Echo Privacy Policy

1. Who we are and how to reach us

Controverse Labs LLC, a Massachusetts limited liability company (Massachusetts identification number 002007256), 68 Harrison Ave, Ste 605 PMB 231072, Boston, MA 02111, USA ("Echo", "we", "us"), runs Echo and is the controller of the personal data described here.

Privacy requests and questions: privacy@echomessenger.app. General support: support@echomessenger.app. We answer within 45 days, and tell you if we need longer.

Controverse Labs LLC may make other apps. Personal data from Echo is used only for Echo. It is never shared with, transferred to, combined with or made available to any other Controverse Labs product, and it is never sold or used for advertising.

2. What we hold

We have split this by whether we can read it, because that difference is the whole point of Echo.

2a. What we hold encrypted

• The content of your messages, in one-on-one chats, groups and family chats.
• Photos and voice notes you send, and their captions and details.
• The emoji you react with (we can see that you reacted, not which emoji).
• Your profile photo, encrypted separately for each contact who can see it.
• The title and note of family calendar events.
• Sealed Chat key material and your recovery backup (§20).
• Message previews sent to your lock screen (§7).

How strong "we can't read it" is depends on what it is and when it was sent. Messages and what is in them — text, reactions, and the photos and voice notes you send — plus family calendar titles and notes: Echo cannot read them if they were sent since 12 October 2026 in a one-on-one chat, or since 25 October 2026 in a family chat, group or family calendar, or in a Sealed Chat set up since 25 October 2026. Everything else in this list, including anything older and your profile photo: Echo does not read it. §4 explains exactly what each of those rests on, and the one exception for a recovery backup.

2b. What we hold and can read

None of this is what you say, except where §11 (reports) and §12 (Echo Support) apply. All of it is needed to route messages and run the app. Some of it is more revealing than people expect, so we list it all.

Your account

• Your account identifier (an Internet Computer "principal") and your Echo Key.
• Your display name, stored in readable form.
• When your account was created and updated, your plan (Free, Pro or Family), and the public half of your encryption identity key.
• Your 13-or-older record: one value saying either "this person confirmed they are 13 or older" or "this account was created through a family seat invitation", plus when. No age, no birth date. It is deleted when you delete your account. Separately, we keep a daily count of how many accounts were created with each answer to that question — a "13 or older" confirmation, or a family seat invitation — with no account identifier, Echo Key, time or other detail attached, so we can show the question is being asked; it is not linked to you.

Who can look up what. Someone who looks you up by your Echo Key sees your display name and what their app needs to reach you and encrypt to you: your account identifier and your public identity key. They cannot see when your account was created or what plan you are on, with two narrow exceptions. Someone already in your contacts can see what plan you are on; the app uses this when they invite you to a family. And a family Admin who already knows you can see whether you are already covered before inviting you, so they know whether the invite uses one of their paid seats. Keep your Echo Key for people you want to hear from.

Who you talk to

• The participants in every conversation. One-on-one conversation identifiers contain both people's account identifiers.
• Your contacts, with their display names and Echo Keys, and any nickname you give a contact (stored in readable form); friend requests in both directions.
• Your family and group memberships, rosters and roles, including Child status.

Activity and timing

• When each message was sent, delivered, read, edited or opened.
• Delivery and read receipts (including per-member read times in family chats), unread counts, and whether someone is typing (held in memory only, never stored).
• Whether a chat is sealed and any timer set on it.
• The last day your account was active — the calendar day only, never the time.

The shape of a message

• Whether it is text, a photo or a voice note.
• How long a voice note is and its loudness pattern (the waveform), which are deliberately left unencrypted so the waveform can be drawn before the audio is opened.
• Which message it replies to, and how many times it was edited.

Families

• Family, group and sub-chat names, in readable form.
• Parental-control settings, including the approved-contacts list.
• Calendar event dates and times, all-day flags, and who has responded (not the title or note).
• Membership changes and calendar activity, recorded as system events.

