echo

Child Safety Standards

Last updated:

These standards apply to Echo — Private Messaging ("Echo"), the Echo app for iPhone and Android, and the website echomessenger.app, all made and operated by Controverse Labs LLC, 68 Harrison Ave, Ste 605 PMB 231072, Boston, MA 02111, USA. They are part of our Terms of Service.

1. Our commitment

Echo has zero tolerance for child sexual abuse and exploitation (CSAE). The following are prohibited on Echo, in every chat, group, family space, call and Chamber, and we act on them when we learn of them:

  • Child sexual abuse material (CSAM): any image, video, audio or description that sexualizes a minor, including material a minor made of themselves.
  • Grooming: building contact with a minor in order to sexually exploit or abuse them.
  • Sextortion: threatening or coercing a minor with intimate images or information.
  • Sexualizing minors in any way, including text, roleplay, drawings or generated images.
  • Arranging, advertising or facilitating child trafficking or sexual abuse.
  • Using Echo to contact a minor you have been told not to contact, or to get around a parent's controls.

Breaking these rules is grounds for restricting or ending access to Echo, reporting to NCMEC and cooperating with law enforcement, as set out below.

2. How Echo is built to protect minors

Echo is a private messenger, not a social network. There is no public directory, no feed, no search for people and no way to be discovered: someone can reach you only if they have your Echo Key. These are the protections that apply, as they work in the app today:

  • Echo is for people 13 and older. Every new account is asked whether the person is 13 or older, and we keep that answer and when it was given. Echo is not directed to children under 13, and we delete an account when we learn it belongs to a child under 13 (Privacy Policy §14).
  • Child accounts in a Family. Inside a Family space, a parent can give a teen aged 13 to 17 a Child account. A parent guards the door, not the room: they decide who can reach their teen and when the teen can use Echo, and they cannot read the teen's chats. Echo gives parents the first power and not the second, because a tool that lets one person read another's messages is a tool that can be turned on anyone.
  • Nobody new reaches a Child without a parent saying yes. A friend request sent to a Child is held for the parent to approve or decline. An invitation that would bring a Child into a new family space or group waits for a parent too. The Child cannot accept either on their own, and a parent cannot approve a friend request past a block.
  • Parental controls for a Child: quiet hours, whether media can be shared, whether link previews load, and an approved-contacts list for family and group chats. These are enforced on our servers.
  • Disappearing messages that delete on both sides (Mutual Vanish) are off in any conversation with a Child account, in either direction, so a Child's conversations cannot be made to vanish by someone else.
  • Calls and Chambers. A Child can join only Chambers hosted by their own family, and can join a group call only when the host and whoever invited them are already among the Child's contacts (every contact a Child has was approved by a parent). Calls and Chambers are audio only; there is no video.
  • Limits on reaching strangers, for everyone. You can start a new one-on-one chat only with someone in your contacts; you can invite only your contacts to a group; and new accounts have lower daily limits for their first 7 days. Chambers are invite-only: only people who are invited can join — or, for a Chamber started from inside a family or group, the members of that family or group. There is no joining by link.
  • No ads, ever, and no profiling. Echo has no advertising, no analytics and no tracking, so there is nothing that learns about a minor to target them.

What these protections do not do, stated plainly. A "Child" is a role in a Family, not a verified age; Echo does not verify anyone's age. A teen with their own account outside a Family has no parent attached and none of the Family protections. Echo's messages are end-to-end encrypted, so we do not scan message content, and we cannot see abuse unless someone shows it to us. That is why reporting matters, and why we make it easy.

3. How to report

Inside the app

  • Report a message. Press and hold any message in a one-on-one chat, group or family chat and choose Report. Choose a reason, including Child safety, and add a note if you want. Your app sends us a readable copy of that one message as you see it (for a photo or voice note, a description of it), your reason and note, and we record the accounts involved and the times. Nothing is sent unless you report.
  • Report a person. Open a contact's profile and choose Report.
  • Report someone in a Chamber. You can report the host, a co-host or a speaker from inside the room, and for 24 hours after they leave or the room ends. Chambers are never recorded, so the report carries no audio; it sends us the room, the account, your reason and note, and whether you also blocked them.
  • Block. You can block anyone at any time, from their profile or from a report. A blocked account cannot contact you. Reporting and blocking are free on every plan.

We never tell the person you reported that you reported them.

From outside the app

Anyone, including parents, people who do not use Echo, and child-safety organizations, can write to our child-safety contact at child-safety@echomessenger.app. Include the Echo Key or display name of the account if you have it. Do not send us the abusive material itself: describe it, and report the material to NCMEC's CyberTipline (report.cybertip.org) or to the police, who are equipped to receive it.

If you are a minor and an intimate image of you has been shared, NCMEC's Take It Down service can help have it removed from participating platforms.

4. What we do with a child-safety report

  1. A person reviews it. Every child-safety report is read by a person at Echo, not by an automated system. Reports are kept with a hold, so a child-safety report is never deleted automatically while it is being reviewed.
  2. Apparent CSAM is reported to NCMEC. If a report or anything else gives us knowledge of apparent child sexual abuse material, we report it to the National Center for Missing & Exploited Children's CyberTipline, as United States law requires of providers (18 U.S.C. § 2258A). NCMEC may pass it to law enforcement. We do not forward or copy the material anywhere except into that report.
  3. We preserve the evidence. We keep the report and the account information we hold at the time we file it for at least one year, and longer when law enforcement asks us to, as the law requires.
  4. We act on the account. We may restrict or end the responsible account's access to Echo, and we may block it from contacting others. We do not notify the account that it has been reported.
  5. We cooperate with law enforcement through valid legal process (section 6), and we respond to emergency requests where we believe in good faith that someone is in imminent danger.

Other reports are reviewed the same way and kept for 12 months (Privacy Policy §11). We use reports to decide whether to warn, restrict, suspend or close an account.

5. The laws we follow

  • United States federal law on reporting apparent child sexual abuse material to NCMEC and preserving the related records (18 U.S.C. §§ 2258A–2258B, as amended).
  • The Children's Online Privacy Protection Act (COPPA). Echo is a general-audience service for people 13 and older. It is not directed to children under 13, we do not knowingly collect personal information from them, and we delete an account when we learn it belongs to someone under 13.
  • Apple App Store Review Guideline 1.2 and Google Play's Child Safety Standards policy, which these standards are written to meet: a way to report, a way to block, published standards, a designated point of contact and published contact information.
  • Other child-safety and child-privacy laws that apply where Echo is offered. Echo is not offered in the European Economic Area, Switzerland or the United Kingdom at present (Terms §12).

We review these standards at least once a year, and whenever the law or Echo changes in a way that affects them.

6. For law enforcement

We comply with valid legal process for data we actually hold. Because message content is end-to-end encrypted, what we hold in readable form is limited to account and routing information (Privacy Policy §2b), reports users have filed, and Echo Support chats. We hold no key that opens message content. Preservation requests and legal process can be sent by post to the address in section 7, with a copy to privacy@echomessenger.app. Please identify the account by Echo Key where you can; we hold no email address, phone number or legal name for any account.

7. Child-safety contact

Designated child-safety point of contact: Child safety team · child-safety@echomessenger.app, Controverse Labs LLC.

Related: Privacy Policy · Terms of Service · Delete your account.