opt out of marketing (10 business days).

7.2 Additional rights for California residents (CCPA/CPRA)

California residents also have the right to know, to delete, to correct, to opt out of sale or sharing (Metaphy does not sell or share personal information for cross-context behavioral advertising — satisfied by our architecture), to limit use of sensitive personal information, to non-discrimination for exercising rights, and to use an authorized agent. To limit sensitive-data use, email us with subject line "LIMIT SENSITIVE DATA USE."

7.3 Exceptions to deletion rights

We may retain information despite a deletion request where necessary to complete a requested transaction, detect or investigate security incidents or fraud, comply with a legal obligation, exercise or defend legal claims, or perform internal operations aligned with your expectations. We will tell you the basis in our response.

7.4 How to submit a rights request

Email logan@metaphysicsandcomputing.com with subject line "PRIVACY REQUEST — [type]." We acknowledge within 5 business days and respond within 30 days (with up to 60 additional days for complex CCPA requests, on written notice). We verify identity before processing and ask only for what is reasonably necessary.

8. Data Security

We implement industry-standard measures: encryption at rest (AES-256) and in transit (TLS 1.3); role-based access controls; access logging; PCI-DSS compliant payment processing (card data never touches our servers); and a local-first architecture — data that never leaves your machine cannot be breached on our end.

What we cannot guarantee: no security system is impenetrable. You are responsible for safeguarding your credentials, using strong unique passwords, enabling available two-factor authentication, and securing your local device.

8.3 Breach notification

In a confirmed breach affecting your personal information, we will notify you by email within 72 hours of becoming aware, to the extent practicable, including the nature of the breach, categories of information affected, approximate number of individuals affected, steps we are taking, steps you can take, and contact information for follow-up.

9. Data Retention Schedule

Order records are kept for 7 years because U.S. tax law requires it — a legal obligation we cannot waive even on a deletion request, applying only to transactional records, not your product data or content.

10. Children's Privacy

The Services are not directed at or intended for children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has provided information, email us with subject line "CHILD PRIVACY CONCERN" and we will delete it within 72 hours of a verified report. Users aged 13–18 must have a parent or guardian's permission to use the Services.

11. Third-Party Links & Integrations

Our site may link to third-party websites we do not control and are not responsible for; review their policies before sharing data. Integrations you enable (calendar, email, etc.) are governed by that service's own terms — Metaphy receives only the data necessary for the integration you enabled, and you can revoke any integration in account settings. Where we use third-party model providers for cloud-overflow inference, we select providers that do not train on customer inference data and are bound by data-processing agreements; specific provider information is available on request.

12. Changes to This Privacy Policy

Material changes (affecting your rights, the data we collect, how we use it, or who we share it with) are communicated by email at least 30 days before they take effect, with a prominent website notice. Minor changes are posted with an updated effective date. If you object to a material change, you may delete your account before it takes effect and receive a prorated refund of any prepaid subscription period. We keep an archive of prior versions, available on request.

13. Contact Us

For any privacy question, request, or concern: Metaphy LLC, Attn: Privacy · logan@metaphysicsandcomputing.com (subject: "PRIVACY REQUEST — [type]"). Response commitment: 5 business days to acknowledge, 30 days to resolve. If you are not satisfied with our response, you may lodge a complaint with the California Attorney General's Office (California Department of Justice, Privacy Enforcement and Protection Unit, P.O. Box 944255, Sacramento, CA 94244-2550).

Appendix A — CCPA/CPRA Disclosure

A.1 Categories of personal information collected (last 12 months)

A.2 Sale or sharing

Metaphy does not sell personal information, and does not share it for cross-context behavioral advertising. No opt-out mechanism for sale is required because no sale occurs; you may confirm this in writing on request.

A.3 Sensitive personal information — purposes & limits

A.4 Your CCPA/CPRA rights — quick reference

This Privacy Policy is incorporated into the Metaphy LLC Terms of Service. © 2026 Metaphy LLC — Universal Computing and Solutions. All rights reserved.