Limits that keep Echo free of spam and bots

• The last day your account sent a friend request and how many it sent that day, so we can apply the daily limit. It is deleted with your account.
• When someone declines your friend request, a record of that pair of accounts, stored under a scrambled label instead of either account's identifier, so the same request can't be sent again straight away. It stops applying after 30 days, even if either account is deleted first.
• The sign-up puzzle your phone may solve when you create an account collects nothing: it uses a challenge from our servers and a counter, and nothing about you or your phone.

Push, payments, safety and support

• A push handle that links your account to a device (§7).
• Your subscription status and the store's purchase identifiers (§13).
• Reports you file or that name you, including what was reported (§11).
• Feedback you send us and your conversations with Echo Support (§12).

We do not store readable message previews. A one-on-one chat's preview field holds the word [encrypted]; a family chat's is empty.

2c. What we never collect

• Your email address, phone number, postal address or a password. There is no field for them.
• Your date of birth, age or age range.
• Your location. Echo asks for no location permission and does no location processing.
• Your phone's address book.
• Advertising identifiers, analytics, crash reports or usage telemetry. There is no analytics, crash-reporting, attribution or advertising code in the app, and the app's internal logs never leave your device in released builds.
• Anything sold or shared for advertising. Echo will never carry advertising. We do not "sell" or "share" personal information as California law defines those words.

3. Your Echo Key is pseudonymous, not anonymous

We see which Echo accounts talk to each other and when. An Echo account is not tied to your phone number, email or legal name, and Echo never asks for them. Your Echo Key is a short identifier our servers assign, meant to be shared with people you want to hear from; it is not a secret, and on its own it says nothing about who you are.

It is still personal data, and we treat it that way, because an account can be linked to the person behind it. These are all the ways we know of:

• Names people type. Your display name, any nickname a contact gives you, and the names of families and groups are stored in readable form, and every account in a conversation is linked to its display name. If you use your real name, your account carries it.
• Paying. Apple or Google knows who paid, and our billing records link that purchase to your Echo account (§13).
• Notifications. Apple or Google can link your notification token to your device, and our notification relay can tell that one device's notifications belong together (§7).
• Internet addresses. The networks that carry your connection see your IP address: Internet Computer boundary nodes, our relays on Cloudflare, the call relays, and any website whose link you preview. Echo's servers on the Internet Computer never receive it; our relays see it only while they carry your connection (§6).
• What you send us. Anything you write to Echo Support (§12), feedback you attach your Echo Key to, and any message or note you include in a report (§11).
• Your profile photo. It is encrypted, but anyone you share it with may recognise you.
• The pattern of your activity. Who you talk to, when, and how often can point to a person when combined with what someone already knows about you.

4. Encryption: what it does, what it doesn't, and who you're trusting

Message content is encrypted on your device before it leaves. Whether a build encrypts is fixed when the build is made; it can't be switched off remotely, per chat or per person. Before every iOS and Android release ships, our own release checks inspect the built app to confirm the encrypted send path is present and no unencrypted send path is left in it. These are checks we run ourselves, not an independent audit.

One-on-one messages sent since 12 October 2026, and family chats, groups and family calendar entries sent since 25 October 2026 — Echo cannot read them. Each one is locked with a key built from two halves: one made on the devices in the conversation, which Echo has never been able to open, and one Echo holds. No change to our servers, no court order and no change of ownership can unlock what you have already sent — with one exception: if you set up a recovery backup, it is only as strong as your recovery code and 8-digit PIN, and someone who obtained a copy of it, including by compelling us, could try every PIN (§20). For new messages, the only thing we could attempt is giving your app the wrong key for a contact, or adding someone to a family or group. Your app tells you if a contact's key ever changes, and comparing a safety number lets you verify the first one yourself. In a family or group, every member's app shows who joined before sharing anything with them, and a newcomer cannot open anything sent before they joined. Sealed Chats set up since 25 October 2026 are locked the same way, with the passphrase you each set on top. This protection depends on the Echo app on your phone being genuine. And it covers what is on our servers, not what you choose to send us: if you report a message, your app sends us a readable copy of that message for a person to review (§11).

