Updated 2026-10-01Draft for the Crowd Echo preview. Legal operator details and the final policies must be confirmed before launch.
Contact Crowd Echo
For privacy requests or support, contact Karim at karim@crowdecho.app or Tameem at tameem@crowdecho.app. You can also use Support in the app. The legal operator name and contact address are still being confirmed for public launch.
Information we collect
We collect user data to run Crowd Echo: your phone number, profile and age details, chosen city and interests, mission reservations, verified attendance, feedback, reward balances, redemption details and support messages. Business accounts provide a business name, country, email and login credentials. Optional profile questions can be skipped.
Location, photos and notifications
With your device permission, foreground location helps find missions and verify attendance. You can decline location for browsing. Camera or photo access is requested when you choose to scan or upload evidence. We process only the photos you submit. Story screenshots may include your Instagram username and business tags. If identity verification is enabled, ID and selfie images are reviewed privately. Push tokens deliver account and mission notifications; you can turn notifications off in Settings.
Why we use this information
We use information needed to provide your account, reservations, attendance checks and rewards, meet applicable legal duties, and protect the service against fraud and abuse. Optional usage analytics is off unless you enable it; you can withdraw that choice in Settings. Permission to use a device feature is separate from agreeing to the Terms.
Who receives data
Crowd Echo staff access information needed for support, verification and reward fulfilment. Organisers see the attendance and feedback information needed to run their own missions; they do not receive private ID images or story screenshots. Service providers may process data on our behalf: Twilio for configured SMS delivery, Resend for configured email delivery, Expo and Apple/Google for push notifications, hosting/storage providers, the payout or gift-card provider you choose, and DeepSeek for AI summaries of post-mission written feedback. We do not send member account identifiers, profile or payment fields to DeepSeek. Feedback may still contain personal information you type, so please avoid including names or contact details. A provider being supported does not mean it is enabled. The production provider list, processing locations and transfer safeguards must be confirmed before launch.
Venue offers and referrals
When you choose to share a mission invitation, we connect its claims and venue-confirmed redemptions to your account to calculate referral rewards. Friends verify their phone and save a voucher. The venue sees a friend's first name, offer and redemption status when staff check the code shown by that friend; public invitation pages do not show member identities. We use phone and device checks to prevent duplicate claims and self-referrals. Deleting an account removes its member links from voucher records. Pseudonymous anti-abuse markers expire 42 days after the mission ends and are cleared during subsequent claim processing.
AI and automated decisions
The current member flow does not send your uploaded story or identity photos to a generative AI service. Staff review evidence; software applies reservation, eligibility, fraud and reward rules. If AI processing of personal data is introduced, this notice and any required choice will be updated first. You can ask for a human review of a disputed decision through Support.
Storage and retention
Private pilot uploads are encrypted and access-controlled. Replacing a screenshot removes the old file. Reviewed story screenshots are removed after the review is saved, while the decision and reward record remain. You can remove a submitted screenshot from its mission page or delete your member account in Profile. Account deletion removes active profile and evidence data and cancels reservations. Details needed to finish an already-requested payout are retained until fulfilment. Unreviewed evidence remains until review, removal or account deletion. Backup retention, business-account retention and any required financial retention periods must be finalised before launch.
Your choices and rights
Use Profile to correct your details, Settings to manage permissions and analytics, and Profile → Delete account to request permanent member deletion. Support can help with access, correction, portability, objections, restrictions or a disputed decision, as applicable to your location. You may complain to your local data protection authority, including the UK ICO. If you cannot sign in, email karim@crowdecho.app or tameem@crowdecho.app.
Adults only
Crowd Echo is for adults aged 18 or over. Some missions require you to be 21 or over. We do not offer a children's account or seek parental consent as a substitute for meeting these age limits.