Echomitter

Privacy Policy

Last updated: June 5, 2026

1. Data controller

The controller of data processed in the Echomitter application is Łukasz Dziuk, a sole trader registered in Poland under the business name Łukasz Dziuk, NIP: 5993250206. Business address: ul. Wawrzyńca Engeströma 10, 60-571 Poznań, Poland. For privacy matters, contact us at: support@echomitter.com.

2. Data we process

Depending on how you use the app, we may process the following categories of data:

The list below describes the main categories of data and examples of data within those categories. Specific data may depend on the features used, operating system, plan, and user settings.

  • account data, such as email address, username, account identifier, and social login provider if used,
  • authentication data handled by the identity provider, including session tokens stored locally on the device,
  • audio-video materials recorded by the user, including active streams, completed recordings, generated download files, and technical metadata,
  • local recording and upload resume data, such as recording session identifier, unsent recording data, upload status, file size, creation time, and finalization state,
  • location data, such as latitude, longitude, accuracy, heading, speed, and capture time, if the user grants location permission and uses a recording or safety feature that supports location,
  • trusted-contact relationship data, invitations, acceptance statuses, approval or rejection history, and access history,
  • recording deletion request information, such as request status, initiating user, approval or rejection, and request creation or completion time,
  • download information, such as generated file status, file metadata, and download counters,
  • account status information, Terms and Privacy Policy acceptance records, account deletion requests, plan limits, and recording storage usage,
  • push notification tokens and in-app notification data used to send and display app alerts,
  • subscription and purchase information received from Apple App Store or Google Play, such as product identifier, subscription status, purchase token, transaction identifiers, original transaction identifier, account token, and other technical billing information,
  • technical data, such as IP address, device type, platform, diagnostic logs, error information, and server events.

Location is optional. If the user does not grant permission or disables location services, recordings may work without GPS data and some location-based safety features may be unavailable.

3. App permissions

  • Camera - used to record video during a video session.
  • Microphone - used to record audio with video.
  • Device storage or system file access - used only when the user chooses to save, share, or open a downloaded recording on the device, depending on the operating system and selected save method. After saving, the downloaded recording may be visible in the device's system gallery, media library, downloads folder, or file manager. Echomitter is not used to browse the user's private gallery or access files unrelated to recording downloads.
  • Location - used optionally to attach GPS data to recordings and, when available for the account, to show trusted contacts a GPS signal or last available position.
  • Push notifications - used to inform users about app events, invitations, and status changes.

4. Purposes of processing

We process data to:

  • create and operate user accounts,
  • enable recording, uploading, playback, and download of audio-video materials and related GPS location data,
  • operate protected deletion mechanisms, safety periods, trusted-contact approvals, and recording retention,
  • resume recording uploads after connectivity loss, device restart, or app interruption,
  • attach GPS data to recordings or show GPS signal or last available position during safety features that use location, if the user granted location permission,
  • share active recordings, completed recordings, downloaded recordings, location information, and selected account-safety events with trusted contacts when app features and permissions allow it,
  • authenticate users, including through supported social login providers,
  • handle subscriptions, payments, plan status, and account entitlements,
  • send push notifications and in-app notifications related to app operation,
  • protect against abuse, diagnose errors, and maintain the service,
  • meet legal, tax, and accounting obligations.

5. Legal bases for processing

If GDPR or similar data protection laws apply, we process data on the following legal bases: performance of the agreement for use of the app, where data is needed to operate the account and Echomitter features; user consent where required by the system or law, for example for location or notifications; legal obligations, in particular tax and accounting obligations; and legitimate interests, including service security, error diagnosis, abuse prevention, handling claims, and responding to user requests.

6. Trusted contacts

If a user adds a trusted contact, that contact may access certain information and materials related to the user's account, recordings, and safety features, according to app features and current permissions. This may include notifications, active recordings, completed recordings, downloads of completed recordings, recording deletion requests, trusted-contact change requests, and selected account-safety events. If the user enables location for recording or safety features, the trusted contact may see the last available position for a recording or, when live access is available for the account, the current GPS signal shared through that feature. Users should add only people they trust and want to share this level of information with.