Everything older — Echo does not read it, and this is what that rests on. One-on-one messages sent before 12 October 2026, family chat, group and calendar entries sent before 25 October 2026, and Sealed Chats set up before 25 October 2026 keep the encryption Echo always used. (A Sealed Chat set up before 25 October 2026 keeps its original key even if it is unsealed and sealed again — re-sealing changes the passphrase, not the key — so it stays in this group.) Our servers hold no key that opens them and release keys only to members of a conversation. But the key that unlocks them is one our own server code stands between, so a future version of that code could release it — and a recovery backup, if you set one up, reaches these messages too (§20). We have not done that and do not intend to. Three things back this, and the last two you can check yourself:

• Our servers release a conversation's key only to its members. There is no exception for us, for parents or for anyone else.
• A fingerprint of the exact code our servers run is public on the Internet Computer and changes whenever that code changes.
• Every conversation has a safety number you and the other person can compare. Your app tells you if a contact's key ever changes. In a family or group, every member's app shows who joined before sharing anything with them, and a newcomer cannot open anything sent before they joined.

Since 25 October 2026, "cannot" covers family chats, groups, the family calendar and new Sealed Chats as well as one-on-one chats. Nothing sent before that date is moved by it.

What encryption never does:

• It does not hide the information in §2b: who you talk to, when, and the shape of your messages stay visible to us.
• It provides no forward secrecy: the keys that protect a message today can, in principle, be re-derived later. That is also what makes account recovery possible.
• It doesn't stop someone photographing their screen, and doesn't protect a copy your phone puts in a cloud backup.
• It doesn't apply to chats addressed to us: Echo Support (§12), and what you send us in a report (§11).
• If you set up a recovery backup, it is only as strong as your 8-digit PIN (§20).
• It doesn't make Echo unhackable. No system is.

5. Who else receives data

We use no analytics, advertising, attribution or crash-reporting provider. We may also disclose information when the law requires it (§11b).

6. IP addresses

Echo itself does not collect, log or use your IP address, and does no location or country detection. Your IP address is still seen, in the ordinary course, by the network services that carry your connection: Internet Computer boundary nodes when your app connects, Cloudflare when our notification, billing, media and call relays run (including our call gateway), Apple or Google when a notification is delivered, and any website whose link you preview (§8).

7. Notifications

When you turn on notifications, your phone gets a token from Apple (or Google on Android). It is encrypted to a key only our relay holds before it leaves your phone. Our servers store it only in that form.

What Apple sees: your device token, a generic alert ("Echo" / "New activity"), a counter, and encrypted data it cannot open. Never your message, the sender or the conversation.

How your phone shows a preview. Your phone opens the encrypted data itself, using keys kept on your device and excluded from iCloud backup, and builds the preview there. The preview never exists in readable form on our servers or Apple's. By default, notifications show the sender's name only; you can choose "Private" (no name) or "Name + message preview" in Settings.

What our servers do hold is a push handle linking your account to a device. It is deleted when you delete your account.

No preview or sender name is ever sent for Sealed Chats, chats with a timer on, or Mutual Vanish messages.

8. Link previews

Off by default. With them off, a link is just text and nothing is fetched.

If you turn them on (Settings → Privacy & Security), typing a link makes your phone fetch that page to build a preview, before you send. That website sees your IP address, the time, and that the request came from Echo's link-preview tool. The request carries no cookies, no referrer and no login. Only the sender is ever exposed: the person who receives a link never fetches anything. If Echo can't tell whether previews are allowed, it doesn't fetch. A parent can turn previews off for a Child.

9. Messages that delete themselves

Vanish removes a message from your own copy of a chat after your timer. It does not reach the other person's phone. On our servers, the encrypted content of a Vanish message is deleted once the other person's app has received it and your timer has run out, or 7 days after you sent it if their app never receives it, whichever comes first. Vanish does not remove the message from the other person's device.

