1. Scope
This Privacy Policy applies to the PenEcho Cloud website, account console, community previews, cloud project storage, signed-in app synchronization, and device relay available through penecho.ai. A self-hosted or local PenEcho installation may process data entirely on the computer or server you control. This policy does not replace the privacy terms of a model provider, OAuth provider, or other service you choose to connect.
Administrative boundary: PenEcho administrators can see account identity, status, credits, quota, service health, aggregate usage metadata, intentionally public Crafts, and reports about them. Administrative APIs are designed not to return private Canvas names, private thumbnails, private files, prompts, model responses, or private Canvas content.
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Account and identity | Name, email address, verification state, account status, OAuth provider identifiers, credits, and storage quota. | You, Amazon Cognito, Google, or GitHub when selected. |
| Cloud projects | Folders, project and Canvas records, saved revisions, files, compact WebP thumbnails, timestamps, favorites, and deletion state. | Your browser or linked PenEcho client. |
| Public Crafts | Published artifacts, automatic WebP previews and thumbnails, titles, descriptions, categories, tags, continuation prompts, parent and lineage identifiers, contributor attribution, license and training-permission records, saves, downloads, continuations, distribution layer, reports, and moderation status. | You, other Crafters who continue a lineage, and community activity. |
| Linked devices | Device name, platform, public key, token hash, connection status, last-seen time, and relay routing metadata. | Your linked local PenEcho service. |
| Model request metadata | Time, request source, device, provider type, result, duration, and error category. Request history does not include prompt text, Canvas content, images, model output, or API keys. | A signed-in PenEcho app and the request relay. |
| Security and operations | IP address, browser and device information, request identifiers, authentication events, rate-limit events, and service diagnostics. | Your connection, Cloudflare, and service infrastructure. |
| Support communications | Contact topic, title, message content, optional reply email, attachments you choose to email directly, and correspondence history. | You, Amazon SES, and Zoho Mail when you contact us. |
3. How we use data
We process data to provide accounts, authenticate users, save and synchronize projects, route linked-device requests, calculate credits and quotas, respond to support, prevent abuse, keep the service reliable, and meet legal obligations. We may use aggregate statistics that do not identify individual Canvas content to understand capacity and service health.
Where applicable, processing is based on performing the service you request, our legitimate interests in securing and improving the service, consent where required, and compliance with law. We do not sell personal information or use private Canvas content for targeted advertising.
4. Canvas content and AI requests
Cloud projects and thumbnails are stored so you can reopen them from signed-in devices. They are private to your account unless you deliberately export or publish them. PenEcho does not use private Canvas content, drafts, link-only content, linked-device traffic, API keys, private prompts, or private model responses to train its own models.
Publishing a public Craft requires a separately recorded model-training permission; only Crafts with that permission are eligible for PenEcho training. For a multi-step Craft, every included contribution must carry the required permission before the complete lineage is eligible. Eligible records retain provenance including the Craft and version identifier, contributor, parent, applicable license and publication-terms version. PenEcho may exclude a Craft from datasets following rights, privacy, safety, quality-control, or moderation review.
When you use a linked local model, the request content needed to perform that request may pass through the PenEcho relay over HTTPS and WSS. During trial operation this relay is encrypted in transit but is not end-to-end encrypted. The request content is not written to the request-history record. Your local model API keys and CLI credentials remain on your linked computer.
If you choose a third-party model or integration, that provider may receive the content you submit to it and will process that content under its own terms and privacy policy.
7. Retention and account deletion
We generally keep account and cloud project data while your account is active and for as long as reasonably needed for the purposes described in this policy. Retention periods may vary based on operational needs, backup cycles, security, dispute resolution, legal obligations, and technical limitations.
When you request account deletion, the account currently enters a 30-day recovery period. You can cancel during that period. After it expires, active account data and stored Canvas files are scheduled for deletion, subject to legal, security, fraud-prevention, backup, and technical retention needs.
Deleted data may remain in disaster-recovery backups, logs, caches, noncurrent object versions, or records required for legal and security purposes until those copies expire or are overwritten. Retention descriptions are not a guarantee that any data will remain available or recoverable. PenEcho Cloud is not a backup service; keep independent copies of important content.
Projects stored only on your own computer are outside the cloud deletion process.
8. Security
We use technical and organizational measures we consider appropriate for the service, which may include encryption in transit, access controls, secure session cookies, rate limits, backups, and infrastructure safeguards. Measures may change as the service evolves. No online service can guarantee security, availability, integrity, or recovery, and you use the service with that understanding. Report suspected account abuse or a vulnerability through the Contact page without including passwords, API keys, or private Canvas content.
9. Your choices and rights
You can review and update basic profile information in the account console, export a Canvas through available product tools, unlink local devices, and request account deletion. Depending on applicable law and subject to permitted exceptions, you may also have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data, and to complain to a data-protection authority.
Send a request to [email protected] with the subject Privacy request. We may need to verify that you control the relevant account before acting.
10. International processing
PenEcho Cloud currently uses an AWS production region in Singapore, a Zoho Mail tenant in the United States for support correspondence, and Cloudflare's global network. Your data may therefore be processed outside your country. Where required, we rely on contractual and technical safeguards and preserve any mandatory rights available under local law.
11. Children
PenEcho Cloud is not directed to children under 13, and we do not knowingly collect personal information from them. If local law requires a higher minimum age for independent consent, you must meet that age or use the service only with valid parental or guardian authorization. Contact us if you believe a child has provided personal data improperly.
12. Changes and contact
We may update this policy as the service, law, providers, or data practices change. The revised policy becomes effective when posted or on a later date stated above. We may provide additional notice where required by law or reasonably practical.
For privacy questions, contact the PenEcho service operator at [email protected]. General support and security-reporting guidance are available on the Contact page.