gnosis-echo Privacy Policy
Established: October 27, 2026
Last updated: November 3, 2026
This is an English translation provided for convenience. If it differs from the Japanese version, the Japanese version prevails.
gnosis LLC ("we") sets out below how we handle users' information in gnosis-echo (the desktop application, the command-line tool, and the website gnosis-echo.com; together, the "Service").
1. Our basic approach
The Service is designed to run on the user's own device. Tests you create, the screens and URLs you verify, login states, account information, and run records are stored on your device and in the storage you choose (such as a Git repository). We do not automatically send them to us. Section 3 covers what is sent externally when you use AI or integrations. Section 4 covers inquiries to us and information handled through the website and similar channels.
2. Information we do not automatically receive
The following information is not automatically sent to us. Apart from the external transmissions in Section 3 and storage you choose, it stays on your device. If you send it to us yourself, for example by attaching it to an inquiry, we handle it under Section 4.
- URLs, screen contents, screenshots, and recordings of what you verify
- Accounts, passwords, one-time password keys, and passkeys for what you verify (stored in the OS keychain or similar)
- Test contents, run results, and records
- Information from abnormal terminations (stored on your device; a redacted summary is written to a file only when you choose "Export diagnostics")
- Records of your agreement to the Terms of Service and of your confirmation that you are authorized to verify a service
3. Information sent externally on your instructions
| Destination | Information sent | When |
|---|---|---|
| Generative AI providers you connect (Anthropic, OpenAI, Microsoft, etc.) | Information the AI features need, such as your instructions, the contents and screenshots of screens being verified, tests, and the contents of attachments and reference materials | When you use AI features. Sent directly from your device to each provider using your own API key or connected account, without passing through us |
| External services you connect (GitHub, Notion, Google Drive, etc.) | Information needed for reference and integration, such as authentication information, the URLs and identifiers to retrieve, and search conditions | When you connect the service and use the feature |
| What you verify | Traffic from your operations, including information identifying the access as coming from this software (user agent, HTTP headers, etc.) | When you open what you verify |
The handling of information at these destinations is governed by your contract with each provider and each provider's privacy policy. Testing a generative AI connection also sends authentication information and a connection-check instruction to the provider. Section 10 covers the handling of Google Drive data.
Personal or confidential information in screens and materials may be included in what is sent. Separately from your permission to verify, confirm that you have the right and any necessary consent to send that information. Check the retention period, use for training, handling outside your country, and your organization's rules for the connection you choose, and where necessary delete, mask, or replace the information with test data.
4. Information related to updates, the website, inquiries, and similar
Update delivery hosts and website delivery and analytics providers obtain information through traffic from your device or browser. The table below distinguishes the inquiry information and analytics results we receive from the information each provider obtains as a destination of that traffic.
| Information | How it is obtained and where it goes | Purpose |
|---|---|---|
| Traffic information from checking for and downloading updates (IP address, requested files and URLs, request headers, etc.) | Obtained, as the destination of the traffic, by the update host configured in the distributed build or by the Git repository (GitHub, etc.) the build came from. The requested file varies by OS and so on. Automatic checks can be turned off in settings. Traffic still occurs when you check or update manually | Providing updates |
| Anonymous usage data (features used, rough ranges of counts and durations, success or failure, version, OS and CPU type, a randomly generated anonymous identifier) | Sent to and stored in Google Cloud (Cloud Run, BigQuery) managed by us, only if you consent. You can withdraw consent at any time in "Settings → Privacy". It does not include the URLs or screens under test, account information, or test contents. IP addresses are not recorded. Data is deleted within 13 months of receipt. Data sent before withdrawal cannot be deleted individually because it cannot be linked to you, and it is deleted within this period | Improving the Service |
| Website analytics (pages viewed, referrer, device and browser type, identifiers such as cookies, download button actions, etc.) | On pages where Google Analytics is enabled, sent from your browser to Google. We use the analytics results. Your IP address is also sent to Google as part of the traffic | Improving the website |
| Traffic information from website delivery (IP address, requested URL, request headers, etc.) | Obtained by Cloudflare, which we use for delivery | Delivering the website and preventing unauthorized access |
| Traffic information from retrieving download information (IP address, requested URL, request headers, etc.) | On pages offering downloads, your browser requests the latest release information from the GitHub API | Showing the latest download links |
| gnosis-echo account information (name, email address, profile image, account identifier) | Obtained through our authentication contractor (Clerk) when you sign in to gnosis-echo from this software. Information that keeps you signed in is stored encrypted on your device | Providing accounts and verifying identity |
| Answers to the first-launch survey (role, organization size, how you learned about the Service) and this software's version, OS type, and display language | Sent to our server (Cloudflare) when you submit answers at first launch of this software. Answering is optional and you can continue without sending. Answers are not linked to your gnosis-echo account and IP addresses are not recorded | Improving the Service and understanding user trends |
| Inquiry contents (name, email address, message, diagnostics and materials you attach, etc.) | We receive what you send by email or similar | Responding to inquiries |
Google's policies govern how Google Analytics handles information. In supported browsers, you can stop Google Analytics from using your data with the opt-out add-on provided by Google. Restricting cookies alone does not stop all external traffic. Section 6 lists the references.
