Updated 2026-10-03These policies describe the current Crowd Echo service. Contact us if you have a question or want to exercise a privacy right.
Contact Crowd Echo
Crowd Echo's named operators are Karim Nashaat and Tameem Hamedi. Contact address: 13 Webster Court, Newton, Massachusetts 02459, United States. For privacy requests or support, contact Karim at karim@crowdecho.app or Tameem at tameem@crowdecho.app. You can also use Support in the app.
Information we collect
We collect user data to run Crowd Echo: your phone number, profile and age details, chosen city and interests, mission reservations, verified attendance, feedback, reward balances, redemption details and support messages. Business accounts provide a business name, country, email and login credentials. Optional profile questions can be skipped.
Location, photos and notifications
With your device permission, location helps find missions and verify attendance. During a checked-in mission using location verification, precise location is also processed in the background to verify time inside the venue area and send a return reminder when you clearly leave. Tracking stops at checkout or the event’s end. We retain aggregate attendance duration and verification state, not a route history. QR scanning and precise location are required to verify attendance and earn mission rewards. Declining access prevents check-in; you can still browse missions and access your account and wallet. Camera or photo access is requested when you choose to scan or upload evidence. We process only the photos you submit. Story screenshots may include your Instagram username and business tags. If identity verification is enabled, ID and selfie images are reviewed privately. Push tokens deliver account and mission notifications; you can turn notifications off in Settings without losing reward eligibility.
Why we use this information
We use information to provide your account, reservations, attendance checks and rewards, meet applicable legal duties, and protect the service against fraud and abuse. Where UK data-protection law applies, our grounds are providing the service you request, our legitimate interests in operating and securing the service, applicable legal obligations, and consent for optional analytics and promotional notifications. Optional usage analytics is off unless you enable it; you can withdraw that choice in Settings. When you allow notifications, your chosen city, eligibility, existing reservations and push registration help us send relevant nearby-event offers. You can turn push notifications off in Settings without losing reward eligibility. We do not sell personal information or combine it with other companies' data for cross-app advertising tracking. Permission to use a device feature is separate from agreeing to the Terms.
Who receives data
Crowd Echo staff access information needed for support, verification and reward fulfilment. Organisers see the attendance and feedback information needed to run their own missions; they do not receive private ID images or story screenshots. We host the application database and private uploads with DigitalOcean in New York, United States. We use Twilio Verify to send and check phone login codes, Resend for service emails, and Expo with Apple or Google to deliver notifications. They receive the information needed for their function, such as your phone number, email address and email content, or push token and notification content. When you request a withdrawal or gift card, authorised staff use your selected destination and the information needed to fulfil it with that provider. External AI feedback summaries are paused. Written questionnaire answers are stored in Crowd Echo’s application database and are not sent to DeepSeek in this release. Feedback may contain personal information you type, so please avoid including names or contact details. These services may process information in the United States and other countries used by their providers. Their data-protection terms describe confidentiality, security, subprocessors and international-transfer safeguards, including contractual safeguards where required. Contact us for information about a transfer affecting your data.
Venue offers and referrals
When you choose to share a mission invitation, we connect its claims and venue-confirmed redemptions to your account to calculate referral rewards. Friends verify their phone and save a voucher. The venue sees a friend's first name, offer and redemption status when staff check the code shown by that friend; public invitation pages do not show member identities. We use phone and device checks to prevent duplicate claims and self-referrals. Deleting an account removes its member links from voucher records. Pseudonymous anti-abuse markers expire 42 days after the mission ends and are cleared during subsequent claim processing.
Reports and personal blocks
You can report a mission's safety, accuracy or content from its details page. Crowd Echo admins receive the report and any details you submit to investigate it and record a resolution. Avoid including unnecessary personal information. You can also block an organiser from future discovery in your app and manage those blocks from You → Account & help → Blocked organisers. Blocking does not cancel existing reservations or remove earned rewards. Account deletion removes your reports and block preferences from active records.
AI and automated decisions
The current member flow does not send written feedback or uploaded story or identity photos to a generative AI service. Earlier versions offered optional DeepSeek feedback summaries with explicit permission. Pausing summaries does not undo previously consented processing. Feedback does not decide eligibility or rewards. Staff review evidence; software applies reservation, eligibility, fraud and reward rules. You can ask for a human review of a disputed decision through Support.
Storage and retention
Private uploads are encrypted and access-controlled. We retain member account, mission, questionnaire and support information while needed to provide your account and resolve requests. You can delete your member account in the app. Deletion removes active profile, feedback, evidence and member-linked records and cancels reservations. Anonymised attendance and reward totals remain. If you have already requested a payout, its destination details remain in restricted encrypted storage until fulfilment, then are removed. Story screenshots are removed after review, replacement, member removal or account deletion; unreviewed screenshots remain until one of those actions occurs.
Recovery copies and provider records
Deletion from active records does not immediately erase historical backups. Routine recovery archives are normally retained for about eight days, with older archives removed after a successful backup. Separate maintenance and release recovery copies do not expire automatically. We review their recovery need when a release or recovery is completed and when handling relevant deletion requests, and remove them when that need ends. Access is restricted. Before restoring a backup, we reconcile subsequent deletion requests. Communications and payment providers retain their own delivery, verification, security or transaction records under their service terms and applicable obligations. Their retention can differ from ours; deleting your Crowd Echo account does not instantly erase those records. Contact us for help with applicable provider deletion rights.
Business accounts and necessary records
Business accounts are managed separately from member accounts. Contact karim@crowdecho.app or tameem@crowdecho.app to request business-account closure or removal of business contact information. We verify your authority, assess outstanding events, payments, disputes and applicable recordkeeping duties, remove information no longer needed, and explain any information that must remain and why. We review retained information when the relevant obligation, dispute or recovery need ends.
Your choices and rights
Use Profile to correct your details, Settings to manage permissions and analytics, and Profile → Delete account to request permanent member deletion. Support can help with access, correction, portability, objections, restrictions or a disputed decision, as applicable to your location. You may complain to your local data protection authority, including the UK ICO. If you cannot sign in, email karim@crowdecho.app or tameem@crowdecho.app.
Adults only
Crowd Echo is for adults aged 18 or over. Some missions require you to be 21 or over. We do not offer a children's account or seek parental consent as a substitute for meeting these age limits.