Privacy Policy

Last updated: August 19, 2026

Echo (“Echo,” “we,” “us”) is an anonymous, location-based bulletin board and chat app operated by Echo App Labs, LLC, a New York limited liability company. This policy explains what information we collect, how we use it, and the choices you have. Echo is designed around anonymity: we do not ask for your name, email, or phone number to use the core app.

Information we collect

Account & identity

Echo signs you in anonymously (via Firebase Authentication) and assigns your device a random identifier and a whimsical guest username. We do not collect your real name, email address, or phone number as part of account creation.

Location

To show you bulletin-board posts from around you and to power matchmaking, Echo reads your device’s approximate location and converts it into a coarse geospatial index (H3 hexagonal cell) before it ever leaves your device context for storage. We do not store your precise GPS coordinates or location history — only the cell your post or session was associated with at the time.

Content you create

Posts, comments, chat messages, and reports you submit are stored so the app can display them to other users (where applicable) and so our moderation systems can review reported content. Voice chat is peer-to-peer (WebRTC) between the two participants — our servers relay connection setup only, and we do not record or store call audio.

Voice call monitoring

To enforce our Community Guidelines and respond to reports of abuse, harassment, or other violations, authorized Echo moderators have the ability to join an active voice call and listen in real time. This monitoring does not add a visible or audible participant to the call and is not separately announced to either caller at the moment it happens — every moderator join is logged in an internal, append-only audit record (who joined, when, and which call) that we retain for accountability and can produce on request. Calls monitored this way are not recorded or stored as audio; only the fact and time of the moderator's presence is logged.

By using Echo's voice chat feature, you acknowledge and consent to this monitoring. Some jurisdictions require the consent of every party to a call before it can be monitored or intercepted — the notice in this Privacy Policy, together with the acknowledgment you give during onboarding and our Terms of Service, is how we obtain that consent from every Echo user before they can place or receive a voice call, so that consent is in place for both participants regardless of which state or country either of you is in.

Device & usage data

We collect basic device and diagnostic information (app version, platform, crash logs) and a push-notification token (if you enable notifications) to deliver chat and match alerts.

Purchases & rewarded ads

Echo Credits can be earned by watching rewarded ads (served via Google AdMob, which verifies ad completion through a server-to-server callback) or purchased in-app. In-app purchases and subscriptions are processed by the app stores and reconciled through RevenueCat; we receive confirmation of a purchase and its associated entitlement, not your payment card details.

How we use information

• To operate core features: nearby posts, matchmaking, chat, and direct messages.
• To keep the community safe: reviewing reports, applying moderation actions (including shadowbans, suspensions, or bans), filtering blocked users from your feeds and matches, and, where necessary, monitoring an active voice call in real time as described in Voice call monitoring above.
• To maintain your Echo Credits balance and transaction history.
• To send chat/match push notifications you’ve enabled.
• To diagnose crashes and improve app performance and reliability.

Sharing

We do not sell your personal information. We share limited data with the service providers that make Echo work: Google Cloud / Firebase (hosting, authentication, push notifications), Google AdMob (rewarded ads), and RevenueCat (purchase management). Each operates under its own privacy policy and only receives what it needs to provide its service.

We may disclose information if required by law, or to protect the rights, safety, and security of Echo, its users, or the public. See our Law Enforcement Guidelines for the legal process we require before disclosing account or content information to law enforcement.

Data retention & deletion

We retain account and content data for as long as your account is active. You can request deletion of your account and associated data at any time by contacting us at privacy@useecho.net. Some information may be retained longer where necessary for moderation records, fraud prevention, or legal compliance.

Children’s privacy

Echo is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will remove it.

Your choices

• You can disable location access, but nearby-post and matchmaking features will not work without it.
• You can disable push notifications in your device settings at any time.
• You can block other users, which filters them from your feeds, comments, matchmaking, and DMs.
• You can request access to or deletion of your data by contacting us below.

California privacy rights

If you're a California resident, the CCPA (as amended by the CPRA) gives you specific rights over your personal information, described here alongside what we actually collect so this section means something rather than reading as boilerplate.

Categories we collect, mapped to the CCPA's categories: identifiers (a device-assigned random ID and guest username — never your real name, email, or phone number); approximate geolocation (a coarse H3 cell, never precise coordinates or a location history); content you create (posts, comments, messages, reports); internet/device activity (app version, platform, crash logs); and commercial information (purchase and entitlement records from RevenueCat, never your card details). We don't collect Social Security numbers, precise geolocation, or other categories the CPRA treats as "sensitive personal information."

Categories disclosed, and to whom: the same identifiers, content, and commercial information listed above, disclosed only to the service providers named in Sharing above (Google Cloud/Firebase, Google AdMob, RevenueCat) for the purpose of operating the app.

Sale and sharing: we do not sell personal information for money. Our use of Google AdMob to serve rewarded ads may, depending on your ad settings, count as "sharing" under the CPRA's broader cross-context-behavioral-advertising definition. To opt out of that sharing, or to exercise any right below, contact us at privacy@useecho.net.

Your rights: to know what we've collected, to request deletion, to correct inaccurate information, to opt out of sale/sharing, and to be free from discrimination for exercising any of these. Because Echo accounts are anonymous by design, we can't verify a request the way a named-account service would (e.g. against a legal name or SSN) — we'll verify through your authenticated session or device/account identifiers instead, and an authorized agent can submit a request on your behalf with proof of your authorization.

European & UK privacy rights (GDPR)

If you're located in the EEA, UK, or Switzerland, the GDPR/UK GDPR gives you rights over your personal data and requires us to state our legal basis for processing it:

• Consent — location access, and the voice-call-monitoring acknowledgment described above.
• Contract necessity — operating your account, matchmaking, chat, and your Echo Credits balance.
• Legitimate interests — safety and moderation, fraud prevention, and service reliability, balanced against your privacy interests.
• Legal obligation — responding to valid legal process and reporting obligations described in our Law Enforcement Guidelines.

You have the right to access, correct, or erase your data; to restrict or object to our processing; to data portability; to withdraw consent at any time without affecting processing already carried out; and to lodge a complaint with your local data protection authority. Data is processed in the United States via our infrastructure providers (Google Cloud/Firebase), transferred under appropriate safeguards. To exercise any of these rights, contact us at privacy@useecho.net.

Changes to this policy

We’ll update the “Last updated” date above when this policy changes, and post material changes in the app.

Contact

Questions about this policy? Email us at privacy@useecho.net, or write to us at Echo App Labs, LLC, 418 Broadway, Ste R, Albany, NY 12207.