Privacy policy
What we collect, why, who else sees it, and what you can demand of us.
Who is responsible
Ecla is published by Cospera. For any question about your data, or to exercise one of the rights below, write to contact@ecla-app.com. We answer within two working days, and in any case within the month the GDPR allows.
What we collect
Nothing that is not needed to make Ecla work. Here is the list, in full.
Your account
- What you type in: email address, username, tag, display name, bio, profile picture.
- Your date of birth, because the law sets a minimum age and asks for a parent’s agreement below a certain one.
- Your phone number, verified by SMS at sign-up. It exists to keep automated accounts down; it does not appear on your profile and is not used to target you.
What you post
Your posts, comments, reactions, photos and videos, and the groups, events and meet-ups you create or join. This is the content you mean for other people: it is visible according to the settings you choose.
Your connections
Who you follow, who follows you, your accepted contacts, and the accounts you have blocked. We keep these because a social network does not work without them — not to build an advertising profile out of them.
The strictly technical
A device identifier so we can send you notifications, and an error report when the app crashes. Those reports are handled on our own servers: no third-party analytics or audience-measurement tool ships in Ecla.
Your messages
Conversations, one-to-one and group alike, are end-to-end encrypted — photos, video and voice notes included. The keys live on your devices, not on our servers. We store the encrypted message and deliver it; we cannot read it, and we cannot hand it to anyone in readable form.
The trade-off is real: if you lose every device, we cannot restore your conversations. Nobody can.
What we do not do
- We do not follow you across other sites or apps, and Ecla contains no third-party pixel or tracker.
- We do not sell your data and we do not trade it for advertising.
- We do not buy an advertising profile built elsewhere and apply it to your account.
- We do not read your private messages — the encryption prevents us, deliberately.
Advertising
Ecla shows ads, and we would rather say so plainly. They are chosen from what you follow on Ecla — your topics, your subscriptions — and never from a profile built outside Ecla, nor from the content of your private messages, which we cannot read. Advertisers receive aggregate statistics, never your identity.
If your account is a minor’s, no advertising is selected from your profile or your activity: you see contextual ads only, the same for everyone. That is what Article 28(2) of the Digital Services Act requires, and the server enforces it, not only the app.
On what legal basis
| Why | Legal basis |
|---|---|
| Creating and running your account, showing your feed, delivering your messages | Performance of the contract (art. 6.1.b) |
| Verifying your phone number and keeping automated accounts down | Legitimate interest — the security of the service (art. 6.1.f) |
| Moderating reported or manifestly illegal content | Legal obligation (art. 6.1.c) and legitimate interest (art. 6.1.f) |
| Checking age and obtaining a parent’s agreement where the law requires it | Legal obligation (art. 6.1.c), GDPR art. 8 |
| Translating a post or a message when you ask | Your consent, withdrawable (art. 6.1.a) |
Who processes data for us
We do not do all of it ourselves. Here is the complete list of providers that see data pass through, and what they see. Each acts on our instructions and may not use the data for its own purposes.
| Provider | What it processes |
|---|---|
| SashiDo | Hosting for the service’s database and files. |
| Brevo | Sending email: confirmations, parental consent requests, security alerts. |
| Prelude | Sending the verification SMS at sign-up. Receives your number and nothing else. |
| Sightengine | Scanning uploaded images and video to detect prohibited content. |
| Mistral AI | Scanning posted text for moderation, and the assistant’s replies when you ask it something. |
| DeepL | Translating a post or a message, only when you ask for it. |
Your private messages appear nowhere in this table, with one exception you control: if you ask for a message to be translated, then — and only then — your device decrypts that message and sends its text to DeepL.
Minors
Ecla is not open below 13. Between 13 and your country’s digital consent age — 15 in France, 13 to 16 elsewhere in Europe — a parent’s agreement is required. You give a parent’s email address; they receive a link and decide from their own inbox, without having to create an account.
A minor’s account starts closed: private profile, not findable by search, messages from strangers refused. These are settings the server applies, not pre-ticked boxes, and the app cannot work around them.
From that same link, a parent can at any time withdraw their agreement, set screen time and quiet hours, or delete the account. Withdrawing the agreement closes the account back down — private profile, not findable by search, messages refused — and the profile cannot be edited again until the agreement is given.
How long we keep it
As long as your account exists. When you delete it from Settings → My account → Delete my account, we erase your posts, your comments, your messages, your connections and your devices, and only then destroy the account itself. It is permanent and we keep no copy.
Two exceptions, short and narrow: a report already acted on may be kept for as long as handling a challenge to it requires, and data a legal obligation requires us to keep is kept for the period that obligation sets.
Your rights
The GDPR gives you rights over your data. Two of them you exercise straight from the app, without writing to us or waiting:
- Access and portability: Settings → My data hands you everything the server holds about you, as JSON.
- Erasure: Settings → My account → Delete my account.
- Rectification: edit your profile in the app, or write to us for anything not editable there.
- Objection and restriction: write to contact@ecla-app.com.
- Withdrawing a consent — translation, for instance — at any time, without calling into question what was done before.
If our answer does not satisfy you, you can complain to the CNIL (cnil.fr) or to your country’s data protection authority.
Changes
We will update this text as Ecla changes. If a change affects what we collect or who sees it, we will tell you in the app before it takes effect — not by quietly editing this page.