Privacy policy

• You can play everything except ranked runs without an account. As a guest, your progress stays in your browser.
• With an account we store your email address (to sign you in), the username and Bop you pick, and your game results.
• No ads, no selling data, no tracking cookies.
• You can download or delete your account data at any time from Account.

Echobop is run by Renzo Romeo ("we" on this page). We decide what data the game uses and why. How to reach us is at the end of this page.

Guests don't have an account, so we don't know who you are. The game keeps these things in your browser's local storage on this device only:

• your settings (theme, sounds, music, mode, guide and similar choices);
• your timing calibration;
• cleared levels, best scores, achievements, streak and today's daily try.

This data is not sent to us. Clearing this site's data in your browser removes it. To play, your browser still asks our server for pages and for the daily rhythm, like any website.

• Email address. Used only to send sign-in emails (a 6-digit code and a link) and to identify your account. It is never shown to other players. If you sign in with Google, Google also shares your name and profile picture link, which are stored with your account.
• Username and Bop avatar. You choose them, and they are public.
• Age confirmation. That you confirmed you are 13 or older, and the date your account was created.
• Runs. For each ranked or practice run you submit: the level or daily, mode, tempo, your calibration offset, the time of every tap, how each note was judged, and your score. We use the taps to check scores on the server and to spot cheating.
• Progress. Best scores, cleared levels (including the unlocks copied once from this device when you first sign in), daily attempts, your streak, and achievements.
• Sign-in records. Our sign-in provider keeps a security log of sign-ins and account changes, with the time, your email address and IP address.

Your username, avatar and join date; your scores on leaderboards (accuracy, timing statistics and when you played); and your achievements and best scores on your profile page. Other players never see your email address, your taps, your calibration or your age confirmation.

• To run the game you asked for: your account, ranked scores, leaderboards, the daily, streaks and achievements.
• To keep the game fair and safe: checking scores, hiding suspicious runs, and limiting how often sign-in emails can be requested and sign-in codes tried. For those limits we keep a scrambled (hashed) form of your email address and IP address for 10 minutes; it is deleted with the next sign-in request or code try after that. Before a sign-in email is sent, Cloudflare Turnstile checks that a person, not a bot, is using the sign-in form; it looks at signals from your browser and connection, such as your IP address and browser type.
• To keep the service working: our server logs record errors with the page and the kind of error, never your email address or your taps. If the app crashes, it sends the error message and your device type to Echobop's own server logs. Our host also keeps standard request logs with the page asked for, the time and the IP address.

Where privacy laws ask for a legal basis, we rely on providing the service you signed up for and on our legitimate interest in keeping it secure and fair. We never sell your data or use it for advertising.

The only cookies Echobop sets are sign-in cookies from our sign-in provider, Supabase. They are set when you ask for a sign-in link (so this browser can finish signing in) and keep you signed in afterwards; signing out removes them. They are strictly necessary, so there is no cookie banner. We use no advertising, tracking or third-party cookies.

Settings, calibration and guest progress live in your browser's local storage, as described above, together with a note of which accounts already copied this device's progress. So that the game works offline, it also keeps copies of its pages, sounds and music in your browser's Cache Storage. All of this stays on your device.

We use Plausible Analytics to understand how the game is used. Plausible sets no cookies and stores no personal data. It counts page views (profile pages are recorded without the username) and a few anonymous events: finishing a run (mode, tier and whether it cleared), playing the daily, pressing a share button and signing in. Plausible uses your IP address and browser only to count daily unique visitors and does not store them.

These providers process data on our behalf, under their own data protection terms:

• Supabase stores the database and runs sign-in.
• Railway hosts the website and the server, including server logs.
• Resend sends the sign-in emails to your address.
• Cloudflare registers the echobop.com domain and answers its DNS lookups. If you open www.echobop.com, Cloudflare handles that request to send you on to echobop.com.
• Cloudflare Turnstile runs the bot check on the sign-in form.
• Google, only if you choose to sign in with Google.
• Plausible Analytics counts anonymous visits and events.

Depending on where these providers run, your data may be processed outside your country.

• Account data stays until you delete your account. Deleting it removes your profile, runs, scores, progress, streak, achievements, daily attempts and your account's email address right away. Backups kept by our database provider expire on their own schedule shortly after.
• The sign-in provider's security log (see above) is not removed when you delete your account; it is kept for that provider's log retention period, or deleted sooner on request.
• Hashed email and IP addresses used to limit sign-in emails and code tries are deleted with the first sign-in request or code try after they are 10 minutes old.
• Server logs are kept for the hosting provider's log retention period.
• Data on your device stays until you clear it.

• Download everything your account stores as a JSON file from Account. It includes each run's taps, judgments and calibration offset, and when guest progress from a device was copied to your account.
• Delete your account there at any time.
• Ask us to correct your data, to explain how we use it, or to delete it, using the contact details below.

Depending on where you live (for example under the GDPR in the EU and UK, or in California), you may have further rights, including complaining to your data protection authority.

Anyone can play as a guest. Accounts are only for people who are 13 or older, and everyone confirms this when choosing a username. If the law where you live requires an older age to agree to this on your own, ask a parent or guardian first. If you believe a child under 13 has an account, contact us and we will delete it.

If we change how Echobop uses data, we will update this page and the date at the top. For significant changes we will also say so in the game.

Questions, requests about your data, or a report about an account? Email contact@renzoromeo.dev.