PRIVACY POLICY

Last updated August 27, 2026

This Privacy Notice for Fabiana Marselli (doing business as ECHO) ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Download and use our mobile application (ECHO), or any other application of ours that links to this Privacy Notice
• Use Echo. Echo is a mobile app that detects when users have been in the same place at the same time, making invisible crossings visible.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@echoapp.it.

SUMMARY OF KEY POINTS

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register on the Services or otherwise when you contact us. The personal information we collect may include:

• Email addresses
• Usernames
• Passwords
• Age range (used only to match you with Echo users in the same age bracket)
• Contact or authentication data (including, if you choose, Sign in with Apple or Sign in with Google)
• Personality/matching answers (optional): responses to a short set of questions about your social energy, adaptability, comfort with silence, and pace, used only to improve match affinity with other Echo users. Never shown to other users directly.
• Private profile details (optional): what you're looking for, interests, daytime/occupation, and whether you have pets. This information is stored to personalize your experience and is never shown to other users.

Sensitive Information. We do not collect government IDs, financial account details, health information, or biometric data. We do process your device's precise geolocation, which some laws (such as the CCPA) classify as sensitive personal information. We collect it only to power Echo's core feature of detecting other Echo users near you, as described below.

Application Data

If you use our application, we may also collect the following information if you choose to provide us with access or permission:

• Geolocation Information. We request access to your device's precise location, either continuously in the background or while you are using the app, to detect other Echo users nearby and power notifications when someone is close to you. If you wish to change our access or permissions, you may do so in your device's settings. If background/"Always" location access is not granted, Echo cannot detect nearby users while the app is closed.
• Push Notifications. We request permission to send you push notifications about nearby users, messages, and account activity. If you wish to opt out, you may turn them off in your device's settings.
• Messages and Proximity Data. When you exchange messages with another Echo user ("7 Istanti," limited to 7 messages per conversation), we store that message content only temporarily, for as long as needed to deliver it, and delete it when the conversation closes (after 7 messages or a period of inactivity). Crossing/proximity information is kept for as long as your account remains active, so the feature can work as intended.
• Safety Data. If you block or report another user, we store that information to enforce blocks and review reports.
• Analytics. We use an analytics provider (PostHog) to understand how the app is used — which screens are opened and how long you spend on them. Session replay (recordings of on-screen taps and navigation) is a feature PostHog offers but is not currently enabled in the app; if we enable it in the future, any text you type (such as messages or your username) will be masked and not visible in those recordings.
• Crash and Error Reporting. We use Sentry to automatically collect crash reports and error logs (such as device type, OS version, and the app state when an error occurred) so we can find and fix bugs. This data is used only for debugging and is not used to advertise to you or build a profile of you.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts.
• To deliver and facilitate delivery of services to the user, including detecting nearby Echo users and delivering proximity notifications.
• To enable user-to-user communications.
• To respond to user inquiries/offer support to users.
• To send administrative information to you.
• To protect our Services, including fraud monitoring and prevention, and to act on blocks and reports submitted by users.
• To evaluate and improve our Services, products, marketing, and your experience.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• With other Echo users, by design. Echo's core feature shares limited signals (such as the fact that you are nearby, your age range, and messages you choose to send) with other Echo users you cross paths with. We do not share your exact identity, email, or precise coordinates with other users beyond what the in-app experience requires.
• Service providers. We share information with vendors who help us run the Services on our behalf and under contract: our database and backend provider (Supabase), our analytics provider (PostHog), and our crash/error reporting provider (Sentry). These providers only process data to help us operate, secure, and improve Echo — not for their own marketing purposes.

4. HOW LONG DO WE KEEP YOUR INFORMATION?

We keep your personal information for as long as you have an active Echo account, so that we can provide the Services. When you delete your account (see Section 11 below), we delete your personal information, including your geolocation history, messages, crossings, and device data, immediately and permanently — we do not retain it for any additional period afterward.

5. HOW DO WE KEEP YOUR INFORMATION SAFE?

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process, including encrypting data in transit. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. You should only access the Services within a secure environment.

6. DO WE COLLECT INFORMATION FROM MINORS?

We do not knowingly collect, solicit data from, or market to children under 18 years of age. By using the Services, you represent that you are at least 18. If you become aware of any data we may have collected from children under age 18, please contact us at info@echoapp.it.

7. WHAT ARE YOUR PRIVACY RIGHTS?

You may review, change, or delete your account and personal information at any time — see Section 11 for the exact steps.

If you have questions or comments about your privacy rights, you may email us at info@echoapp.it.

8. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. We do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

9. DO WE MAKE UPDATES TO THIS NOTICE?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top of this Privacy Notice. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

10. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at info@echoapp.it.

Fabiana Marselli (doing business as ECHO)
Rome, Italy

11. ACCOUNT AND DATA DELETION

You are always in control of your Echo account and data. You can request full deletion of your account and all associated data at any time, directly inside the app — you do not need to contact us to do this.

How to delete your Echo account

What gets deleted

Deletion is immediate and permanent. We delete, without any additional retention period:

• Your profile (email, username, password, age range)
• Your geolocation and presence data
• Your registered device and push notification token
• Your messages, crossings, and proximity history with other users
• Your blocks, reports, shared connections, and invites
• Your authentication account

No Echo personal data is retained after account deletion. If you are unable to access the app, you may also request deletion by emailing info@echoapp.it from the email address associated with your account; we will process the request within a reasonable time.

12. HOW CAN YOU REVIEW OR UPDATE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you or correct inaccuracies. You can request a copy of your data directly inside the app, without deleting anything: go to Impostazioni (Settings) and tap Richiedi una copia dei tuoi dati (Request a copy of your data). You can also make such a request by contacting us at info@echoapp.it.