Privacy Policy

The short version

EchoMap has no advertising, no analytics, and no trackers of any kind. Nothing about you is sold or shared for marketing. A pin you publish is placed at the centre of a grid cell — about 150 m, 1.2 km or 5 km wide, your choice — on your own device, before it reaches any map. You can delete your account and its contents from inside the app at any time.

The rest of this page is the detail, including the parts that are less flattering — what other people can see, what leaves your phone, who moderates, and what survives deletion.

1. Who this covers

This policy covers the EchoMap Android app (com.echomap.app) and this website. EchoMap is an independent app published by the developer listed on its Google Play listing, who is the data controller for the purposes of the UK GDPR, the EU GDPR, and equivalent laws.

Contact for any privacy question, request, or complaint: support@echomap.space.

2. What EchoMap collects

Things you type. Your username, display name, bio, age and gender. Age must be between 18 and 70; gender is chosen from a fixed list, or left unanswered.

Things you create. Memories, notes, folders, and the places you pin — including the true coordinates of those places.

Photos. Profile photos, and any photo you attach to a message.

Messages. What you send in direct conversations and in place rooms.

Reviews and ratings. The words and the star rating you leave at a published place, under your display name.

Connections. Who you have connected with, and the status of pending requests.

Account identifiers. A Firebase account ID, and — if you sign in with Google — the email address on that Google account. A username-only account has no email attached at all.

A push-notification token, so the app can reach your device. It is stored only while notifications are switched on for your account on that phone: signing out, or turning notifications off, removes it.

A location salt, generated on your device when you sign up and stored where only your account can read it. It is never sent to another user, and it is not what places your published pins — those are grid-cell centres, described in section 4.

Reports. If you report someone, the report holds your account identifier, theirs, the reason you chose, and any details you typed.

EchoMap does not collect your contacts, your photo gallery, your browsing, your device advertising ID, or any analytics or crash telemetry.

3. Who can see what

This is the part most policies leave vague, so it is spelled out.

Any signed-in EchoMap user can see: your username, display name, bio, age, gender, and your profile photos. Treat all of those as public. That is what makes you findable in search and recognisable on a person card.

Only you can see: your memories, notes, folders, the true coordinates of your places, your location salt, and your notification token. These are enforced as owner-only by the database security rules, not merely by the app.

People standing at the same place can see: a place pin you chose to publish, the review and rating you left there, and whatever you wrote in that room. A private place is published to nobody.

The person you are talking to can see: your messages and any photo you attach. A direct conversation is readable by the two accounts in it and by the moderator described next — nobody else.

The moderator can see: direct messages and place-room messages while investigating a report. EchoMap is run by one developer, and one administrator account — the developer's — can open a reported conversation or room, read it, and delete content or remove an account. That access exists so that a report of harassment can actually be acted on; it is not used for anything else, and there is no automated scanning of messages.

Nobody can see: your exact position. See below.

4. Location — in detail

Only while the app is open. EchoMap does not hold Android's background location permission, so the operating system will not give it your position when the app is not in front of you. Auto-capture of places can be switched off entirely on the Profile tab.

Quantised on your device, before anything is published. A published pin is placed at the centre of the grid cell your position falls in — not at your position, and not at a random offset from it. Everyone standing anywhere in that cell publishes the same point, so watching a pin repeatedly reveals nothing more than the first look: an observer learns which cell you were in, and nothing finer. The exception is a named venue: at the Block level, when OpenStreetMap identifies the café or shop you are in, the pin is placed on that venue's own map point — the café is the place, and blurring it would stop it being that café for everyone else there. At District and City no venue snapping happens.

You choose how coarse. Block (a cell about 150 m wide), District (about 1.2 km), or City (about 5 km). Block is the finest available and the default; a tighter setting was removed because a cell smaller than a building does not hide one.

No-show zones. Areas you mark as never-publish produce no pin at all, rather than a coarser one.

FIND ME ON THE MAP starts OFF. Until you turn it on, nothing of your position is published to anyone.

What does leave your device, and where it goes. When you pin a place, or auto-add pins one for you, EchoMap sends your device's precise latitude and longitude to OpenStreetMap's public Nominatim service (nominatim.openstreetmap.org) to ask what is there — the café, the park. If that fails it may fall back to your device's built-in geocoder, which on Android is operated by Google. Only the coordinates and a request are sent — no account identifier, no name, nothing that links the query to you. Those services have their own privacy policies and EchoMap does not control them. This is the one path on which an unblurred position leaves your phone, and it exists so that a place can have a real name instead of a number.