Mutual Vanish removes the message from both phones and our servers when its timer ends, and the timer starts when the recipient opens it. If it is never opened, our servers delete it after 7 days. You are always told before you open one. Mutual Vanish is not available in any chat with a Child account.

Scheduled deletions keep running even if the person who set them deletes their account.

What timers can't do: stop a screenshot or a photo of the screen, reach a backup your phone made before the timer ran out, or reach a copy someone included in a report (§11).

10. Photos and voice notes

Today: photos and voice notes you send are stored on our servers, encrypted, for as long as the message they belong to, just like text. They are deleted when the message is deleted or its timer ends (§9). Your phone also keeps its own copy.

What is changing. We are moving photos and voice notes, in one-on-one chats, families and groups, to a shorter rule: our servers will keep their encrypted copy only until everyone it was sent to has downloaded it, plus 7 days, and never longer than 37 days for anyone who never does. Your phone keeps the copy. Once that rule applies to everyone, restoring Echo on a new phone will not bring back older photos and voice notes, and text messages are unchanged. We will update this section when the shorter rule is in effect for everyone, and we will not describe it as in effect before it is.

Echo is not a backup service for your media. Keep your own copies of anything that matters.

11. Reports, safety and the law

Reports — the one way you can choose to show us a conversation. We do not read your messages, so when you report a message, your app sends us a readable copy of that message, as it appears to you, so a person at Echo can review it. For a photo or voice note, what reaches us is a description of the attachment, not the file itself. Nothing is sent unless you report. With it we keep: the accounts involved, the times, and which chat or group it came from; an encrypted copy of the original as stored on our servers, where we still hold one; and your reason, which we can read. If you report someone from your call history, the report also carries when that call was and how long it lasted. Please don't put anything in your reason you wouldn't want us to read. We use reports to decide whether to act on an account.

How long we keep reports. We keep a report for 12 months from when it was filed, then delete it automatically, unless it is a child-safety report or part of an open legal matter. A report filed as a child-safety report is held, with no end date, until a person at Echo has reviewed it and released the hold; until then it is never deleted automatically. Reports are kept separately from normal deletion, so they survive the reported message vanishing and either account being deleted.

Child sexual abuse material. If a report or anything else gives us knowledge of apparent child sexual abuse material, we report it to the National Center for Missing & Exploited Children (NCMEC) as US law requires (18 U.S.C. § 2258A). We keep the report and the account information we hold at the time we file it for at least one year, and longer when law enforcement asks us to. NCMEC may share it with law enforcement. Our full child-safety standards are at echomessenger.app/child-safety.

11a. Calls and Chambers

Voice calls are audio only and live: we do not record them, and we do not listen to them. Audio is encrypted on your phone before it is sent. To connect calls, our servers hold who called whom, who was on a group call, when, and for how long, and clear that call record shortly after the call ends. Your call history is kept on your phone.

Chambers (live audio rooms) are audio only. They are not recorded, and we do not listen to them. They are invite-only: only people who are invited can join — or, for a Chamber started from inside a family or group, the members of that family or group. There is no joining by link. Our servers hold who is in a room, who can speak or is listening, and when.

Reporting someone in a Chamber. You can report the host, a co-host or a speaker. Chambers are never recorded, so a Chamber report has no audio, clip or transcript attached. It sends us: which room it was (by its room ID, never the room's name), the account you reported, the reason you picked, your note if you add one, which we can read, whether you also blocked them, and when you filed it. We can see that the report came from you, even if you were listening hidden. We do not tell the person you reported that you reported them. A Chamber report is kept like any other report (above): 12 months, or, for a child-safety report, until a person at Echo has reviewed it and released the hold.

If you were in a Chamber, our server keeps a private note that you were there for 24 hours after you leave or the room ends, so a report can still be filed. If you were on stage (host, co-host or speaker), it also notes that, so you can still be reported. Listeners are never noted as on stage and can never be reported. Both notes are deleted after 24 hours, or when you delete your account.

