EchoFloat Privacy Policy

Version 1.15, effective 26 October 2026. What changed from 1.14: the server's official account no longer sends letters — not about sign-ins to your account, not with the server's news, not about promo codes. A sign-in notice goes only to your other devices that are online at that moment; news and promo codes wait in its dialog. So the mail server's log is gone from "The server's official account", "How long it is kept" and "Who has access": the address and time of such letters are no longer left anywhere.

Version 1.14, effective 25 October 2026. What changed from 1.13: the server's official account, which writes to everyone — news from the people who run the server, and notices about sign-ins to your account. A sign-in notice goes to your other devices that are online at that moment, and when none is, or you are in Do Not Disturb, it comes by e-mail to your confirmed address; so does the server's news when you are not in the app. A notice is not stored on the server; a letter passes through a mail server whose log keeps the address and the time for a few days. The new section "The server's official account" has the details; "How long it is kept" and "Who has access" now mention it too.

Version 1.13, effective 25 October 2026. What changed from 1.12, two things. The policy now says how auto-deleted messages start counting: the clock of such a message starts when someone other than its author first reads it, and everyone in the chat is told when the message will go — which says when that first reading happened and, in a small group, who it was, also when the reader was Invisible. The app has always worked this way; "Messages and attachments", "Status: who is at the keyboard" and "Who has access" now say so. And the server no longer keeps the time of what you do for yourself alone: hiding a message, deleting a chat for yourself, declining a friend request, blocking someone, starting a sticker pack.

Version 1.12, effective 23 October 2026. What changed from 1.11: Floats, the app's own currency: not money — they cannot be bought for money or exchanged for it. The server keeps your balance and the history of its movements, which you see in full; quests count acts with friends, not time online, and are kept as one overwritten row per person. The details are in the new "Floats" subsection; "How long it is kept" now speaks of Floats too.

Version 1.11, effective 22 October 2026. What changed from 1.10: channels. A channel is a room where only the channel itself writes, and comments can be left under its posts. Anyone signed in can find and read an open channel; only a channel's staff see its subscribers and who published a post. You can delete your own comment in a channel within four hours; after that only the channel's moderators can. The details are in the new subsection "Channels"; "Status: who is at the keyboard", "Usage statistics", "How long it is kept", "Who has access" and "Your choices, and what you can actually do today" now speak of channels too.

Version 1.10, effective 20 October 2026. What changed from 1.9: photo history. When you put on a new profile or group photo, the previous one is no longer deleted: it stays in the history together with the date it was put on, and the people who see the current photo see it too. "Delete" removes the current photo for good, and the previous one shows again. The details are in the new "Profile and group photos" subsection.

Version 1.9, effective 18 October 2026. What changed from 1.8: a camera in a call. In the Windows app you can switch your camera on in a call. Its video is end-to-end encrypted the way voice is, and the server does not record it; the call's participants see that your camera is on, and the server does not keep that. The details are in the new "Camera" subsection.

Version 1.8, effective 18 October 2026. What changed from 1.7: the game you are playing. If "Show what I'm playing" is on in the Windows app (it is on by default), your friends see the name of the game that is running and how long you have been playing it — while you are online and not Invisible. The server does not keep it: the name lives only in the running server's memory, while the app is connected. The details are in the new "The game you are playing" subsection.

Version 1.7, effective 10 October 2026. What changed from 1.6: rating a call. When a call ends, the app and the web version ask how it went and offer two answers, "bad" and "good". If you answer, the server keeps the rating together with that call's connection figures; if you close the window, nothing is sent. The details are in the new "Rating a call" subsection.

Version 1.6, effective 10 October 2026. What changed from 1.5: the list of sessions. Settings now have a "Sessions" section: which devices are signed in to your account, when each was last online, and a button that ends any of those sign-ins. For that the server now keeps, for each sign-in, the device's name and its system as the app reported them, the app's version, and one "last seen" timestamp for that device. Only you see it; the details are in the new "Sessions" subsection.