When attaching materials to an inquiry, confirm that you have the right to send any personal or confidential information and limit it to what is necessary. Redaction of diagnostics is not guaranteed to remove all confidential information, so check the contents before sending.
If we offer paid services in the future, we will announce in advance the information obtained for them, its destinations, and the purposes of use. Where the law requires consent, we will provide the necessary information and obtain consent before starting.
5. Provision to third parties
We do not provide personal information we have obtained to third parties without your consent, except in the following cases.
- When required by law
- When necessary to protect a person's life, body, or property and it is difficult to obtain the person's consent
When we entrust the handling of personal data to the extent necessary to achieve the purposes of use, we select suitable contractors and supervise them as necessary and appropriate. Provision to contractors located abroad is governed by the next section; being entrusted does not by itself remove the need for consent.
6. Provision to third parties in foreign countries
The services of GitHub, Google, Cloudflare, and Clerk listed in Section 4 may handle information outside Japan. The countries and entities involved vary with the service, contract, and settings. A company's head office location does not show every country where information is handled.
When we provide personal data to a third party in a foreign country, we do so under the Act on the Protection of Personal Information after confirming one of the following grounds.
- Where the ground is the person's consent, we provide in advance the necessary information, such as the name of the country where the recipient is located, that country's personal information protection system, and the protective measures the recipient takes, and obtain consent to the provision to a third party in a foreign country. If the country or other details cannot be identified, we provide the reason and alternative information as the law requires.
- Where the ground is that the recipient has established a system meeting the standards set by law, we confirm the necessary system through a contract or similar and take the measures needed to ensure the continued implementation of equivalent measures. We provide the information set by law at the person's request.
- In any other case falling under an exception in the law, we confirm its requirements.
We do not treat blanket consent to this Policy or the listing of the references below as the consent required for an individual provision to a third party in a foreign country. We distinguish direct transmission under your own contracts in Section 3 from provision of personal data by us.
References for the information each provider publishes and for the relevant systems are below. Listing them does not guarantee the content of our contracts with each provider or compliance with the legal requirements for any specific transfer.
- GitHub privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
- Google Privacy Policy: https://policies.google.com/privacy?hl=en
- Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout?hl=en
- Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/
- Clerk Privacy Policy: https://clerk.com/legal/privacy
- Information on foreign personal information protection systems (Personal Information Protection Commission of Japan): https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku
7. Security
We take necessary and appropriate measures, such as access restrictions and encryption of communications, to prevent leakage, loss, or damage of personal information we have obtained.
8. Requests for disclosure, correction, suspension of use, and similar
You may request disclosure, correction, addition, deletion, suspension of use, suspension of provision to third parties, and disclosure of records of provision to third parties for your personal information that we hold. Contact the desk in Section 11. After confirming your identity, we will respond as the law requires.
9. Changes to this Policy
We may change this Policy in line with changes to the law or the Service. When we do, we will announce it in this software and on our website. Where the law requires consent, for example for a change in purposes of use or a new provision to third parties, we will not rely on an announcement alone; we will provide the necessary information and obtain consent before starting.
10. How we handle Google Drive data
This section applies when you connect to Google Drive with "Sign in with Google" in this software. You sign in on Google's page, shown in your default browser.
| Item | How it is handled |
|---|---|
| Data we read | The only permission we request is drive.file. We read the files you select in Google's file picker (name, type, size, and contents) and your Google account information, which is used to display the connection (only the email address is stored). We cannot read files you have not selected. A file you have selected can be read again until you revoke the connection. We do not create, change, or delete files |
| How we use it | To pass the selected files to AI features as attachments on your instructions, and to display the status of the connection. Based on those contents, the AI may create tests, notes, commits, and pull requests, and may enter values into what you verify by operating the browser |
| How we share it | The contents of files you attach are sent directly from your device to the generative AI provider you connected. Section 3 covers their handling at that destination; depending on your contract and settings with that provider, they may be used to train AI. What the AI creates from the contents may be sent to the storage you choose (GitHub, etc.) or to what you verify, through the operations described under "How we use it". We do not receive file contents, and anonymous usage data does not include file names or contents. We do not sell file contents or use them for advertising or to train AI models |
| How we store it | The login refresh token and email address are stored in the OS keychain or similar on that device. The access token is held only in memory while the app is running and is not saved to a file. The file picker window does not save browsing information. The contents of attached files are stored unencrypted on your device as part of the conversation record, and remain until you delete the conversation. Nothing is stored on our servers |
| Deletion and revocation | Signing out in "Settings → Connections" deletes the token from your device and also revokes access on Google's side. If revocation on Google's side fails, the app tells you. You can also revoke access in your Google Account settings (https://myaccount.google.com/permissions). Revoking does not remove what is stored on your device or contents already sent to a generative AI provider. If you continue that conversation, the stored attachments keep being sent to the provider. Deleting the conversation removes the attachment contents stored with it, but tests, notes, and work records the AI created from them may remain. Contents already sent are governed by each provider's terms |
If you connect with a service account JSON key, we read files within the scope shared with that service account. The key is stored in the OS keychain or similar. Materials retrieved by reference sync are stored in the reference storage on your device (or the location you specify).
11. Operator and contact
gnosis LLC
〒501-3303 岐阜県加茂郡富加町羽生三本杉1455-12, Japan
Representative member and person responsible for personal information: Sota Mamiya
echo-support@gnosis-tech.net