Effective date: October 6, 2026
EchoBBS.com is operated by ThunkTunk LLC, a Virginia limited liability company. In this policy, "EchoBBS", "we", and "us" mean ThunkTunk LLC. This policy explains what information we collect, why we collect it, and who can see it. It applies to echobbs.com and to every board hosted on it.
The short version
- We collect very little. Sysops give us an email address and a password. Callers give a handle and a password, and an email address too on boards that require an EchoBBS account.
- Private mail between callers can be read by the sender and the recipient. A board's sysop and co-sysops cannot read it. EchoBBS administrators can access it only in the limited cases described below.
- The sysop and co-sysops of a board can see certain information about that board's callers. The table below lists exactly what.
- We do not sell your information, and we do not show ads.
- EchoBBS is for adults. You must be 18 or older to use it.
Who is who
A board is a bulletin board system hosted on EchoBBS. A sysop is the person who created and runs a board. A co-sysop is a caller the sysop has appointed to help run it. A caller is a member of a board.
Each board is run by its sysop, not by EchoBBS. The sysop decides the board's rules, who may join, and what questions callers are asked when they sign up.
What we collect
From sysops
- Your email address and your password. Passwords are stored only as a salted hash. We never see or store the password itself.
- Whether your email is confirmed, and the time of your last sign-in.
- The boards you create and their settings, including any logo you upload.
From callers
- Your handle and your password, stored as a salted hash.
- Your answers to any signup questions the sysop has set.
- Your join date, the time of your last call, your post count, your credits, your game scores and saved games, and your access level and status on the board.
Each sysop chooses how people join their board. Some boards let you join as a local caller with only a handle and a password, and in that case we do not collect an email address from you. Other boards require an EchoBBS account with a confirmed email address. If you join with an EchoBBS account, or link your handle to one, the email address on that account becomes associated with your caller record.
Content you create
Threads, posts, one-liners, private mail, live chat messages, one-to-one chat with board staff, and your activity in door games.
Presence
While you are on a board, we record your handle, the screen you are on, and when you were last seen. Boards use this to show who is online.
Technical information
- We use your IP address for a moment to calculate a one-way hash, which we store to limit repeated join and password-reset attempts. We do not store raw IP addresses in our application database.
- Our hosting providers keep standard server logs, which include IP addresses, for security and reliability.
- We do not record your browser's user agent in our application database.
Email records
We keep a log of the emails we send, including the recipient address, the type of email, and whether it was delivered. We also keep a list of addresses that bounced, reported spam, or asked not to be emailed, so that we do not email them again.
Password safety check
When you choose a password, we check it against a public list of passwords exposed in data breaches. Only the first few characters of a scrambled version of the password are sent for this check. The password itself never leaves our systems.
Who can see what
| Information | Other callers on the board | The board's sysop and co-sysops |
|---|---|---|
| Handle, posts, one-liners, game scores | Yes | Yes |
| Live chat messages | Yes, for about a minute after they are sent | Yes, including history |
| Private mail | Only the sender and the recipient | No. Board staff can delete a message but cannot read it |
| One-to-one chat with board staff | No | Yes |
| Answers to signup questions | No | Yes |
| Email address, if you joined with or linked an EchoBBS account | No | Yes |
| Join date, last call, post count, credits, status, access level | Some boards show recent callers | Yes |
| Your password | No | No |
A sysop can reset a local caller's password. When that happens the sysop sees the new temporary password once, so they can pass it on.
Public areas. Depending on how the sysop has set up the board, some areas may be visible to visitors who are not logged in, and to search engines. This can include announcements, one-liners, bulletins, the games list, and game scores. On boards that publish scores to the global leaderboard, your handle, score, and board name can appear on public pages of echobbs.com. Treat anything you post in a public area as public.
Login notifications. A sysop can choose to receive an email when a caller joins or logs in to their board. That email includes the caller's handle.
EchoBBS administrators. EchoBBS administrators run the platform itself and are separate from any board's sysop. Because we operate the database, a small number of EchoBBS administrators have the technical ability to access stored information, including private mail. We do so only when it is needed to keep the service running and secure, to investigate a reported violation of our Terms of Service, or to comply with the law.
How we use information
We use the information above to run boards, sign you in, send account emails, notify sysops about activity on their boards, prevent abuse, and meet our legal obligations.
We do not sell your information. We do not use it for advertising.
Cookies and browser storage
EchoBBS uses a small amount of browser storage, all of it to make the service work:
- A sign-in token, so you stay logged in.
- Your display choices, such as the skin you picked for a board and whether a side panel is open.
- Whether you muted the sysop doorbell sound.
- Progress in a game you are in the middle of.
Our hosting provider, Cloudflare, sets a short-lived security cookie to tell real visitors from automated traffic.
We may use Google Analytics to understand how the public pages of the site are used. If we do, it will set cookies and collect usage information such as the pages you view, your approximate location, and your device type.
Companies that help us run EchoBBS
We share information with service providers only so they can provide their service to us:
- Cloudflare for hosting, content delivery, and protection against attacks.
- Supabase, through Lovable Cloud, for our database and sign-in system.
- An email delivery provider for sending account and notification emails.
- Google. Your browser loads fonts and some images from Google's servers, which means Google receives your IP address when you load a page.
- Have I Been Pwned for the password safety check described above.
We may also disclose information when the law requires it, or when it is needed to protect the rights, safety, or property of EchoBBS, our users, or the public.
Emails we send
All email from EchoBBS comes from noreply@notify.echobbs.com.
- Account emails, such as confirming your address or resetting your password. These are required to operate your account and cannot be switched off.
- Doorbell emails to sysops about callers joining or logging in. Each one includes an unsubscribe link, and a sysop can turn them off for any board in that board's settings.
How long we keep information
We keep your information for as long as your account or board exists.
- When a sysop deletes a board, everything on it is permanently deleted, including its callers, posts, private mail, and game data.
- When a sysop removes a caller, that caller's posts, the threads they started, their private mail, their scores, and their signup answers are deleted.
- Banning a caller does not delete anything.
- Copies may remain in our backups for a limited time before they are overwritten.
Your choices
- Delete your account or your data. There is not yet a button for this. Email privacy@echobbs.com from the address on your account, or tell us your handle and board, and we will delete it within 30 days.
- See or correct your information. Email privacy@echobbs.com.
- Change your password from your profile on a board, or with the password reset link.
- Leave a board. Ask the sysop to remove you, or email us.
Depending on where you live, you may have additional legal rights over your personal information. We will honor a request to access, correct, or delete your information wherever you live.
Age
EchoBBS is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe someone under 18 is using EchoBBS, email privacy@echobbs.com and we will remove the account.
Security
Every connection to EchoBBS is encrypted in transit. Data is stored encrypted on managed cloud infrastructure with automated backups. Passwords are salted and hashed. Each board's data is isolated from every other board at the database level.
No system is perfectly secure. If we learn of a breach that affects your information, we will notify you as the law requires.
Where your information is processed
EchoBBS is operated from the United States. Your information is processed in the United States and in other countries where our service providers operate.
Changes to this policy
If we change this policy, we will post the new version here and update the effective date. If a change is significant, we will also tell sysops by email.
Contact
Privacy questions and requests: privacy@echobbs.com
ThunkTunk LLC