7. Payments and subscriptions

Payments are handled by Apple App Store or Google Play. We do not store full payment card details or other full payment instrument details. We receive information from store operators needed to confirm purchases, handle subscriptions, and grant the correct account plan, such as product identifier, subscription status, transaction identifier, or other technical billing information.

8. Who we share data with

Data may be shared with or entrusted for processing to the following categories of recipients:

  • cloud infrastructure, hosting, database, and file storage providers, including Amazon Web Services,
  • identity and social login providers,
  • push notification providers,
  • Apple App Store and Google Play operators,
  • diagnostic, security, and error monitoring tools, if used,
  • trusted contacts selected by the user, according to app features and the rules described in section 6,
  • public authorities, courts, or other authorized entities if required by applicable law.

We do not sell users' personal data to advertisers or data brokers.

9. Data retention

We store account data for the duration of the account or longer if required by law. Audio-video materials are stored as long as needed to provide the service, handle downloads, and support deletion features available in the app. Location data linked to a recording is deleted with that recording or with the account, according to deletion mechanisms available in the app. Technical logs, if created by the app or infrastructure, may be processed for diagnostics, security, and service maintenance.

Recordings may be subject to protected deletion mechanisms, including trusted-contact approval or a safety period. Currently, deletion requests created by the account owner have a 14-day safety period, while deletion requests created by a trusted contact have a 48-hour safety period. The standard maximum recording retention period in the service is up to 90 days, unless law, user plan, deletion request, security obligations, or technical limitations require different handling.

When an individual recording is deleted, the deletion process covers the selected recording, media files, download files linked to that recording, and stored GPS location points. Some limited technical records, such as information that a session was marked as deleted or deletion request history, may be retained for system consistency, security, abuse handling, or audit purposes.

10. Security

We use technical and organizational measures designed to protect data against unauthorized access, loss, alteration, or disclosure. This includes access controls, private media storage, limiting access to materials, secure communication with backend services, and mechanisms designed to reduce accidental or unauthorized deletion of recordings. No system can guarantee complete protection against all risks, so users should protect access to their account and device.

11. Transfers outside the EEA

The providers described in section 8, in particular cloud infrastructure providers, identity providers, push notification providers, app store operators, and diagnostic tools, may process data outside the European Economic Area or allow access to data from such countries. Where this applies, we rely on the transfer mechanisms, data processing terms, and privacy documentation made available by those providers, and we handle such transfers in accordance with applicable data protection laws.

12. User rights

Depending on applicable law, users may have the right to access their data, delete data, restrict processing, transfer data, object to processing, and withdraw consent where processing is based on consent. If account data is incorrect or needs to be updated, the user may request correction where the change is possible under app functionality and applicable law. To exercise these rights, contact us at: support@echomitter.com.

Users may also delete their account according to app features. Instructions are available on the Echomitter account deletion page.

Users may also delete individual recordings without deleting the account. Instructions are available on the Echomitter recording deletion page.

Users in the European Economic Area may also lodge a complaint with the competent data protection authority. In Poland, this is the President of the Personal Data Protection Office.

13. Minors

Echomitter is not directed to persons who cannot independently use the app under applicable law or app store rules. A minor may use Echomitter only where permitted and, if required, with consent or supervision of a parent or legal guardian. If we learn that an account was created or data is processed in violation of these rules, we may restrict access, delete data, or delete the account.

14. Changes to this Policy

We may update this Privacy Policy when the app, data processing, or legal requirements change. The current version will be available at this address. For material changes, we may notify users in the app or require them to review the updated Policy before continuing to use selected features.

15. Terms

Rules for using the app are described in the Echomitter Terms of Use. The Terms and Privacy Policy are also available in the app from the settings panel and from the links shown at the bottom of the login screen.