Version 1.5, effective 5 October 2026. What changed from 1.4: usage statistics. The server now counts, by itself and in its own database, how many people and groups use EchoFloat and whether they come back — with no third-party service and no outside SDK in the app. The "Usage counters" section has become "Usage statistics": it says exactly what is recorded, how long it lives and how to turn it off. The app's technical reports no longer keep the account id, and call-quality numbers reach the server's metrics without being tied to a person. The policy also now speaks plainly about read receipts — the author of a message sees when you read it — about feedback on the app, and about the server's logs.

Version 1.4, effective 27 September 2026. What changed from 1.3: pets — EchoFloat's bots. A pet is an account a program drives; it reads what you send it, and only that. The new "Pets" section says exactly what a pet receives, who runs pets, and how to stop one; "Who has access" and "How long it is kept" name them too.

Version 1.3, effective 17 September 2026. What changed from 1.2 is in the same "Status" section: there is a sixth status, "In a call". It is computed, cannot be set by hand, and does not say which channel the call is in. Who can see your status has not changed, and no new data is stored. Version 1.2 (17 August 2026) narrowed that circle to your friends only — sharing a channel no longer grants it; version 1.1 (also 17 August 2026) had narrowed it from the whole server to "friends and people you share a channel with", and added one new stored value, "last seen".

EchoFloat is a small messenger: text channels with attachments, and group voice calls inside a channel. This policy describes what the app and the server actually do — what data comes into being, why it is needed, how long it lives and who can see it. It covers the server at echo.godrink.beer and the EchoFloat desktop client for Windows. If you use somebody else's EchoFloat server, the data on it is the responsibility of whoever runs it, not ours.

The project is private and non-commercial. We do not sell data, show advertising, or embed third-party analytics — the server keeps its own usage statistics (see "Usage statistics") — and we pass nothing to third parties other than the hosting provider whose machine the server runs on, and the mail server that hosts the security@godrink.beer mailbox: letters with confirmation codes — your address and the code — pass through it (see "Your account"). A pet — a bot, below — receives what you send it; on this server every pet is run by the server's operator, and each pet's card names its owner.

The important part: what is encrypted and what is not

This is the sharpest distinction in the product, and we would rather state it plainly than bury it.

If that is not acceptable to you, do not write things in chat that you are not willing to trust the server owner with. A voice conversation is protected more strongly in that sense.

What data comes into being

Your account

When you register we store the username, the email address, a hash of the password (argon2id — we do not have the password itself), the creation date and an administrator flag. The address is a second unique handle and a way to reach you, not a login factor: you sign in with your username and password. The server sends it mail of one kind only — a six-digit code to type into the app: to confirm the address when you register (the account is created only after that), to set a new password in place of a forgotten one, to confirm the address of an account whose address is not confirmed yet, and to change the address (a code goes to the old address first, then to the new one). A code is good for five minutes; a letter carries no links and nothing you typed, not even your name. Letters are sent from security@godrink.beer through the mail server that hosts that mailbox. Codes and unfinished registrations live only in the server's memory; once an address is confirmed, the time of confirmation is stored. There are no mailings at all. The username and the address are unique case-insensitively. Registration is rate-limited per IP address per hour.

Your username and numeric id are visible to anyone signed in — there is no other way to put a name on a message in the feed. Your email address is not shown to other users.

Profile and group photos

A profile photo is visible to anyone signed in, a group's photo to the group's members. When you put on a new photo, the previous one is not deleted: it stays in the history together with the date it was put on, and the same people who see the current photo see it — in the Windows app the history opens when the photo is pressed. The history keeps at most 100 photos; past that, the oldest one is deleted. "Delete" in the photo's menu (in the web version, the bin beside the photo) deletes the current photo for good, from the history too, and the previous one shows again; there is no photo once the history is empty. A group's photos are put on and deleted by its administrators, and deleting the group deletes all of them. Photos put on before 20 October 2026 are kept without a date.

Status: who is at the keyboard

While the app is running and connected, other people can see your status: Online, AFK (the computer has not been touched for over five minutes), In a call, Do Not Disturb, or Offline. What counts is activity on the whole computer, not just our window — if you are typing in another program, you are at your desk.

