What is true
- No Echo account. There is no separate Echo username or password.
- Local first. Entries are written to your device. iCloud sync is an addition, not a requirement.
- iCloud protects synced entry text in transit and on its servers. Echo currently uses standard CloudKit fields in your private iCloud database; it does not provide end-to-end encryption for synced entry text.
- No third-party server. Nothing is sent to Wells Code.
- No behavioural tracking or advertising.
- Intelligence is on-device. See On-device intelligence.
What that does not cover
These protections have limits:
- An unlocked device is an unlocked journal. Turn on the journal lock.
- Your Apple Account controls access to iCloud sync and backups. Protect it with two-factor authentication.
- Exports are plain files. An exported ZIP is unencrypted by design, so it can be read by other software. Store it accordingly.
- So are imports. A Day One export is read by Echo on your device and nothing is uploaded, but the ZIP itself isn’t protected. Delete it once you’ve checked the import.
- Metadata is only captured if you ask. Location, weather, steps and sleep are off until you turn them on in Settings ▸ Privacy ▸ Automatically Add Metadata.
Erasing everything
Deleting the app removes the local journal. To clear the synced copy as well, use the reset options in Settings ▸ Sync before deleting, so nothing is left in iCloud.