Data & Compliance

• Data Controller: Gioel Antoni, an individual sole proprietor in Italy, decides why and how your data is processed. Contact: support@echoframe.help.
• Data Processors: the providers that process data on our behalf and under our instructions (such as Supabase for hosting and MapTiler for maps). They are listed in the processor register below, each under a data-processing agreement.
• Supervisory authority: as we are established in Italy, our lead authority is the Garante per la protezione dei dati personali.

Purpose limitation

We collect data for the specific purposes set out in the Privacy Policy — running your account, anchoring and discovering echoes, social features and security — and we do not reuse it for unrelated purposes.

Data minimisation

We collect only what the Service needs. There are no advertising identifiers, no contacts access, no background movement log, and no analytics SDKs in the App. The location we store is the point you deliberately anchor an echo to.

Storage limitation

We keep data only as long as needed for the purpose it was collected, per the retention schedule. When you delete your account, your data is removed and ages out of backups.

Lawful basis

Every processing activity has a lawful basis — contract, consent, or legitimate interests — set out in the Privacy Policy. Sensitive processing (precise and background location) relies on your explicit device-level consent.

Privacy by design & by default

• Camera-only capture means we never ingest your whole photo library.
• Background location is off until you explicitly enable proximity alerts.
• Each echo defaults to the visibility you choose, and private circles limit who can discover an echo within the App.
• Database row-level security enforces, at the data layer, that users can only reach data they're entitled to.

We aim to respond to any request within one month, as the GDPR requires.

Our App Privacy information on the App Store reflects the practices in this document. In summary:

• Data linked to you: contact info (email), user content (photos, comments, messages), identifiers (account ID) and precise location — all used only to run the Service.
• Tracking: we do not track you across other companies' apps or websites, and we do not use data for third-party advertising.
• Permission strings: the App explains, at the moment it asks, why it needs the camera, location (while-in-use and background) and notifications.
• Background location: requested only for proximity alerts, with a clear in-app explanation before the system prompt.
• Account deletion in-app: as required by App Store guidelines, you can delete your account and all associated data directly in the App (Settings → Account → Delete account).

• Encryption in transit: all communication uses HTTPS/TLS.
• Encryption at rest: databases and stored files are encrypted at rest by our infrastructure providers.
• Password handling: passwords are salted and hashed (bcrypt) by our authentication provider; we never store or see plaintext passwords.
• Authentication security: sessions use short-lived, auto-refreshing tokens stored in your device's hardware-backed secure storage; authentication endpoints are rate-limited by our provider.
• API & access control: database row-level security policies enforce per-user access at the data layer; storage access is scoped to each user's own files.
• Backups: encrypted backups support recovery and are rotated on a rolling window.
• Logging: we keep limited operational logs for security and debugging, and avoid logging sensitive personal data in production.

Core data is stored in the United Kingdom (London region), which benefits from a UK adequacy decision. Where a provider processes data in the United States or elsewhere, we rely on appropriate safeguards (Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework). See the Privacy Policy for more.

We review this document as the Service and the law evolve, and update the effective date on any material change. Questions or requests:

• Gioel Antoni
• Capalbio (GR), Italy
• support@echoframe.help