"In a call" is computed, cannot be set by hand, and does not say *where* the call is. We relay the status alone: the message carrying it has no field for a channel, so somebody who cannot see that room learns nothing about it. The name appears only for a reader who can already see the channel — their app takes it from the call's participant list, which it was sent on the ordinary terms. Do Not Disturb and Invisible outrank it: you chose those yourself, and joining a call does not retract them — invisible stays invisible.

"Other people" means your friends. To everybody else you are indistinguishable from offline: not a single message about you reaches them, and the list their app receives simply has no row for you — the same nothing a person who really is offline produces.

Sharing a channel does not grant it, and that is what changed in version 1.2. Groups are private from the moment they are made, and in a channel subscribers do not see each other (see "Channels"). But a group is joined by an invite link its owner or an admin makes, and a link can be passed to anyone. So "we share a channel" is something another person can bring about on their own, without your agreement, while a friendship takes two people agreeing — and watching when you are at your computer is a right of that second kind. A channel's member list therefore carries no status dots at all.

There is no presence log. Who is connected and who has stepped away lives only in the memory of the running server and disappears with it. It is impossible to reconstruct from our data when you sat down at your computer and when you left, because no such data exists: connections, app launches and absences are written down nowhere — all that remains is the "last seen" timestamps, one for you and one for each device, each written over the one before it (see below and "Sessions"). What is written down is actions other people see anyway: when you read a message (see "Messages and attachments") and that you did something on a given day, without the time of day (see "Usage statistics"). The nearest thing to a history is the minutes in which you read your chats: they tell when you read a given chat, not when you were online.

Of your status, exactly two things are stored. The first is the choice you made yourself: Do Not Disturb or Invisible. It sits on your account so that it survives a restart and reaches your second device.

The second is "last seen": one timestamp, accurate to the minute, written over the previous one. It can say when you were last here, and it cannot say when you were here before that — no history accumulates, because there is nowhere for it to accumulate. Only your friends see it, and only while you are away: while you are online there is already a dot beside your face saying so.

While you are Invisible that timestamp does not move. Otherwise invisibility would leak out through the back door — the dot saying offline while the clock underneath it kept running.

Each of your sessions keeps the same kind of timestamp, one per device, by the same rules; only you see it (see "Sessions").

Invisible means that to everybody else you are simply offline — no dot, and no "typing" indicator. There are four exceptions, and it is fairer to say them in advance: a server administrator can see the choice you made, in the same way they can see your email address; being in a call is visible to everyone in that call — if you join a conversation, you are seen in it; the author of a message you read sees that you read it, and when; and if you are the first to read an auto-deleted message, everyone in its chat can tell when you did (both in "Messages and attachments").

The game you are playing

The Windows app can show your friends what you are playing, the way Discord does. To do that it looks, every 15 seconds, at which programs are running on the computer: each one's path and the time it started. It counts as a game what Steam, Epic Games, GOG, Ubisoft Connect, the EA app, Xbox or Riot installed, a few well-known games outside those stores, and the programs you added yourself. It does not read other programs' memory. It looks at window titles only to recognise Minecraft, and while the "Add a game…" list in settings is open — for that list.

Only the game's name and how long it has been running go to the server — and only while "Show what I'm playing" is on (Settings → Games; on by default). A program's path and the list of the other programs running go nowhere.

The people who see it are the people who see your status — your friends only, and only while you are online: while you are Invisible nobody does. Any game can be hidden with "Don't show".

It is not written down. The name lives in the running server's memory while the app that reported it is connected, and for ten seconds after, so that a short drop in the connection does not flicker on your friends' screens. It is in no database, log or statistics; neither the server nor your computer keeps a history of what you played and when.

Sessions

Every sign-in to your account is a session, and the server remembers it while it lasts: that is what lets a sign-in be ended — on this device with "Sign out", and any other one from the settings. For a session the server keeps the device's name and its system as the app reported them when signing in (for a computer, its Windows name, such as "SERGEY-PC", and "Windows 11"; for a browser, its name and system, such as "Edge 141" and "Windows"), the app's version, and that device's "last seen": one timestamp, accurate to the minute, written over the previous one when the device connects to the server or disconnects from it. Like your own timestamp (see "Status"), it does not move while you are Invisible, and it accumulates no history. Whether a device is connected right now the server knows only in memory. A session's record holds neither an IP address nor the place a sign-in came from.

