Privacy Policy · WikiClip

Effective date: October 28, 2026 · Last updated: October 28, 2026

1. Who we are

Echo Harbor Tech, LLC (“Echo Harbor,” “we,” “us,” or “our”) is a human-centered technology company based in Albuquerque, New Mexico. This Privacy Policy describes how we collect, use, and protect information across our entire portfolio of websites, applications, publications, and tools:

echoharbor.tech — our company site.
wikiclip.com — WikiClip, the encyclopedia of your life: a personal, searchable archive of everything you read.
aithinks.com — AIthinks, a transparent reasoning assistant.
echoharbor.news — Echo Harbor News, a reader-owned newsroom.
echoharbor.press — Echo Harbor Press, long-form essays and reports.

Together, these are the “Services.” One policy, one standard, everywhere: whichever of our properties you are using — including the subdomains we serve them from, such as wikiclip.echoharbor.tech — the promises on this page apply. Where an app shows you a supplemental notice of its own, this policy is the floor: nothing in a supplement can weaken a promise made here.

2. Our promise

Our mission is to build software that restores clarity, trust, and safety, and our privacy practices follow the same principles. In plain terms, this is the deal:

We never sell your data. Not to advertisers, not to data brokers, not to anyone.
We never share your data with third parties. No ad networks, no data brokers, no “partners.” The exceptions are ones you control: paying for a plan (our payment processor handles the payment), signing in with Google or Apple, consenting to AI processing by an external provider — to process your content for you, and for nothing else — and, on our public websites, accepting optional Google measurement cookies. Each is described below, and none of them happens unless you choose it. See Third parties.
We never use your data for anything other than running the Services. No profiling, no ad targeting, no monetization of your attention or your information.
Join a waitlist and you hear from us only about that launch. A confirmation, your invitation when it is your turn, and the news that the doors are open. Never a newsletter you did not ask for — and you can leave the list at any time.
By default, the only analysis we perform is anonymous. We study usage in anonymized, aggregate form — with everything that could identify you removed — because that is our standard for deciding what to improve and what to build next. See Anonymous analysis. Optional Google measurement runs only if you opt in — see Cookies.
You can leave with your data, or have it erased, at any time.

3. Information we collect

Information you give us

Waitlist signups. When you join a waitlist for one of our products, we collect your email address and — so that we can write to you in your own language — the preferred language your browser reports. We record when you joined and which product you joined for. We use this for exactly three things: to confirm your spot, to send your invitation when it is your turn, and to tell you when the product opens. Nothing else is ever sent to that address.
Contact messages. When you write to us through a contact form or by email, we receive the name, email address, subject, and message you provide.
Account information. Some Services offer accounts. If you create one, we collect the information needed to register and secure it, such as your name, email address, and credentials. If you choose to sign in with Google or Apple instead of a password, we receive only the basic profile the provider releases for sign-in — your name, your email address (or the private relay address Apple offers), and an identifier for your account with them — and nothing about your activity there.
Content you create. Some Services let you save content — for example clips, notes, prompts, or reading lists. That content belongs to you; we store it so the Service can work, and for no other reason. If you choose to share a clip or a folder with someone, or to create a share link, the people you share it with can see that content. That is sharing you direct, not sharing by us, and you can stop it whenever you like.
Billing information. If you subscribe to a paid plan, the payment is handled by Stripe, our payment processor. Stripe collects your card details directly on its own secure pages; we never see or store your full card number. We keep the records needed to run your subscription: your plan, your billing history, and the identifiers Stripe gives us.

Information collected automatically

First-party traffic records. When you visit our sites, our own servers record the page requested, the date and time, your IP address, browser and device type, the referring page, and a randomly generated session identifier. This is standard server logging kept entirely on our own infrastructure — it never leaves our systems and is never shared with anyone.
Technical metadata with your messages. When you submit a contact form, we record the IP address and browser identifier of the submission to help us filter spam and abuse.
Service records. As you use an app, we keep the operational records the Service needs to run your account — for example which plan you are on, the AI credits a feature used, and when you last signed in — so that your allowance is right and your account stays secure.
Optional measurement data — only with your consent. If you accept the measurement cookies on our public websites, Google Analytics and Google Ads collect usage data as described in Cookies. If you decline, none is collected.

