1. Introduction
Welcome to EchoDrop ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service").
By using EchoDrop, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Information You Provide
- Account Information: When you create an account, we collect your display name, username, email address, and profile photo.
- Profile Information: Bio, memoji/avatar, and preferences you choose to share.
- User Content: Posts, photos, videos, comments, reactions, and other content you create within the app.
- Tribe Information: Data related to tribes you create or join, including tribe names, descriptions, cover photos, and membership.
- Communications: Messages sent through direct messaging and tribe channels.
2.2 Information Collected Automatically
- Device Information: Device type, operating system, unique device identifiers, and mobile network information.
- Usage Data: How you interact with the Service, including features used, content viewed, and time spent.
- Location Data: With your permission, we may collect precise or approximate location data to enable location-based features such as the Vibe Map.
2.3 Third-Party Services
- Music Services: If you connect Spotify or Apple Music, we may access playlist and listening data to power music-based features. We do not store your streaming credentials.
- Authentication: If you sign in via third-party providers (e.g., Apple, Google), we receive basic profile information as permitted by your settings.
- AI Services: EchoDrop uses artificial intelligence to power certain features. When you use AI-powered features (such as the Vibe Guide, mood-based suggestions, or content recommendations), your prompts and relevant context may be processed by the following third-party AI providers:
- Cloudflare Workers AI — Primary AI provider for text analysis and recommendations. Data is processed in transit and not retained after the response is generated.
- Groq — Fallback AI provider for complex reasoning tasks. Data is processed in transit and subject to Groq's data processing terms.
- Content Safety: Uploaded images are analysed for safety compliance using the HuggingFace Inference API. Image data is sent for classification only and is not stored by the provider after processing.
- Product Analytics: We use PostHog (EU hosting,
eu.i.posthog.com) to understand how features are used so we can improve them. PostHog receives in-app event data (for example: screens opened, features used, and when you sign in) together with your account's internal user identifier, your app version and platform. We do not send your email address, name, messages, or the content of your posts to PostHog. Events are linked to that internal identifier, which means they are associated with your account rather than anonymous. PostHog acts as our service provider and does not use the data for its own purposes or for advertising. You can turn this off at any time in Settings → Privacy → Opt out of analytics, which stops collection on that device immediately. - Crash Reporting: We use Sentry for crash reporting and performance monitoring. Crash data and performance metrics are sent to Sentry's servers and are not linked to your identity.
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Service
- Personalise your experience, including content recommendations and the discovery feed
- Enable social features such as tribes, posts, reactions, and messaging
- Send you notifications related to your account and activity
- Detect, investigate, and prevent fraud or abuse
- Comply with legal obligations
- Conduct analytics to understand how our Service is used
4. How We Share Your Information
We do not sell your personal information. We may share information in the following circumstances:
- With Other Users: Your profile, posts, and tribe activity are visible to other users as determined by your privacy settings.
- Service Providers: We use third-party services (e.g., Supabase for data storage, cloud hosting) that process data on our behalf under strict confidentiality obligations.
- Legal Requirements: We may disclose information if required by law, legal process, or government request.
- Safety: We may share information to protect the safety of our users or the public.
5. Data Storage and Security
Your data is stored using Supabase, a secure cloud database platform. We implement industry-standard security measures including encryption in transit (TLS) and at rest, row-level security policies, and regular security audits. However, no method of electronic transmission or storage is 100% secure.
6. Your Rights and Choices
Depending on your location, you may have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate data.
- Deletion: Request deletion of your account and associated data.
- Portability: Request a portable copy of your data.
- Opt-Out: You can disable location services, notifications, and third-party integrations at any time through your device or app settings.
To exercise these rights, please contact us at the email address below.
7. Children's Privacy
EchoDrop is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will promptly delete it. If you believe a child has provided us with personal data, please contact us.
8. Data Retention
We retain your information for as long as your account is active or as needed to provide the Service. Specific retention periods:
- Account data (profile, email, preferences): Duration of account + 30 days after deletion request
- Messages: Duration of conversation. Unsent messages are removed from view but retained for safety investigations for 90 days.
- Vibe Capsules: Auto-expire after 24 hours, or until manually deleted
- Content (posts, voice notes, articles): Duration of account or until user deletes
- Safety data (moderation logs, contact rate logs): 90 days
- Grooming/safety reports: 24 months (legal obligation for child protection)
- Crash reports & diagnostics: 90 days
- Analytics events: 12 months, after which they are deleted or aggregated so they no longer identify an individual account
Account Deletion Timeline
When you request account deletion:
- Days 1-7 (Grace Period): Account marked for deletion. You can cancel and recover your account.
- Day 7 (Soft Deletion): Account deactivated. Profile hidden, content removed from feeds.
- Day 37 (Hard Deletion): All personal data permanently removed from primary database.
- Day 67 (Backup Purge): Data removed from encrypted backups.
After deletion, we retain only: anonymised safety flags, grooming reports (legal obligation), and aggregated analytics (no personal identifiers).
9. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy within the app or via email. Your continued use of the Service after changes constitutes acceptance of the updated policy.
11. Contact Us
If you have questions or concerns about this Privacy Policy, please contact us at:
Email: alistairakrofimanteyabram@gmail.com