Privacy policy

Who we are

Ekko is a social media planning and publishing service. For privacy questions or requests, contact [email protected].

Data we collect

• Account data, including your name, email address, password hash, workspace membership, and role.
• Workspace content, including drafts, campaigns, comments, approvals, schedules, settings, and team invitations.
• Connected-account data, including social profile identifiers, granted scopes, encrypted access tokens, publishing results, and metrics returned by a provider.
• AI inputs and outputs when you use writing or assistant features.
• Technical data needed to operate and secure the service, including session cookies, request IP addresses used for short-lived rate limits, and server error logs.

How we use data

We use this data to provide the service, publish content you direct us to publish, secure accounts, prevent abuse, troubleshoot failures, and respond to support and privacy requests.

Where applicable, we process account and workspace data to perform our contract with you. We process security and reliability data for our legitimate interest in operating a safe service. We rely on your direction or consent when you connect a third-party account or ask Ekko to publish content.

AI features

If the deployment has an Anthropic API key configured, Ekko sends the prompt and relevant workspace context to Anthropic to produce a response. If a TypeSafe API key is configured, Ekko also sends draft post text to TypeSafe to score it (for example, how strong the opening is) and to rank AI-written versions; TypeSafe returns scores, not text. Without those configurations, Ekko uses its local deterministic engine and sends no prompt to an external AI provider. Do not place secrets or sensitive personal data in prompts.

When we share data

We share data only as needed to run the service or follow your instructions. Recipients may include:

• LinkedIn, X, Meta, or another social provider when you connect an account or publish through it.
• Anthropic when external AI is enabled for the deployment.
• TypeSafe when copy scoring is enabled for the deployment.
• Infrastructure providers used by the deployment operator for hosting, storage, monitoring, or email.
• Authorities or other parties when required by law, or when necessary to protect users and the service.

We do not sell personal data or use workspace content for third-party advertising.

Retention and deletion

Account and workspace records remain until they are deleted or no longer needed to provide the service. Sessions expire after 30 days. OAuth state records expire after the connection flow. In-memory rate-limit records expire with their rate-limit window.

Disconnecting a social profile stops future use of its credentials. Deleting your Ekko account removes your identity and memberships and erases credentials from workspaces you own. Meta can also send Ekko a signed deletion request, which erases matching Facebook and Instagram credentials and analytics.

After a Meta deletion request, Ekko retains the random confirmation code, completion time, and a keyed, non-reversible hash of the provider user ID as an audit record. It does not retain the raw provider user ID in that record.

Ekko does not maintain an application-level backup system. A deployment operator may maintain infrastructure backups under its own retention schedule.

Security and international transfers

Ekko hashes passwords and encrypts connected-account tokens at rest when real provider connections are enabled. No internet service can promise absolute security.

Social, AI, and infrastructure providers may process data in countries other than yours. Their own terms and privacy policies govern that processing.

Your choices and rights

You may request access, correction, export, restriction, objection, or deletion where local law provides those rights. You may withdraw a connected provider at any time. Contact us at the address above or use account deletion in Settings.

If you are in a jurisdiction with a data protection authority, you may also complain to that authority. We will not discriminate against you for exercising a privacy right.

Children and changes

Ekko is for business users and is not directed to children under 18. We may update this policy when the service or law changes. We will update the effective date and provide additional notice when a change materially affects your rights.