4. Cookies

Two first-party, strictly necessary cookies are always present:

A session cookie that maintains continuity between page visits and, where a Service offers sign-in, keeps you signed in. Because our apps share one Echo Harbor sign-in, the sign-in cookie is set on the shared Echo Harbor domain so that signing in once works across them; it identifies your session and nothing more.
A security token that protects forms against cross-site request forgery.

One more category exists, and it is entirely your choice. Optional measurement cookies — off until you say otherwise. Our public websites can use Google Analytics and Google Ads to understand how visitors find us and whether our advertising works. These tools load only after you accept them in the cookie banner: until then, no Google measurement script runs, no measurement cookie is set, and no data is sent to Google. If you decline, the sites work exactly the same. You can change your mind at any time through “Cookie preferences” in the site footer; withdrawing consent stops the tools and removes the cookies they set. Your answer to the banner — accept or decline — is remembered in your browser's local storage so we do not ask again; it is stored on your device, not on our servers. When you opt in, the data these tools collect is handled by Google as described in the Google Privacy Policy.

Beyond that consent-gated measurement, we do not use advertising cookies, cross-site tracking cookies, third-party cookies, or fingerprinting — on any of our properties. Two narrow cases involve someone else's servers, and we want you to know about both. Our web pages load typefaces from Google Fonts, which means your browser requests font files from Google's servers; Google may receive your IP address as part of that request. Google's handling of those requests is described in the Google Fonts privacy FAQ. And if you pay for a plan, checkout happens on Stripe's pages, where Stripe sets the cookies it needs to process the payment and prevent fraud, under the Stripe Privacy Policy.

5. How we use information

We use the information described above solely to:

Operate and maintain the Services.
Send the waitlist emails you signed up for: a confirmation, your invitation, and the launch notice.
Respond to your messages and requests.
Run your account and, if you have one, your subscription — including processing payments through Stripe.
Send the notices an account needs — a password reset, a security alert, or a notice that this policy has changed.
Detect, prevent, and respond to spam, abuse, and security incidents.
Improve the Services through anonymous, aggregate analysis (see the next section).
Measure — only with your consent — how visitors find our public websites and how our ads perform (see Cookies).
Comply with legal obligations.

That list is exhaustive. Beyond the consent-gated measurement above, we do not use your information for advertising, we do not build behavioral profiles, and we do not sell, rent, trade, or disclose personal information to anyone.

6. Anonymous analysis

We want to be completely transparent about the one way we study how the Services are used, because it is the standard by which we decide what to build next.

To improve our tools and develop new features, we analyze usage in anonymized, aggregate form — for example, which pages are read most, which features are used, and on what kinds of devices. Before analysis, information that could identify you is removed or generalized; the results describe patterns across many visitors, never an individual person.

Anonymous analysis happens entirely on our own infrastructure. The only third-party measurement is the optional, consent-gated Google tooling described in Cookies — it never runs unless you accept it.
The results cannot be traced back to you, and we never attempt to re-identify anyone.
The results are used for exactly one purpose: making the Services better and building the new features you have told us — through your usage — that you need.

By using the Services, you acknowledge that this anonymous, aggregate analysis is how we move forward: it is the evidence base for every improvement and every new feature we ship. If we ever wanted to analyze data in a way that could identify you, we would ask for your explicit consent first.

7. AI features

Some of our products, including WikiClip and AIthinks, include AI-assisted features. When you use them, the content you submit (for example a prompt, a page you clip, or a question you ask) is processed for exactly one purpose: providing the feature you asked for. You choose how that processing happens:

External AI providers — only with your consent. Our most capable features are powered by third-party AI providers (OpenAI, Anthropic, or Google). If you consent, the content you submit to an AI feature may be sent to one of these providers for processing. They act solely on our behalf: under our agreements with them, they may not use your content for their own purposes, may not share it, and may not use it to train their models.
On-premise processing — entirely within Echo Harbor. If you prefer, you can choose our on-premise model instead. It is less powerful, but it runs entirely on Echo Harbor's own infrastructure: your content never leaves our systems, and no third party is involved at any point.

If you do not consent to external processing, your content is not sent to any third-party provider. Either way, we never use your personal content to train AI models, and we do not permit anyone else to do so.

