Privacy policy

Last updated: 12 October 2026. This covers the Echobound game (Android and Windows) and this website.

Who we are

Echobound is made by a small independent team. Contact for anything in this policy: support@echobound.app.

What stays on your device

Your profile (name you choose, rank, unlocks, gems, cosmetics, season pass), your saved run and your settings are stored only on your device. We cannot see them.

What goes to our server, and why

• A game account. The game creates an account bound to a random install id. It has no email, phone number or real name. Purpose: online play.
• Your Echoes and runs. The boards you build in a run (champions, items, rank) are stored as "Echoes" and shown to other players as opponents. Run records are checked by our server so nobody can upload impossible boards. Purpose: the core game.
• Play stats (only with your OK). Fights, picks, run progress, crashes and when the game is open. Purpose: balancing and fixing the game. You can switch this off in Profile at any time; tester builds have it on by default and ask you on first start.
• Feedback you send. Your note, a screenshot of the game at that moment and your tester nickname. Only when you press Send.
• Google sign-in (optional). If you link a Google account, we keep only Google's account number for it, so you can get your game account back on another device. We delete the email, name and photo Google sends.
• Google Play Games (optional, Android, when available). Play Games "Recall" lets the game find your account again after a reinstall. Google gives us an anonymous link token, never your Google profile.
• Technical data. Your IP address is used to connect and to limit abuse. It is not stored in our database; it may appear in server logs, which have a small fixed size and are overwritten.

Legal bases (GDPR): the game account, Echoes, runs and Google/Play Games links are needed to provide the online game you ask for (contract); play stats are based on your consent; abuse limits and technical logs on our legitimate interest in keeping the service safe.

Who processes it for us

• DigitalOcean hosts our server in Frankfurt, Germany (EU).
• Anthropic (Claude): we use Claude to help read play stats and tester feedback (summaries). Only the text we send it, never Google data or install ids.
• Google: when you use Google sign-in or Play Games.
• Cloudflare runs the DNS for echobound.app and forwards email to us.

Some of these companies are based in the USA; transfers use the EU's standard safeguards. We do not sell your data and we do not use it for advertising. Personalised ads are off; if a build shows ads, the ad provider will be named here before they start.

How long we keep it

• Play stats, run records for review and feedback: 180 days, then deleted automatically.
• Your game account, Echoes and links: until you delete them.
• Database backups: one per day, the last 7 kept, plus an offline copy on our own computer that is replaced the same way.

Delete my data

In the game: Profile › Help & privacy › Delete all your data. This erases your profile, saved run and settings on the device and your account, Echoes, play stats, feedback and Google / Play Games links on our server. Backups age out within 7 days. You can also email us to ask for a copy, a correction or deletion of your data, and you may complain to your data protection authority.

Children

Echobound is for players 16 and older. The game asks your age first and cannot be played by younger players. If you believe a child under 16 has sent us data, write to us and we will delete it.

Changes

We will update this page when the game changes what it collects, and change the date at the top.