Only you see any of this — in the settings, under "Sessions"; that is also where any session, or all but the current one, can be ended. A session without "Remember me" ends by itself after a day, and its record is deleted within an hour after that; a session with it ends when you sign out on that device, end it from another, or change your password.

Messages and attachments

A message is stored with its channel, sequence number, sender, time sent, text, formatting, list of attachments and the time of any edit or deletion. Separately we store how far each user has read each channel, and — to the minute — when that mark moved.

Read receipts. From those minutes the author of a message sees which of the others have read it and when ("Details" in the menu of your own message) — also when the reader was Invisible. The minutes are kept for as long as the chat exists. This is the one history of its kind the server keeps indefinitely: it shows in which minutes you read a given chat.

Auto-deleted messages. A message can be sent with a lifetime, from five seconds to a day. Its clock starts when someone other than its author first reads it, and from then on every copy counts down to the same moment, which the server sends to everyone in the chat and keeps with the message. That moment, minus the lifetime, is when the message was first read, to the millisecond — also when the reader was Invisible; in a group of three, or wherever it is clear who else could have read it, it also says who that was.

Attachments are files on the server's disk, with their size, type, image dimensions, checksum and a reference count. Quotas apply: a daily upload allowance per user and a total storage ceiling.

Photos and video are re-encoded on your computer before they are sent (WebP and AV1/H.264). Re-encoding rebuilds the file, so the original's metadata — camera model, GPS coordinates — never reaches the server. Voice messages are encoded to Opus, also on your device.

Channels

A channel is a room where only the channel itself writes: its posts come out in the channel's name, with its name and photo. They are published by the channel's staff — its owner and the people the owner has given rights to. A channel is either open — anyone signed in can find it in search, read it and subscribe — or closed, by invitation only. An open channel can have a public name, @name, by which it is found and opened; such a name can never be the same as a user's name.

If someone answers your comment or mentions you in one, you get a notification, as in any chat.

Voice

The server sees the call's metadata: who is in it and when, the participant's IP address and port, the volume and rate of traffic, and audio levels (they decide who is currently forwarded as an active speaker). It does not see the contents.

Connection-quality numbers — loss, latency, jitter, an estimate of intelligibility — are, during a call, relayed to the other participants of the same call: the people in the room can see your ping. They reach the server's metrics without your user id — only as summary numbers over everybody in a call right now: the median, the edge of the worst ten per cent, and the worst value. Those metrics are kept for up to 30 days; they are closed to the outside.

Beyond that, the server counts calls anonymously: how many started, how many minutes they ran, how many connections failed and why, which range the latency fell in. And the "what you did that day" statistics note that you were in a call that day and whether your voice connection came up. Both are described in the next section.

Camera

Only you switch your camera on, and only in a call — it is off every time you join one. While it is on, the call's participants see your video, and the list of participants shows that your camera is on; the web version does not show the video, only that mark. The video is encrypted on your computer under the same call's keys as voice (MLS and SFrame), and the server cannot decrypt it; what it sees of it is what it sees of voice — the volume and rate of the packets it forwards the frames in.

That your camera is on, the server holds only in memory while the call lasts — to tell whoever joins later — and writes neither to its database nor to its logs. Any participant can "turn off for me" anybody else's camera: only they see that, on their own screen, and the camera's owner is not told. The camera preview in settings is sent nowhere — it is drawn on your computer.

There are no usage statistics about the camera. The app's technical reports (see below) receive only anonymous numbers about how it works — how many frames were sent and received, how many were lost — with no account, like everything else in those reports.

Usage statistics

To know whether EchoFloat is useful to people, the server keeps statistics — by itself, in its own database. There is no third-party analytics service, and no outside SDK in the app. No part of these statistics holds message text, audio, chat names, files or search queries, and nothing in them is derived from IP addresses — no country, no provider. There are three parts, and one switch for them (described at the end of this section).

