Privacy
Your circles should stay yours.
Last updated: June 13, 2026
echooos is built for private groups, so the service is designed around keeping personal context limited, purposeful, and reviewable. This notice covers the website, waitlist, support forms, and mobile app.
Who is responsible
The controllers jointly responsible for the website, app, waitlist, support requests, and the systems that make the private social game work are Marcel Bartling (Stemmering 36, 45259 Essen, Germany) and Bastian Schmalbach (Viersener Strasse 10, 50733 Cologne, Germany). You can reach us about any data question at support@echooos.com or through the support page. We have not appointed a separate data protection officer because we are not legally required to; data protection requests go to the same contact.
Account and profile data
We process account details such as email address, display name, user ID, authentication provider details, optional profile image, birthdate, gender, country, language, time zone, app and notification settings, app version, platform, and related account timestamps. We use this for authentication, profile setup, product personalization, age-appropriate access, streak and time-zone-correct features, and app functionality.
Groups, games, and app activity
We process private group membership, group names and images, invite links, game participation, category choices, facet assignments, reactions, result views, read state, badges, progression, and similar gameplay or usage data. This data is linked to your account where needed to run the game, show results, personalize the experience, and improve product quality.
Friends and discovery
echooos lets you build a list of friends so it is easier to start groups and play together. Adding a friend is always opt-in and mutual: a connection exists only once the other person accepts your request. To provide this feature we process friend requests and their status, your accepted friend connections, an optional unique @handle you can claim to become searchable, and "people you play with" suggestions derived from groups you already share. You can remove a friend, decline or cancel a request, or block someone at any time; blocking removes the connection and hides you from each other. This serves the provision of the app you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in a useful and safe social experience (Art. 6(1)(f) GDPR).
Phone number verification (optional)
Making yourself findable by phone number is entirely optional, off by default, and never requested during sign-up. If you choose it, you verify your number with an SMS one-time code. Sending and checking that code is carried out by Firebase Authentication (Google), acting as our processor, which processes your phone number for this purpose. On our own servers we never store your phone number. We store only a salted, irreversible cryptographic fingerprint (a keyed hash) of the verified number together with the time of verification. This fingerprint lets people who already have your number find you, without us ever holding the number itself. The processing is based on your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future by removing your number in the app, which deletes the stored fingerprint.
Finding friends from your contacts (optional)
Syncing your contacts is optional, off by default, and asked for separately on its own consent screen — never during sign-up. If you turn it on, the phone numbers in your address book are turned into salted, irreversible fingerprints on your device. Only these fingerprints are sent to us: your contacts' names, numbers, and other details never leave your device and are never uploaded or stored by us. We compare the fingerprints against those of members who have verified their number, so we can show you which of your contacts already use echooos and let you know if one of them joins later (a "reverse match"). Any such notification uses that person's own echooos profile — never the name from your address book — and we never reveal a contact's number to anyone. The fingerprints we derive are deleted automatically after 90 days on a rolling basis, and you can disconnect at any time, which deletes the fingerprints we hold for you. The matching endpoint is rate-limited so it cannot be used to probe whether a given number is registered. This processing is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.
Photos, videos, and user content
If you upload profile or group images, create group names, answer prompts, react to games, or send feedback and support messages, we process that content to provide app functionality, keep the service reliable, and respond to you.
Notifications and device identifiers
If you allow notifications, we process push notification tokens, APNs or Firebase Cloud Messaging identifiers, badge state, and related device or app identifiers to deliver notifications and service updates. These identifiers may be linked to your account where needed for app functionality.
Product analytics, diagnostics, and session replay (PostHog)
We use PostHog for product analytics and error diagnostics (provider: PostHog, Inc., 2261 Market St. #4008, San Francisco, CA 94114, USA). Data is stored and processed in PostHog's EU cloud on servers in the European Union (eu.i.posthog.com, data center in Germany). Because PostHog is a US company, occasional access from the United States (e.g. for support or maintenance) and thus a transfer to a third country can occur. Any such transfer takes place on the basis of the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, which are incorporated into our data processing agreement with PostHog. PostHog captures automatic screen views and a small set of named events (sign-up, sign-in, group creation, group join, game completion), along with technical errors and crashes. When you sign in, we link these events to a person profile tied to your echooos account, so events captured anonymously before sign-up are backfilled onto your profile. Properties processed include email address, username, language, app flavor, and distribution platform. An approximate, city-level location may be derived from technical signals such as your IP address; we do not collect precise or GPS location. We also use PostHog mobile session replay to record how the app is used so we can diagnose problems and improve usability. All text and all images are masked in these recordings, so readable user content — including game answers, group names, display names, messages, and profile photos — is never captured; recordings show only the layout and interactions as masked shapes. PostHog acts as a data processor on our behalf under a data processing agreement pursuant to Art. 28 GDPR. A current list of PostHog's sub-processors is available at https://posthog.com/subprocessors.
Website, waitlist, and support
If you join the waitlist or send a support message, we store the information you submit, such as email address, name, topic, and message, along with basic context such as language, page path, user agent, and campaign parameters when available.
Sign-in and infrastructure providers
We use providers such as Firebase, Firebase Cloud Messaging, Google Sign-In, Sign in with Apple, plus hosting, database, and file storage providers. These data processors act only on our instructions and process authentication tokens, identifiers, files, diagnostics, and other service data only as needed to provide their services to echooos. We have data processing agreements pursuant to Art. 28 GDPR in place with all relevant providers, and we rely on appropriate safeguards such as the EU Standard Contractual Clauses for any transfers outside the EU/EEA.
Why we use data
We use data to provide echooos, authenticate accounts, keep groups private and safe, show results inside your group, personalize the product, deliver notifications, respond to support, improve quality, send launch or service updates, comply with legal obligations, and protect the service from abuse.
Legal bases
We process your data under the following GDPR legal bases: performance of the user contract and provision of the app and game functionality (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR), and our legitimate interests (Art. 6(1)(f) GDPR) in a stable, secure, and user-friendly product — including product analytics, error diagnostics, and fully masked session replay via PostHog, abuse prevention, and quality improvement. Where we exceptionally rely on consent (for example, push notifications on certain platforms, verifying your phone number to be findable, and syncing your contacts to find friends), processing is based on Art. 6(1)(a) GDPR; you can withdraw consent at any time with effect for the future.
Retention
We keep account, profile, game, notification, analytics, and support data for as long as needed to operate the service, keep it secure, improve product quality, respond to requests, and meet legal obligations. If you enable contact discovery, the contact fingerprints we derive are deleted automatically after 90 days on a rolling basis; if you disconnect contact sync or remove your verified phone number, the related fingerprints are deleted. Deleted items may remain in backups, logs, or audit records for a limited period.
Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Any consent you have given can be withdrawn at any time with effect for the future. You can submit requests via the support page. You also have the right to lodge a complaint with a data protection supervisory authority, typically the one in your place of residence.
Children
echooos is intended for users aged 16 and older, and is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. We ask for your birthdate during sign-up to support this age threshold; if we learn that we have collected data from someone under 16 without the required parental consent, we delete it. If you are a parent or guardian and believe your child has provided us with personal data, contact us at support@echooos.com.
Changes
When this privacy notice changes, we update this page and, when appropriate, notify users in the app or by email.
Questions about your data?
Contact support