Privacy Policy

Echo X is a creator discovery service and Chrome extension for TikTok creator research. It helps users start from one or more source creators, search for similar TikTok creators, and review publicly available creator information.

The Chrome extension is a thin browser-side tool. It opens Echo X in the Chrome side panel, reads the public TikTok creator identifier from the active TikTok page when needed, syncs login state with the Echo X web app, and may collect public candidate creators from TikTok hashtag pages when the user starts that workflow.

Account and contact information: email address, verification code status, account settings, credit balance, and related account records.

Authentication information: password credentials are processed for login and registration. We store authentication tokens in browser storage to keep users signed in. Passwords should be stored by our backend in hashed form, not as plain text.

Creator discovery data: source creator unique IDs, search filters, search job status, result decisions, shortlist information, and search history created by the user.

Public TikTok content and profile data: public creator IDs, profile text, public post metadata, hashtags, public bio links, public engagement signals, and public creator statistics needed to provide similar-creator search results.

Browser extension workflow data: the active TikTok creator identifier, temporary pending search seed, tag-candidate collection progress, and extension-side login token synchronization.

Technical and service data: API requests, error logs, diagnostic information, timestamps, and basic security records needed to operate, secure, and troubleshoot the service.

Echo X is not designed to collect health information, government ID numbers, private messages, personal communications, full browsing history, precise GPS location, or payment card numbers through the Chrome extension.

Echo X is not affiliated with, endorsed by, or sponsored by TikTok. We only process TikTok information that is publicly available or supplied through the user's own workflow.

We use collected information to provide account login, creator discovery, similar-creator ranking, result review, credit accounting, support, security, abuse prevention, debugging, and product reliability.

We may use public creator data and search metadata to improve matching quality and service performance, but we do not use user data for creditworthiness, lending, or unrelated advertising purposes.

We do not sell user data.

We do not transfer user data to third parties for purposes unrelated to Echo X's single purpose of creator discovery and related account operation.

We may share or process information with service providers that help us run Echo X, such as hosting, database, email delivery, authentication, analytics, queue, cache, vector search, AI/embedding, and TikTok data provider services. These providers process data only as needed to provide the service.

We may disclose information if required by law, to protect users, to prevent abuse, or to protect the security and integrity of Echo X.

activeTab is used to read the public creator identifier from the currently active TikTok tab after the user opens or interacts with Echo X.

tabs is used to open TikTok creator pages and manage browser-assisted candidate collection from TikTok hashtag pages when the user starts that workflow.

sidePanel is used to display the Echo X web app in Chrome's side panel.

storage is used to store login state and temporary workflow state, such as a pending creator seed.

Host access to tiktok.com is used to detect public creator identifiers, open creator profiles, collect public candidate creators from hashtag pages, and extract public bio contact information when requested.

Host access to allecho.xyz is used to embed and communicate with the Echo X web app and synchronize login status.

We keep account, search, result, credit, and service records for as long as needed to provide Echo X, maintain security, comply with legal obligations, resolve disputes, and operate the product.

Users may request account or data deletion by contacting us at the email address below. We may retain limited records when required for security, fraud prevention, legal compliance, or legitimate business records.

We use reasonable technical and organizational measures to protect user information, including access controls, authentication, transport security, and operational logging. No online service can guarantee absolute security.

Echo X is intended for business and creator-operations use. It is not directed to children, and we do not knowingly collect personal information from children.

We may update this Privacy Policy as Echo X changes. When we make material changes, we will update the effective date on this page.

If you have questions about this Privacy Policy or want to request data access or deletion, contact us at hello@allecho.xyz.