Local-first is a design choice, not a security certification. We explain limits honestly and encourage users to verify nearby connections before sharing information.
Our security principles
Echo is built around local proximity, user-approved peer connections and short-lived sessions. The design goal is to reduce unnecessary exposure, not to promise complete anonymity or perfect network security. Mobile and desktop operating systems, local-network equipment and transport APIs all influence security.
Controls users can rely on
- Compare pairing codes on both devices before accepting a connection.
- Choose what profile information to reveal; alias mode changes the app-facing display but does not erase all metadata.
- Remember that a file you send is a file a recipient can save.
- Leave a bubble when you no longer want to participate. Review optional kept contacts and notification permissions.
- Get updates from official stores instead of APK mirrors or unknown downloads.
Known limitations
Radar rings are illustrative rather than measurements of physical distance. Some connectivity paths are dependent on device hardware or operating-system support. Nearby peers, LAN administrators and recipients may access connectivity metadata or content voluntarily sent to them. Echo cannot prevent another person from copying shared information.
Website security
The website ships as static HTML, CSS and JavaScript, with no login, API, server-side contact form, cookies or external tracking libraries. A sample production configuration provides HTTPS-friendly headers, a strict Content Security Policy, clickjacking defenses, and referrer and permissions policies. Hosting provider defaults must also be secured and checked before launch.
Report a security concern
We welcome responsible reports of security vulnerabilities and abuse affecting Echo or this website. Email youngboysincoperated@gmail.com with an accurate description of the issue, affected version/platform, and steps needed to reproduce it. Do not include other people's personal data or carry out destructive testing.
Please avoid public disclosure of newly discovered vulnerabilities before giving the development team a reasonable opportunity to investigate. We cannot guarantee a particular response time or bug-bounty reward.