What you did that day. If on a given day you did something other people can see, the server writes one row about it: your account, the date (Moscow time), and which of five actions there were — wrote a message, reacted, joined a call, started a stream, read somebody else's message. A few attributes go with them: whether you sent an attachment, a spoiler or a forwarded message, whether you wrote a command to a pet, whether you did something from the web version (the app and the web version name themselves and their version to the server in every request), and whether your voice connection came up in a call. For groups and direct conversations the server likewise records who did something in that chat that day, and what. Channels and comments get no such row: they record only that you did something that day, and how many channels, posts and comments were made in a day the server counts anonymously. These rows have no time of day — only the date.

These rows live for 10 days. Every night numbers without account or chat ids are computed from them — how many people were active that day and that week, how many groups are alive, how many people come back a day, a week and a month after registering — and those numbers are kept indefinitely. We are few, and a small number can on its own point at a person; only the server's owner sees these numbers. So that the statistics would not start from zero, at launch they were computed backwards once, from 29 August 2026, out of what the server already held: messages, reactions, calls and read receipts.

What is never here: the content of messages and calls, a history of status or presence, the times you connected or launched the app. Search does not reach these rows at all — it is counted only as the day's total number of searches, without who searched. Pets are not counted.

Anonymous event counters. Separately the server counts events, not people: how many messages and reactions were sent that day, how many attachments of each kind, how many searches there were, how many calls and streams started and how many minutes they ran, how many call connections failed and for what reason, which range the connection latency fell in, how many times the app was started and how many times it crashed — by version. These numbers are tied to nobody and are kept indefinitely.

The app's technical reports (telemetry). Once a minute the desktop app and the server components pack counters into a report: the source (client, gateway, SFU), the build version, a short platform string (win11, linux), a random per-process run id, a window number, and a set of "metric name → whole number" pairs — how many times something started, how many network errors there were, how many milliseconds joining a call took. A report carries no account id: the app does not put one in, and the server strikes one out if it arrives. The server knows which account a report came from only while receiving it — to limit the rate and to honour your switch — and does not write it down. The reports of one run are tied together only by that run's random id. From the reports the server takes the number of launches, crashes and failed call connections into the anonymous counters above.

What a report cannot contain, by construction: message text, audio, file names, channel names, IP addresses, or free-form strings of any kind — metric names are restricted to a small character set and values are integers.

Reports are written into daily files on the server and deleted after 14 days. Reports written before 5 October 2026 still carry the account id and are deleted on the same schedule.

The switch. "Send usage statistics" — in the desktop app under Settings → Privacy, in the web version on your own profile card. It is stored on your account and applies to all your devices at once. Turning it off stops the "what you did that day" rows about you and deletes the ones already kept — about you, and about you in groups and direct conversations. From then on the server discards the app's technical reports from your account. You cannot be subtracted from numbers computed earlier: they hold neither you nor your ids, only totals. The switch does not touch the anonymous event counters: there is nothing about you in them.

Only the switch on the server counts. In versions of the app before this policy the switch ("Send anonymous stats") lived only on your computer: it stopped the technical reports from being sent, and the server never knew about it. Such a version is counted in the "what you did that day" statistics until it updates; after the update the app passes a switched-off switch to the server once, and from then on that is the one in force.

Floats

Floats are the app's own currency. They are not money: they cannot be bought for money or exchanged for it. They come from a promo code issued by a server administrator, from the launch gift and from quests, and are spent on features inside the app — HD+ for streams, say, or one more slot for your own stickers.

The server keeps your balance and every movement of it: the amount, the time, what it was (a code, a quest, a purchase, a gift to or from a friend, an administrator's correction with its reason) and, for a gift, who gave it to whom. You see this history yourself — in full, for as long as the account exists — and so do the server's administrators, who issue codes and correct balances; nobody else sees your balance. The text of a promo code is not kept on the server, only its fingerprint; a code an administrator sent to you personally is bound to your account and works for you alone.

Quests count acts with friends — a message, a reaction to a friend's message, minutes in a call together with a friend or watching their stream — not time online. For quests the server keeps one row per person: the counts for today and for this week, the reward accrued, the streak of days and the achievements earned. The row is overwritten: there is no quest history, and it cannot tell when, or with whom exactly, you were in a call. The counting cannot be switched off — it runs the same way for everyone and makes no record of who was online when. The server's overall counters — how many Floats were issued and spent — hold nobody's identifiers.

