Privacy Policy
The short version
- EchoIt has no accounts. We never ask for your phone number, email or real name.
- Your messages, contacts and files are kept on your device, with the words of your messages encrypted. We have no copy and cannot read them.
- Who you talked to and when is not encrypted on your device. Keep a lock screen on.
- There is no backup. If you lose your device or uninstall EchoIt, your history is gone; your recovery phrase brings back who you are, not your messages.
- The people you talk to receive what you send, your name and picture, and when you are online, typing, or have read their messages. These can't be hidden yet.
- To find your friend's device, EchoIt uses a connection helper and an address directory, run by Number 0 (until mid-November 2026 the helper is ours). They see your device's internet address and when it is online, never your messages. EchoIt also asks GitHub once a day for updates; you can turn that off.
- No ads, no tracking, no analytics. We don't collect or sell anything about you.
- Not for children under 13. EchoIt is a beta — read the beta section before you rely on it.
Who we are
EchoIt is made by Parth Sarthi Mishra, an independent developer in India. "We" and "us" on this page mean that developer. To ask anything about privacy, write to wforsarthi@gmail.com. You can also message the developer on Telegram, Discord or Instagram (see the contact section). Anything sent there goes through those services, under their own privacy policies, and we see what you send us.
What stays on your device
Everything you make in EchoIt lives on the device you made it on:
- your messages, reactions and replies
- photos, videos and files you send or receive
- your contacts, their names and pictures
- your name, your picture and your recovery phrase
The words of your messages and your files are encrypted on your device, with a key kept in your device's secure storage. Someone who copies EchoIt's files off your device cannot read them. A file you save out of EchoIt — to your Downloads folder, say — becomes an ordinary file on your device, and the files you send stay where they were, as they were.
Who you talked to and when is not encrypted on your device. Someone with access to your device's files could see that you had a conversation, with whom, and when — but not what was said. And anyone holding your unlocked device can simply open EchoIt. A lock screen PIN or password is what protects you here.
There is no copy anywhere else, so nobody can restore your history for you — not us, not anyone. Your twelve-word recovery phrase brings back who you are on a new device, not your messages.
What the people you talk to receive
When you add someone and they accept, their device receives from yours:
- what you send them — messages, reactions, photos, videos and files
- the name and picture you chose, and any change to them
- when you are online, when you are typing, and when you have read their messages
There is no setting to hide your online status, typing or read receipts yet. What you send is theirs to keep: deleting a message, a chat or a contact only removes it from your device. Removing or blocking someone happens on your device only, and they are not told.
What leaves your device, and who can see it
Phones and computers have no fixed address on the internet, so EchoIt needs some help to find your friend's device. This is everything EchoIt sends to a server, and what that server can see:
| Service | Why EchoIt uses it | What it can see | Who runs it |
|---|---|---|---|
| The connection helper | While EchoIt is open, your device stays in touch with the helper, which introduces it to your friend's. Most of the time your messages then go straight between the two devices. If they can't reach each other directly, the helper passes your messages and files along — still sealed. | Your device's ID, its internet (IP) address, when it is online, and how much it sends through the helper. It cannot read anything it passes along, and it does not store messages: a message for someone who is offline is not kept there. It waits on your device instead. Number 0 says it watches its helpers for abuse; it does not say what it keeps, or for how long. | Number 0, the company that makes the networking software EchoIt is built on. We don't run it and receive nothing from it. Until mid-November 2026, EchoIt uses ours instead — see below. If you'd rather use neither, you can point EchoIt at a helper you run yourself, in Settings → Connecting. |
| The address directory | Each time EchoIt opens, it publishes where your device can currently be reached, so your contacts' devices can find it. | Your device's ID and which connection helper it uses. Like any website, it also sees your internet address each time EchoIt publishes. Number 0 does not say what it keeps, or for how long. | Number 0, the company that makes the networking software EchoIt is built on. We don't run it and receive nothing from it. It cannot be turned off yet. |
| The update check | Once a day, EchoIt asks whether a newer version exists. Updates are downloaded from the same place. | Nothing about you or your conversations — but like any website, it sees your internet address and roughly when the app was opened. | GitHub. You can turn the check off in Settings → Updates. |
We have not tested whether the helper or the directory could work out which two devices are talking to each other, so we do not promise that they can't.
Your device's ID is a code created on your device. It is not your name or your phone number.
Our own helper, until mid-November 2026
Until then, EchoIt uses a connection helper we run ourselves, on Amazon Web Services in Mumbai — the one EchoIt 0.7.0 and earlier use, so that people who haven't updated can still be reached. EchoIt switches to Number 0's helper only if ours doesn't answer when the app opens. Ours sees the same kind of information as Number 0's and cannot read anything either. It may keep records of connections — a device's internet address, its device code, and the time — until we switch it off in mid-November 2026, when everything on it is deleted. After that, EchoIt uses Number 0's helper, and EchoIt 0.7.0 and earlier will no longer be able to connect — please update.
What EchoIt does not do
- No ads, no analytics, no tracking, and no crash reports sent anywhere.
- No access to your phone's contacts, location, camera or microphone.
- Notifications are made on your device. A message notification shows only who it is from — not what it says.
- We do not sell, share or rent anything about you. We have nothing about you to sell.
What EchoIt asks your phone for
- Notifications — to tell you about new messages and files.
- Running while open — Android shows a notification that EchoIt is running, so it can keep receiving while you use your phone.
- Files you choose — only the file you pick when you send one, and the place you choose when you save one.
This website
This website is hosted by GitHub Pages, so GitHub sees visits to it. Its fonts, styles and pictures are served from the site itself; the only other thing the main page asks for is the latest download links, from GitHub. We use no cookies and no analytics, and we don't receive any of that information.
Your choices and rights
- See or copy your data: it is all on your device, in EchoIt.
- Delete your data: Settings → Reset removes everything from this device; uninstalling does too. Your contacts keep what you sent them.
- Ask us for your data: we keep no records about you, so we have nothing to show, correct or delete — apart from the connection records our temporary helper may hold until mid-November 2026; if you want to know about yours, write to us. For what Number 0 or GitHub may hold, ask them.
Privacy laws, such as India's Digital Personal Data Protection Act and Europe's GDPR, give you rights over data an organisation holds about you. If you believe we hold any, write to wforsarthi@gmail.com and we will answer.
Children
EchoIt is not meant for children under 13. We cannot check anyone's age, because we collect nothing about you.
EchoIt is a beta
Versions before 1.0.0 are test versions. They can have mistakes, including mistakes that affect privacy. When we find one, we fix it and say so in the release notes.
Changes to this policy
If we change this policy, we will publish the new version here with a new date. If the change matters to you, EchoIt will show it the next time you open the app and ask you to accept it again.