8. Third parties

We do not sell, rent, trade, share, or disclose your personal information to third parties — for any reason. There are no advertisers, no data brokers, and no “partners” with access to your data. Your data is never part of any third-party interaction you did not explicitly choose. (Sharing you do yourself — a clip or folder you hand to someone — is your decision, not ours, and is described under Content you create.)

For complete honesty, six narrow situations exist that are not “sharing” in any commercial sense:

Infrastructure. Like every online service, ours runs on server and email infrastructure. Those systems operate strictly under our instructions and binding confidentiality obligations; the companies that provide them have no right to access, use, or retain your data for their own purposes. The waitlist and contact inboxes live on that same infrastructure, operated by us.
Payments. If you subscribe to a paid plan, Stripe processes the payment. Stripe receives your card details and billing email directly, under the Stripe Privacy Policy; we receive confirmation that you paid and the identifiers needed to run your subscription. Stripe is never given your clips or anything else about how you use the Services.
Sign-in providers you choose. If you sign in with Google or Apple, that provider learns that you signed in to our app — as it would with any site that offers its sign-in — and we receive only the basic profile described in Information we collect. Sign in with a password instead and no provider is involved.
AI processing you choose. If you consent to AI features powered by an external provider, the content you submit for that feature is processed by the provider as described in AI features — solely to serve you, never for the provider's own use, and never for model training. Prefer zero third-party involvement? Choose the on-premise model.
Measurement you opt into. If you accept the optional measurement cookies on our public websites, Google Analytics and Google Ads receive usage data as described in Cookies. Decline — or simply say nothing — and they receive nothing.
Legal compulsion. If we are legally required to disclose information by a valid subpoena or court order, we will comply with the law — narrowly, and we will notify you unless we are legally prohibited from doing so.

If Echo Harbor is ever part of a merger or acquisition, any successor inherits this policy and remains bound by every promise in it.

9. Data retention

We keep personal information only as long as it is needed for the purposes described in this policy:

Waitlist entries are kept until the launch they were for is complete and the invitations have gone out, and for a short period afterward. If you leave the list, we stop writing to you immediately; on request, we delete your address entirely.
Contact messages are retained while our correspondence with you is active and for a reasonable period afterward.
Account information and the content you create are kept for as long as your account is active. When you delete your account — yourself, from your account settings, or by asking us — your content and personal information are deleted from our live systems promptly, and from backups as they cycle out.
Billing records are kept for as long as tax and accounting law requires, and no longer.
First-party traffic records are retained for a limited period for security purposes, then deleted or anonymized.

You can request deletion at any time (see Your rights and choices).

10. Security

We protect information with industry-standard measures, including encryption in transit, access controls, and isolation of administrative systems. No method of transmission or storage is completely secure, but we design our systems to minimize both the data we hold and the harm any incident could cause. If a breach affects your personal information, we will notify you as required by law.

11. Your rights and choices

Regardless of where you live, you can ask us to:

Tell you what personal information we hold about you.
Correct inaccurate information.
Delete your information.
Provide a copy of your information in a portable format.
Stop using your information for a particular purpose.

Some choices need no request at all. You can withdraw measurement-cookie consent at any moment through “Cookie preferences” in the site footer. You can leave a waitlist by writing to us at the address below — we stop at once. And where a Service offers accounts, you can delete your account yourself from your account settings. To exercise any of the rights above, email contact@echoharbor.tech. We will respond within 30 days. Residents of certain jurisdictions — including the European Economic Area, the United Kingdom, and California — have specific statutory rights; we honor the requests above for everyone, wherever you are.

12. Children's privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

13. International visitors

Echo Harbor is based in the United States, and the Services are hosted there. If you access the Services from outside the U.S., your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. Every promise in this policy applies regardless of where you are.

14. Changes to this policy

We may update this policy from time to time. When we do, we will post the revised version here and update the effective date above. If a change is material, we will make that clear on our website or, where appropriate, notify you directly. We will never weaken the promises in Our promise without asking you first.

15. Contact us

Questions about this policy or our privacy practices are always welcome.

Echo Harbor Tech, LLC
Albuquerque, New Mexico, USA
contact@echoharbor.tech

Your data stays in the harbor.