Feedback about the app

"Send feedback" (under Settings → About) sends the server what you wrote — that part is optional — and a report on the session: the app version, the audio settings, the whole of the current call and screen share — the people in it included — and the app's and the core's logs, which contain channel and user ids. The call's encryption verification code is never in the report. Feedback is signed with your account and username, goes only when you press the button, and is kept on the server for 90 days.

Rating a call

When a call ends for you and somebody else was in it, the app and the web version ask how it went: "bad" or "good". The answer reaches the server only when you press one; closing the window sends nothing.

The server adds to the rating that call's connection figures, which the app already sends it during the call — delay, loss, jitter, the share of sound that had to be reconstructed and the estimate of how clear it was, averages and worst values. Until a rating arrives they are only in the server's memory, and without one they are forgotten half an hour after the call.

A rating goes to three places:

A rating is signed with your account even if usage statistics are switched off: it is a message you send yourself, like feedback about the app. The random run id of the technical reports does not go with it, so a rating does not tie those reports to an account.

Network and technical data

The server sees the IP address you connect from — without it there is no connection. The reverse proxy keeps an access log in its own container log. The logs of the server programs are collected into a log store on the same server and kept there for 14 days; their lines can contain account and chat ids. Docker also keeps its own copy of each container's output until the container is recreated. The voice relay holds per-address counters in memory to defend against flooding.

What stays on your computer

All of it goes away with the application and the %APPDATA%\Echo folder.

Pets (bots)

A pet is EchoFloat's bot: an account a program drives instead of a person — it rolls dice, answers questions, reminds. Its card carries a paw mark, a description, the commands it knows, and its owner: whoever made it and answers for it. On this server only the server administrator can make a pet, so every pet here is run by the server's operator.

What a pet receives — and nothing else:

A pet never receives reactions, read marks, typing, statuses or calls, and it cannot download files: it is told a file was attached, and no more. It cannot write to you first — only in a dialog you started, and in groups whose own administrators added it.

A command is an ordinary message. Everybody in the chat sees it, and it is stored like any other. The server looks at a message's first word to know which pet a command is for — the one case in which it reads a message's text at all.

Stop. In your dialog with a pet, «Stop» cuts it off: nothing you write reaches it, and it can no longer write to you there. «Restart» — which sends the message /restart — lets it talk to you again. Stop is about your dialog only: a command you type in a group the pet is in still reaches it, because who is in a group is for its administrators to decide.

What happens to what it is sent. It waits for the pet's program in a queue on the server — at most a day — and is deleted as soon as the program has taken it. What the program keeps after that is its owner's responsibility; on this server the owner is the server's operator. When the pet's dialog is open, the program taking a message is also what marks it read.

The server's official account

The server has an account of its own — the official one, with an "Official account" mark in place of a pet's paw. The server itself runs it, not a program somewhere else, and it speaks for the people who run the server. Everyone has a dialog with it from registration on. It cannot be blocked, stopped or muted, and it cannot be answered: in its dialog there is a "Send feedback" button where the message box would be.

What it sends:

In the app only, no letters. The official account sends no e-mail. When no other device of yours is online at a sign-in, the notice goes nowhere — the sign-in itself is on your sessions list (Settings → Account → Sessions). The server's news and the promo-code lines wait in the dialog. In Do Not Disturb the app still gets the notice and shows it without a sound.

Why each of these exists

How long it is kept

Backups are not configured on the server. That means both that there are no copies of your data anywhere, and that a disk failure would lose it.

Who has access

No automated system reads message contents to judge them or to learn from them — no moderation classifier, no model training. The one program that reads a message is a pet it was sent to, and only the messages sent to it.

Your choices, and what you can actually do today

Children

EchoFloat is not intended for children under 13. We ask you to confirm your age when you register. We collect no other information about age, and we have no way to verify it.

Changes

If this policy changes, the version and date at the top of the page change with it, and the page stays at the same address. Significant changes will also be announced in a channel everyone can read.

Contact

Privacy questions, account deletion, content reports: support@godrink.beer.