Law Enforcement Guidelines

Last updated: September 12, 2026

This page explains what legal process Echo requires before disclosing account or content information, what data actually exists to disclose, and how to submit a request. It's written for law enforcement and legal professionals; if you're a user looking to report abuse or request your own data, see Help & Support or our Privacy Policy instead.

What data Echo has

Echo is designed around anonymity, so there's less here than a typical social app. Echo does not collect or store a real name, email address, or phone number at account creation.

• Account identity: a Firebase-authenticated anonymous UID, a random device-assigned identifier, and a guest username.
• Location: a coarse H3 geospatial cell associated with a post or session — never precise coordinates, and no location history.
• Content: posts, comments, reports, and moderation records. Content is retained for 90 days from creation and then deleted, unless it's the subject of an open report or a preservation request (below) — see Retention under our Privacy Policy.
• Chat messages: a rolling window only — the most recent 30 days or 100 messages per conversation, whichever is smaller. There is no historical chat store beyond that window; a request for older messages will come back empty regardless of legal process.
• Voice calls: peer-to-peer (WebRTC) between the two participants. Echo's servers relay call setup only and never touch call audio directly. When Echo's moderation team or law enforcement, acting under a valid Title III wiretap order or equivalent judicial authorization, covertly monitors a call, that session is recorded from the monitoring device and requires a sworn attestation on file before it can begin — see Live interception of call audio below. Absent that process, no audio is recorded or retained. Because recording happens on the monitoring device rather than as a network-level intercept, completeness can depend on that device's connection quality.
• Purchases: purchase and subscription entitlement records via RevenueCat — not payment card details, which we never receive.

Legal process we require

Echo is a provider of electronic communication services under the Stored Communications Act (18 U.S.C. §§ 2701–2713), and we require the process the SCA specifies for each category of data:

• Basic subscriber/account information (account identifiers, creation date, associated device ID) — a valid subpoena.
• Non-content records (e.g. moderation action history, report history not itself containing message content) — a court order under 18 U.S.C. § 2703(d), or a subpoena where the SCA permits.
• Contents of communications (post text, comments, chat messages) — a search warrant issued on probable cause. We do not disclose content on a subpoena or 2703(d) order alone.
• Live interception of call audio (wiretap/covert monitoring): a Title III order (18 U.S.C. § 2518) or state-law equivalent authorizing real-time interception — on top of, not in place of, our internal process. Even with valid legal process in hand, we additionally require a designated staff member to sign a sworn attestation, under penalty of perjury, certifying that a valid order is in hand before any covert listen session begins. Every such session is recorded and audit-logged.

All requests must be issued by a government agency with proper jurisdiction, identify the account clearly (guest username, device ID, or a specific post/chat ID and approximate timestamp — we don't have a name, email, or phone number to search on), and be served on us through the contact channel below rather than in-app.

Emergency disclosure

Where we have a good-faith belief that disclosure without delay is necessary to prevent an imminent danger of death or serious physical injury, we may voluntarily disclose the information reasonably necessary to address that emergency, consistent with 18 U.S.C. § 2702(b)(8)/(c)(4). Send emergency requests to emergency@useecho.net on official letterhead, describing the specific emergency and the information needed. This is a narrow exception, not a substitute for legal process in non-emergency cases.

Preservation requests

We can preserve existing records pending the issuance of formal legal process, per 18 U.S.C. § 2703(f). Send a preservation request identifying the account or content as specifically as possible; we'll confirm what, if anything, we're able to preserve.

International requests

Non-U.S. law enforcement should proceed via an MLAT request or letter rogatory through the U.S. Department of Justice, or another mechanism recognized under U.S. law. We generally require the same legal process described above regardless of the requesting country.

How to submit a request

Email law-enforcement@useecho.net with your request attached, your agency affiliation, a return contact method, and the account/content identifiers described above.

Questions

For anything not covered here, email law-enforcement@useecho.net.