Echofiles privacy policy

Last updated 22 October 2026

Echofiles is made by Ontiqo Pty Ltd, Australia. It keeps the folders you choose the same on your computers. This page says what information it handles, where that information is kept, and what you can do about it.

Your files

Files are copied directly between your own computers. They are not sent to or stored on any Ontiqo service. When two of your computers cannot connect to each other directly, another of your own computers can pass the traffic between them. That traffic is encrypted between the two computers, and the computer in the middle forwards it without decrypting it.

Your Ontiqo account

You sign in to Echofiles with your Ontiqo account, the one account for every Ontiqo app. The Ontiqo account service keeps:

• An account identifier and when the account was created.
• How you sign in. For Google, Apple or Microsoft: the user ID that service gives the app, and the email address it gives, which your account shows. For Sign in with Apple, also a token Apple issues so that your Apple sign-in can be revoked when you delete your account. For email: your email address and, if you set a password, a salted hash of a value your computer derives from it (Argon2id); your password itself is not sent. While a 6-digit code is waiting to be used, the service keeps a hash of it, when it expires, how many tries it has had, and counts of recent codes so it can limit them.
• For each computer signed in: an ID made on the computer, its public key, the app, the name you give it, its platform (for example windows-laptop), when it was added and when it last signed in.
• Purchases: for internet sync, the product, when it was bought, whether it is still active, and the purchase's identifier from where it was bought (the Mac App Store, the Microsoft Store or Polar), so one purchase turns internet sync on for one account.

What the Echofiles service keeps

The Echofiles service introduces your computers to each other. For each account it keeps the account identifier, whether the account has internet sync and until when, and, for each computer, its ID, public key, name, platform, when it was added and when it last connected (to the hour).

While your computers are online, the service also passes messages between them so they can connect. These carry network addresses (IP addresses and ports) and are not stored. While a computer is connected, the service also compares the public address it connects from with those of your other computers, to tell which of them are on the same network; that is kept with the connection only.

Echofiles 1.0.5 and earlier sign in through the Echofiles service itself rather than the Ontiqo account. For those, the service also keeps a one-way hash of the user ID from Google, Apple or Microsoft (not your name or email address), or, for email accounts, your email address, a salted hash of a value your computer derives from your password (Argon2id), and while a code is waiting, a hash of it and counts of recent codes.

Buying internet sync

Internet sync is bought in the app: in the Mac App Store or the Microsoft Store in those editions, and through Polar (polar.sh), our online reseller, on Linux and in the editions downloaded from echofiles.app. Each handles the payment under its own terms and privacy policy; the app and the services do not see payment details. To turn internet sync on, the app passes proof of the purchase from the store to the service, which checks it with Apple or Microsoft; Polar tells the service about a purchase made through it.

Logs

The services run on Cloudflare Workers. Cloudflare keeps logs of requests to them, which include the IP address a request came from, for up to 7 days. When sending an email code fails, the log entry can include the email address it was being sent to.

Other companies involved

• Cloudflare hosts the services and stores what is listed above (Cloudflare privacy policy).
• Purelymail sends the emails with sign-in codes, so it receives your email address and the code (Purelymail privacy policy).
• Google, Apple or Microsoft, if you sign in with them. They handle that sign-in under their own privacy policies and give the app a signed token with your user ID and email address.
• Apple, Microsoft or Polar, if you buy internet sync (see above).

What stays on your computer

The app keeps its settings in %LOCALAPPDATA%\EchofilesPlus on Windows, ~/Library/Application Support/Echofiles+ on a Mac (inside the app's container) and ~/.local/share/echofilesplus on Linux: the account identifier, the email address or name from your sign-in (shown on the Account page), computer names, your folder list, an index of the files in your synced folders, earlier versions of changed or deleted files (the Recovered files page), and a log file. The computer's private key is kept there too, or in the Mac's keychain. Your synced folders and their files stay where they are when you uninstall the app.

What you can do

• See what is kept: the Computers page lists every computer on your account with the details above, and the Account page shows how you signed in. Your account at ontiqo.com/account shows your purchases and computers.
• Remove a computer: on the Computers page, or by signing out on that computer.
• Delete your account: Account page → Delete account. This deletes your Ontiqo account, which other Ontiqo apps you use share. Everything above that identifies you is erased at once, Apple sign-in tokens are revoked, and every computer on the account is signed out. A record of each purchase is kept without a link to you, so a store purchase can be restored to a new account. Files on your computers are not touched.
• Ask a question or ask for a copy of what is kept: email support@ontiqo.com.

Changes

When Echofiles starts handling information differently, this page changes and the date above changes with it.