Privacy policy

1. Who is the data controller

The data controller is EchoRun, publisher of the EchoRun service, reachable at bonjour@echo-run.app. The full contact details appear in the legal notice.

2. The most important point: your position

During a race, the app reads your GPS position continuously to know when to trigger a message. These coordinates are never transmitted to our servers.

The proximity computation runs entirely in your browser: the route and the trigger points were downloaded beforehand, and the comparison "am I within 70 meters of this point?" happens locally, on your device. The position is kept in memory for the duration of the computation, then replaced by the next one. It is neither logged, nor stored in a history, nor sent to a third party.

The practical consequence: we are technically unable to reconstruct your route, your pace or your passing times. The only information that comes back, and only if the network is available, is the fact that a message was played • an identifier and a timestamp, with no coordinates.

3. Data we actually process

For the runner (account)

• Email address: for magic-link authentication and service messages. Legal basis: performance of the contract.
• Display name or nickname: shown to your friends on the drop page, so they know who they are talking to.

For races

• Route from the GPX file you import: route coordinates, distance, race name, date. A race route is public organizer data, not a history of your movements.
• The original GPX file, kept to allow a re-import. You can delete it without deleting the race.

For friends and family (no account)

• The first name or nickname entered. We ask for no email, no phone number, and no verified identity.
• The recorded voice message and its duration. Legal basis: consent, given by the act of recording and sending.
• The chosen point on the route • a position on a route, not the friend's position, which is never requested.
• A technical token stored in their browser's local storage, which lets them find their messages and their quota if they come back. This token is not an advertising cookie and enables no cross-site tracking.

For payments

Payments are processed by Stripe Payments Europe. We never see and never store any card number: entry takes place on Stripe's pages. We keep only the transaction identifier, the amount, the currency and the status, for accounting and customer support.

4. Voice messages: who can listen to them

The audio files are stored in a private space. They are not accessible through any public URL: each playback goes through a signed, temporary link, generated only for the authenticated recipient runner.

• The recipient runner can listen to them.
• Other friends cannot listen to them. They only see that a point on the route is taken, and by which first name.
• Our team does not access them, except on a court order or a report of unlawful content by the runner.

A friend who wants to withdraw their message can do so from the share link as long as the race has not taken place, or write to us. The runner can delete any received message.

5. Retention periods

• Voice messages: 12 months after the date of the race, then automatic deletion. The runner is notified one month before and can request an extension or download their files.
• Routes and races: until the account is deleted.
• Account: deleted on request, or after 36 months of total inactivity.
• Billing data: 10 years, a legal accounting retention obligation.
• Technical logs (server errors, IP addresses): 30 days.

6. Processors and hosting

• Supabase • database, authentication and file storage. Hosted in the European Union.
• Vercel • hosting of the web application.
• Stripe Payments Europe • payment processing.
• Google AdSense • display of ads, when this feature is enabled (see next section).

7. Cookies and trackers

The service uses two categories of trackers, and only two. There is no third-party audience-measurement tool, no social-network button, and no session recording.

Strictly necessary • no consent required

These trackers are exempt from consent because the service cannot work without them. None is used for advertising purposes.

• Session cookie (set by Supabase Auth): keeps you logged in. Duration: the session, renewed on each visit.
• Voice-drop token (local storage, not a cookie): lets a friend find their messages and quota without creating an account. Stays on their device, transmitted to us only at the moment of a send.
• Remembering your cookie choice (local storage): so we don't ask you again on every page.
• Race cache (IndexedDB): the route and audio files downloaded before the event, for offline playback. Removable from your browser settings.

Advertising • subject to your consent

The service may display Google AdSense ads on the public pages, on the message-drop page and on the race-finish page. No ads are shown during a race.

As long as you have not responded to the banner, no advertising script is loaded and no request is sent to Google. If you decline, the ads become contextual: they still show, but with no advertising cookie or profiling. We pass this refusal on to Google via the "Consent Mode" mechanism, which also applies it to its partners.

The service is fully functional in both cases: declining degrades no feature.

Changing your choice

You can change or withdraw your consent at any time, without justification and with no impact on your use of the service. The link is also present at the foot of every page.

Open my cookie preferences

Regardless of this choice, the advertising settings of your Google account can be changed at adssettings.google.com, and your browser lets you block or delete cookies already set.

Our internal statistics (number of races, of messages, revenue) are aggregate counters computed directly in the database, with no individual identifier or tracker.

8. Your rights

In accordance with the GDPR, you have a right of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to withdraw your consent at any time.

To exercise them, write to bonjour@echo-run.app. We respond within 30 days. If our response does not satisfy you, you can refer the matter to the CNIL (cnil.fr).

9. Security

• Encryption in transit (HTTPS) and at rest across the entire service.
• Row Level Security partitioning in the database: one runner cannot technically read another's data, even in the event of an application flaw.
• Audio files in a private space, served exclusively via ephemeral signed links.
• No password stored: authentication is done via a single-use link.

10. Minors

The service is not intended for children under 15. A child can of course record a message for a parent, under the responsibility of the adult who entrusts them with the device.

11. Changes

Any substantial change to this policy is announced by email to account holders at least 15 days before it takes effect.