Privacy and data boundaries

Echo combines local storage with optional network services. The boundary depends on the selected transcription model, AI provider, workflow actions, authentication state, and analytics preference.

Local data

Echo uses these source-backed local locations:

Data	Location and behaviour
Saved audio and per-recording history artifacts	~/.budgie/echo/recordings/<recording-id>/. A folder can contain audio plus history.json metadata and workflow-run details.
Completed transcription and History records	The embedded Budgie memory store under ~/.budgie/memory/. Echo reads and deletes these records in-process.
Most settings	The embedded configuration store under ~/.budgie/memory/; some Echo-specific preferences and workflow files also live under ~/.budgie/echo/ or the webview's local storage.
Logs and workflow-run diagnostics	~/.budgie/echo/logs/. Logs can be cleared from Settings.

Echo does not present a single automatic retention period for all of these stores. Treat History, recordings, settings, and logs as retained until you delete or clear them through the relevant UI.

Deleting a History entry removes its matching local memory record and its recording folder, including audio when present. Clearing Events is separate from clearing Logs and does not delete History.

Encrypt saved recordings is an optional Privacy setting. When enabled, Echo migrates saved audio to AES-256-GCM at-rest storage and decrypts it for playback. This setting applies to recording audio, not every database, log, transcription, or exported value; verify the toggle after migrations or reinstalls instead of assuming universal protection.

Network operations

Echo can contact a network service for:

• sign-in, license, purchase, quota, account, recipe, and support operations through the Budgie gateway;
• model catalogue lookup and model downloads;
• cloud speech recognition when a supported cloud route is selected;
• cloud LLM prompts through the selected Budgie provider;
• custom endpoints, including any remote URL you configure;
• workflow actions such as HTTP requests, downloads, remote plugins, or recipe publishing;
• direct-build update checks, or the operating system's store update channel.

Cloud transcription can transmit audio. Cloud LLM and remote custom profiles can transmit transcription text, prompts, selected text, constants, and earlier workflow outputs. A local transcription model does not make later workflow steps local.

Authentication tokens are used for gateway operations and quotas. Never place a token or provider key in a constant, workflow input, screenshot, or support report. Review AI and Recipe Security before processing sensitive text.

The AI panel's Privacy mode blocks Budgie gateway inference and any non-local custom endpoint. On-device models and a localhost custom endpoint remain allowed. Non-AI network actions remain separate trust boundaries, so confirm each destination instead of treating the toggle as a whole-application offline mode.

Analytics

When usage analytics is enabled, Echo records product events such as feature use, model/provider names, performance measurements, app version, platform, and error categories. The frontend attaches app: echo, logs the event locally in Events, and sends authenticated events to the gateway in the background.

The gateway forwards accepted events to the EU PostHog ingestion host (eu.i.posthog.com). Event delivery requires authentication and is fire-and-forget; it must not block the feature being measured.

Use Settings → App → Privacy → Send usage analytics to disable usage analytics. Echo stores the opt-out locally and attempts to synchronise it with the gateway so server-side events are also dropped. If synchronisation fails, the local preference remains saved; verify account connectivity before assuming the server preference has updated.

The frontend accepts event properties, adds app: echo and the current page URL, and stops before sending when the local opt-out is active. The gateway checks the account-level opt-out before enriching and forwarding an accepted payload.

Before PostHog delivery, the gateway replaces values under known sensitive property names, including fields for raw text, prompts, completions, recordings, credentials, and tokens. It also redacts heuristic patterns for email addresses, IPv4 addresses, and selected token formats inside nested properties. This filter is bounded: other property names can still pass through. Do not put transcription text, prompts, responses, audio, credentials, or other user content in analytics properties.

The database user ID is used as the PostHog distinct ID. Accepted events are sent to the EU PostHog ingestion host (eu.i.posthog.com). This analytics path is separate from provider calls, authentication, updates, support reports, and workflow actions.

For material you plan to share, follow Safe redaction.