Chambers' daily hosting limit. Hosting a Chamber comes with a daily fair-use limit (Terms §15). To apply it, our servers keep, for each host's plan, a running total of how much its Chambers cost to run that day, worked out from how many people could speak and how many were in each room, and for how long. For an Echo Family it is one total for the whole family plan, never a total per member. Each day's total is stored under a scrambled label rather than your account identifier, and only today's and yesterday's are kept. Older days are reduced to a count of how many plans fell into each usage band, with no label, account or date attached. While a Chamber is live we also keep that room's current rate, who is paying for it, and its wrap-up time. None of this records what was said, who spoke, or who listened.

11b. Requests from governments and law enforcement

We follow the law, and we can only hand over what we have. Like any company, we must comply with valid legal process, such as a subpoena, court order or warrant, for data we actually hold, and we won't promise otherwise. We disclose data only when the law requires it, in response to valid legal process, or when we believe in good faith it is needed to prevent imminent harm to someone. Where the law allows, we tell the affected user before disclosing; the app is the only channel we have to do that.

What we could provide is limited to what we hold in readable form (§2b): for example account identifiers, display names, which accounts talked to each other and when, and billing records; what someone reported to us (§11); and support chats (§12). We also hold encrypted data, including your encrypted messages and, if you set one up, your encrypted recovery backup (§20). We can be ordered to hand that over too, but we hold no key that opens it, and we do not read your messages (§4).

What no one can get from us in readable form. No one — not Echo, Apple, Google, or any government or authority — can use what Echo holds to read one-on-one messages sent since 12 October 2026, family chat, group and family calendar messages sent since 25 October 2026, or messages in Sealed Chats first set up since 25 October 2026 — with one exception: your recovery backup, if you set one up. We can be ordered to hand that over too, and it is only as strong as the recovery code and PIN that protect it (§20). Older messages are encrypted too and we do not read them, but their protection rests on our own server code, as §4 explains. §4 also explains the one way a new message could still be exposed, and how your app warns you. Your Echo Key is not a secret and unlocks nothing.

12. Feedback and Echo Support

This is the one part of Echo where we read what you write, because you wrote it to us.

Feedback (Settings → Send feedback) sends us what you typed, the category, your app version, build and platform. Nothing else goes with it: no performance numbers, no logs, and no field that could carry a message, a name or a contact.

Attaching your Echo Key is your choice. If you attach it, the feedback carries your Echo Key so we can look into your account's state, and, once our verified Echo Support account is live, it invites Echo Support to open a private chat with you. Until then we reply by the contact route you used to reach us. If you don't, no Echo Key is stored with it and we have no way to reply.

Echo Support, once it is live, is an account run by our team. A support chat is encrypted like any other chat, but we are in it, so we read it. It starts read-only; you can reply only after you tap to allow it, and Echo Support can't allow itself. Echo Support can only be in that one chat with you, never in your families, groups or any shared chat. We will never ask for your PIN, recovery code or seed.

Retention. Feedback is kept in an inbox of fixed size; when it is full, the oldest entries are deleted. Your permission for Echo Support to contact you is kept with your account and deleted when you delete it.

13. Payments

Echo never receives your card details. You buy Echo Pro and Echo Family in the app: through Apple on iPhone, and through Google Play on Android once subscriptions are sold there. The store is the merchant and handles your payment details under its own privacy policy. There is no free trial.

What goes to Apple from us (iPhone): a purchase identifier we derive from your Echo account by a one-way calculation Apple can't reverse. It is stable for the life of your subscription, so a renewal can be matched to your account.

What we keep: your plan, its status and end date, whether it renews, the store's identifiers for your subscription (Apple's transaction identifiers, or Google's purchase token) stored against your account, with a lookup from the identifier back to the account so renewals and refunds reach the right account, and a log of billing events.

What that means. Echo never links your payment to the content of your messages. But a subscription does create a lasting link between your Echo account and a payment record that Apple or Google could connect to your real identity. That is the cost of taking money. If that matters to you, the Free plan asks nothing of you.

