Privacy Policy

Data We Collect

EchoUploader collects the minimum data required to provide the Service:

• — Cardano stake address — used to identify your account, track subscription status, and attribute uploaded files.
• — File metadata — filename, MIME type, file size, IPFS CID, and upload timestamp. File contents are forwarded directly to Pinata and are not stored on EchoForge servers.
• — Subscription and spend records — on-chain transaction IDs, ADA amounts, and subscription tier, stored in our Supabase database.
• — ANCHOR records — for the pay-per-anchor proof-of-existence feature, the on-chain transaction hash and the SHA-256 hash (or IPFS CID) it anchors.
• — Organization data — if you create or join a team account, the organization name, domain, and your role/membership status within it.
• — Usage logs — server-side request logs (IP address, timestamp, endpoint) retained for up to 30 days for security and abuse-detection purposes.

How We Use Your Data

• — To verify subscription status and enforce storage quotas.
• — To attribute files to your wallet for retrieval and management.
• — To detect abuse and enforce our Terms of Service.
• — To compute ForgeCard XP and relay identity signals to the EchoForge ecosystem via the EchoID API.

We do not sell your personal data. We do not use your data for advertising.

Third-Party Services

EchoUploader relies on the following third-party processors:

• — Pinata — IPFS pinning provider. File data is transmitted to Pinata under their privacy policy.
• — Supabase — Database infrastructure. Data is stored in encrypted PostgreSQL instances.
• — Blockfrost — Cardano blockchain query API used for payment and anchor verification. No personal data beyond stake address is transmitted.
• — Charli3 / CoinGecko — ADA/USD price oracle. No personal data is transmitted.

Data Retention

File metadata and subscription records are retained for as long as your account is active. If you close your account, records may be retained for up to 90 days to satisfy legal obligations, after which they are deleted. Server logs are purged after 30 days.

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, or request deletion of your personal data. To exercise these rights, contact us at privacy@echoforgellc.tech.

Note: Because uploaded files are content-addressed on a public peer-to-peer network, we cannot guarantee removal of data from third-party IPFS nodes.

Cookies and Local Storage

EchoUploader uses browser local storage strictly for session continuity and preferences (wallet identity cache, language, selected organization) and the BroadcastChannel API to sync identity state across tabs. We do not use tracking cookies or third-party advertising cookies. See our Cookie Policy for details.