Privacy

Who it is for. Echo MCP serves a single person’s own fitness and health data to AI assistants that person connects. Only the allowlisted Google account can sign in. There are no other users.

What is shared. Only the kinds of data ticked on the consent screen, per app: training, recovery, goals, nutrition, glucose, and the coach’s notes. Health-related categories are never pre-selected. Location data (GPS routes, start points) is never shared with any app.

Where it goes. Data is sent to the AI assistant you connected and is then subject to that provider’s privacy policy and retention. Echo cannot control what a connected assistant does with data it has been given.

What Echo keeps. A record of each request (which app, which tool, when, and the outcome — not the data returned), kept up to 400 days, and the minimum needed to keep a connection signed in (hashed refresh tokens). Echo keeps no Google tokens; Google is used only to confirm who is signing in.

Your controls. Disconnect any app at any time in Echo Admin → Connected AI; it loses access immediately. A daily summary of what each app did is sent to you on Telegram.