When you delete your account, your subscription record is deleted. The billing event log is kept, because we must keep financial records by law, and it still carries your former account identifier, so a past purchase stays linked to it.

14. Teens, families and children

Echo is for people 13 and older. That includes Child accounts in a Family, which are for teens aged 13 to 17. Echo is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn an account belongs to a child under 13, we will delete it. A parent who believes their under-13 child has an Echo account can tell us at privacy@echomessenger.app and we will delete it.

A "Child" is a role a family Admin assigns. We collect no birth date and do no age verification.

A parent guards the door, not the room. A parent decides who can reach their teen and when the teen can use Echo. A parent cannot read the teen's messages in any chat the parent is not in: the keys are released only to a chat's members, with no parent, Admin or operator exception.

What parents control: membership and roles, seats, quiet hours, media sharing, link previews, and an approved-contacts list for family and group chats. Friend requests and invitations to a Child are held for the parent; the teen cannot accept them alone. Mutual Vanish is off for Child accounts. A Child can join only Chambers hosted by their own family, and can join a group call only when the host and whoever invited them are already among the Child's contacts (every contact a Child has was approved by a parent).

Limits: these protections follow the Child role, so a teen with their own account outside a Family has none of them; the friend-request gate lets a request through as an ordinary request if our check can't complete, and re-checks later; quiet hours use UTC.

Only the account holder can delete an account. A teen can delete their own Child account like anyone else. A family Admin can remove a teen from the Family, which ends their place in it, but cannot delete the teen's Echo account.

15. Legal bases (EU and UK)

Echo is not offered in the European Economic Area, Switzerland or the United Kingdom at present (Terms §12). We set out our legal bases anyway, because they are true wherever you are.

We do not rely on consent for any processing, and we do not profile you or make automated decisions with legal effects about you.

16. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to receive a copy in a portable form, to withdraw anything based on consent, and to complain to your data-protection authority. In California, you also have the rights to know, delete and correct, and not to be discriminated against for using them. We don't sell or share personal information for advertising, so there is nothing to opt out of.

How: write to privacy@echomessenger.app. We have no email or name for you, so to find your account we'll normally ask for your Echo Key, and may ask you to confirm a request from inside the app. Never send us your PIN or recovery code. You can use an authorized agent where your law allows. If we refuse a request, we'll tell you why and how to appeal.

What we can do:

• Access: we can give you everything we hold about you in readable form (§2b). We can't give you a readable copy of message content we don't read; your phone already has it.
• Correction: change your display name in the app.
• Deletion: delete your account in the app (§17), or ask us at the address above if you can't use the app. Because an Echo account has no email, phone number or password, we can only act on a request from outside the app once we can reasonably confirm it comes from the account holder; Delete your account explains what that takes.
• Portability: there is no automatic export yet. Ask us and we will provide your readable data.

17. Deleting your account

Settings → Account → Delete account. Echo shows you what goes and what stays, then asks you to type your display name. You have ten seconds to change your mind; after that there is no undo. The full walkthrough is at echomessenger.app/delete-account.

Deleted: your profile, display name and Echo Key; your contacts and any nicknames, from your list and from theirs; friend requests; blocks you set and blocks set against you; family and group memberships, parental-control settings, seats, calendar events you created and your responses; your recovery backup; your push handles; your reactions (in one-on-one chats, reduced to an empty marker so the chat stays in order; in families and groups, removed); your subscription record; your last-active day; your permission for Echo Support to contact you; your last friend-request day and count; any Chamber presence notes (§11a); and your 13-or-older record.