True coordinates are stored only in your own owner-only data, and are never written to anything another user can read.

5. Photos

Profile photos can only be taken with the in-app camera. EchoMap holds no gallery permission whatsoever, so it cannot read pictures you already have. That restriction is the anti-impersonation promise expressed as a permission the app never has.

Profile photos are visible to any signed-in user alongside your name and age — treat them as public. Photos attached to messages are readable only by the people in that conversation or room, enforced by storage security rules.

6. Who processes your data on EchoMap's behalf

Google (Firebase). Authentication, database (Firestore), file storage, and push notifications. This is where your account and content live.

Google (Maps SDK for Android). Draws the map. It receives the map view being displayed.

OpenStreetMap Foundation (Nominatim). Receives your device's precise coordinates to return a place name when you pin a place or auto-add pins one, as described above.

Cloudflare (Images). Delivers photos attached to messages, when that option is enabled on the service. When it is not, those photos are stored in Firebase instead.

Railway. Hosts this website.

These are service providers acting on instructions, not partners who are given your data to use for their own purposes. Nothing is sold, rented, or shared with advertisers or data brokers — there are none in this app.

EchoMap will disclose data where it is legally required to, or where it is necessary to investigate a report and protect someone's safety.

7. Where your data is held

Firebase stores data in Google's data centres, which may be outside your country, including in the United States. Where personal data moves out of the UK or the European Economic Area, it relies on the transfer mechanisms Google offers its customers, such as Standard Contractual Clauses.

8. Why EchoMap is allowed to hold it

Where the UK or EU GDPR applies, the legal bases are: performance of a contract for the things the app cannot work without — your account, your content, your connections; consent for location and camera access, which Android asks you for separately and which you can withdraw in system settings at any time; and legitimate interests for keeping the service safe, which covers moderation records and abuse prevention.

9. How long it is kept

Your account and its contents are kept until you delete them. Deleting your account removes them immediately, and the removal is thorough: your profile and photos, your memories, notes and folders, your published pins — sealed FOREVER memories included — every message you sent in any room, every photo attached to one, and each of your direct conversations in full, for both people. The other person does not keep a copy. What the app cannot reach itself is swept afterwards by a server-side routine running with administrative rights, which retries until it succeeds.

Two things outlive account deletion, and it is fairer to say so than to imply otherwise. Star ratings you left at places stay, stripped of everything that identifies you: the review's words are deleted, the name becomes "Someone", and the link back to your account is removed. A rating is a fact about a place, and a café's average is not the reviewer's to take away on the way out; a review that was only words, with no star, is deleted outright. Moderation records from reports are kept for as long as they are needed to protect other users; a report holds the account identifiers and display names of both people, the reason chosen, any details typed by whoever filed it, and the title of the place concerned.

The full breakdown is on the account deletion page.

10. Your rights

You can access everything about you that is not already visible in the app, correct your profile from the Profile tab, delete your account and its contents with DELETE ACCOUNT, object to or restrict processing, and request a copy of your data in a portable form.

For anything the app cannot do by itself, email support@echomap.space. Expect a reply within 30 days.

If you are in the UK you may complain to the Information Commissioner's Office; elsewhere in Europe, to your national data protection authority. Please raise it with us first if you can — it is usually faster.

Controls inside the app: the location blur level, FIND ME ON THE MAP, auto-capture, no-show zones, retaking or removing photos, deleting individual memories, notes and folders, and blocking another user — which removes them from your map and stops their notifications reaching you.

11. Children

EchoMap is for adults. You must be 18 or over, the app refuses an age below 18, and it is not directed at children. If you believe a child has created an account, email support@echomap.space and it will be removed.

12. Security

Everything travels over encrypted connections. Access is enforced by server-side security rules rather than by the app alone, so a modified client cannot read what it should not. Your location salt and notification token are owner-only. Banned accounts are refused at the database, not merely hidden in the interface.

No system is perfect. A username-only account has no email attached, which means its password cannot be reset — if you lose it, the account is unrecoverable. Choose Google sign-in if that matters to you.

13. Changes to this policy

If this policy changes, the updated version appears here with a new date before it takes effect, and material changes are shown in the app.