Not deleted, and why:

• Messages you sent stay in the conversation for the other people in it. They stay in the other person's app, and we can't reach into someone else's phone to take them back. Our servers also keep the encrypted copies that make up the other person's side of the chat, so their conversation does not break, together with the record that your former account took part in it. That account identifier is no longer linked to a name.
• Shared spaces you were in stay for their other members.
• Disappearing-message deletions you set keep running, so a message you sent with a timer still disappears from the other person's side on schedule.
• Reports naming you or filed by you, including any readable copy a reporter sent us, until their retention period ends (§11).
• The billing event log, which we must keep by law. It keeps your former account identifier (§13).
• Feedback you sent, without your Echo Key: we keep what you wrote as a record of the problem, but remove the link to you.
• A declined-friend-request record (§2b), stored under a scrambled label rather than your account identifier, which stops applying within 30 days.
• Chambers hosting totals (§11a), which are stored under a scrambled label rather than your account and are gone within two days.
• Copies held outside our live service, described below, and records other companies keep themselves: Apple's or Google's purchase records, and our service providers' operational logs, under their own retention rules.

Echo shows no "this person left" label anywhere, so deleting your account looks the same from outside as being blocked or never connected.

If you have an active subscription, cancel it with Apple or Google Play first; Echo can't cancel it for you.

Copies outside our live service. Deleted records are removed from the live data Echo runs on. Our servers also keep a small number of recent snapshots, which are replaced as we update the service and are not kept indefinitely, and the Internet Computer network itself may hold copies we cannot reach. We can't promise to erase every copy from every snapshot or replica. What such a copy holds of your messages is encrypted.

18. How long we keep things

19. International transfers

Echo's servers run on the Internet Computer, a network of independent node providers in several countries; Cloudflare, Apple and Google operate globally. Your data is processed outside your country. Where the law requires, we use safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum with our service providers.

20. Security

• Message content is end-to-end encrypted (§4 explains what that covers, and what it doesn't). Before every iOS and Android release ships, our own release checks inspect the built app to confirm the encrypted send path is present and no unencrypted send path is left in it. These are checks we run ourselves, not an independent audit.
• Your account's secret key is stored in your phone's secure storage (the iOS Keychain), on that phone only. On current versions of Echo, it stays on your phone and isn't included in iCloud or computer backups, so to move Echo to a new phone you need your recovery code and PIN, or your recovery phrase if you saved one. A backup made before you updated Echo may still contain it until that backup is replaced.
• Your recovery backup. If you set up recovery, we store a copy of your account key, encrypted with a key made from your 8-digit PIN. Your PIN never leaves your phone and we never see it, and recovery attempts through Echo are rate-limited. But a PIN has a limited number of possible values, so your backup is only as strong as your PIN: someone who obtained a copy of it — for example by breaking into, or legally compelling, Echo or the network it runs on — could in principle try every PIN on their own computers. Keep your recovery code private, and never reuse your PIN.
• Echo's chat data on your phone is excluded from iCloud and device backups.
• Apple and Google do not get your account key from Echo. We don't send it to them, and on current versions of the app it isn't in your iCloud backup (above). Echo's Android app turns off Android's automatic app backup. Apple and Google do keep what they collect themselves, such as purchase records and notification tokens (§5).
• On iPhone, Echo covers its screen whenever you leave the app, so the app switcher does not show your chats.
• Nothing is logged off your phone in released builds.

Limits we'd rather state than have you find: Echo's chat database on your phone is not yet encrypted separately from your phone's own protection, so someone with your unlocked phone may be able to read it. No method of storage or transmission is completely secure, and we will never claim Echo is.

21. Clearing your history

Pro and Family members can clear their entire message history at once, from Settings. It removes your copy from this phone and your own access to that history on our servers, in every chat. It does not delete the other people's copies, which stay on their phones and in their access, and it does not stop disappearing-message timers you set from running. Your account, contacts and families stay as they are.

22. Changes and contact

If we change this policy in a material way, we'll tell you in the app before it takes effect; we have no email for you, so that is the only channel.

Contact: privacy@echomessenger.app (privacy) · support@echomessenger.app (everything else) · child-safety@echomessenger.app (child safety; see our standards) · Controverse Labs LLC, 68 Harrison Ave, Ste 605 PMB 231072, Boston, MA 02111, USA.