Trust is not declared.
It is verified.
Here is, precisely, what ekko seals, where your data lives, what we erase and what we keep. Nothing beyond what the code does.
●Hosted in Europe. No advertising. Verification without an account.
Verify a document
Every sealed document carries a code. Type it in: you will see what was sealed, by whom, and when. No account needed.
What is sealed, and how.
A sealed document is a set of facts, a seal and a code. Here are the six steps, as they are written in the code.
The facts
The document type, the level, the organisation, the date, the author, then the content: result, attendance, log. Nothing else.
Canonical JSON
The facts are written in one single form: sorted keys, no whitespace. The same content always gives the same text.
The SHA-256 fingerprint
For a ballot, one fingerprint is computed at opening (candidates, method, registered voters) and another at closing, on top of the first. A third party can recompute them.
The HMAC-SHA256 seal
The document is sealed with a key held only by ekko's server. If a single character changes, the seal no longer matches.
The EKKO-XXXX-XXXX code
Derived from the seal. It is printed on the document, and anyone can type it at ekkonetwork.eu/verifier.
The operations log
Opening, reveals, closing, invitations, reminders: every operation is dated and attached to the document.
What the seal proves: that the document has not changed since ekko sealed it. What it does not prove: it replaces neither a bailiff nor an auditor.
Where your data lives.
Two processors handle your data. We name them, and we say what is sent to them.
Google Cloud, in Europe
The database and the files are stored by Firebase (Google Cloud) in Europe: Belgium and the Netherlands. The studio's functions run in Belgium. Some of the mobile app's functions (sign-in codes, notifications, moderation) still run in the United States: data passes through there for the time of processing, the database stays in Europe. The hosting provider encrypts data in transit and at rest.
AI: Gemini, by Google
We use Gemini to create questions from a text or a file, and to moderate and group questions from the room. That content is sent to Google.
- Goes to Gemini: the text or file you submit; questions from the room and messages in the feed.
- Never goes: answers to questions, ballots, responses to an anonymous survey.
Your role, ours
Your organisation is the data controller; ekko is the processor. We read your data only to run the service. Emails (invitations, reminders) go through an email service.
What we erase, what we keep.
Erased
- On the free plan, a session's answers and results are erased 30 days after it ends. You are warned 7 days before. On a subscription, the period depends on the plan: one, two or five years.
- Participants (nickname, device identifier) and the session feed go with the answers.
- A ballot is erased on the date scheduled when it was created. For class representatives, everything is erased at the end of the school year.
Kept
- The sealed documents you produced, with their log, remain verifiable by their code as long as your space exists.
- The declared result of a ballot is kept; the ballots and the attendance list are erased.
- Your organisation's administration log: who did what, and when.
The threshold of five
An anonymous survey never shows a group of fewer than five respondents. This threshold is fixed: the organiser can raise it, never lower it.
The ballot box and the attendance list never meet
Who voted is written in one place, what was voted in another, with no shared field and no exact timestamp. The ballot box stays unreadable while the vote is open.
What each session guarantees.
You choose when preparing, according to the stakes: without attestation, with attestation, or reinforced. A session that has started runs to the end as it started. The attestation states what was applied.
| Guarantee | Without attestation | With attestation | Reinforced, on quote |
|---|---|---|---|
| Live results, participant anonymity | yes | yes | yes |
| Game data erased after 30 days on the free plan | yes | attestations kept | attestations kept |
| One participation per person | — | yes | yes |
| Ballot box unreadable during the vote, separated from attendance | — | yes | yes |
| Operations log | — | yes | yes |
| Sealed attestation, verifiable by code with no account | — | yes | yes |
| Attendance list | — | yes | yes |
| Remote participants identified through a second channel | — | — | yes |
| Individual receipt | — | — | yes |
| Measured anonymity, with a statement | — | — | yes |
| Transparency file for an independent review | — | — | yes |
Without attestation, it is free up to 50 people. The attestation comes with the subscription, from €4.90 for the month; reinforced, contact us: see the Pricing page.
There is a requirement above: end-to-end encryption, secrets shared between several people, external review before every ballot. It is that of workplace elections. We do not provide it.
This table is our reading of the CNIL recommendation on electronic voting, applied to all our activities. It is not a certification.
The trust the community places in you.
In the app, every account carries a karma, from 0 to 100. It measures one thing: engagement that respects others. Everyone starts at 100, the maximum; it cannot be bought, only the server writes it.
It rises by taking part
Voting on an ekko: +1. An accepted comment: +1. An accepted ekko: +3. At most 10 points a day, never above 100: you don't hoard it, you take part.
It falls by trying
Trying to publish an ekko that breaks the charter: −10. A comment that breaks it: −5. An ekko removed by moderation: −10. The attempt is what counts: the content is blocked and the karma drops at once.
The levels
From 50 to 100, everything is open; between 50 and 60, the app warns you. Below 50, no more publishing or commenting — you still read and vote, and every vote brings you back up. Below 20, read only. The server enforces these levels, not just the screen.
The charter, in plain words: every ekko and every comment is reviewed by an AI before it is published. It blocks insults and vulgarity, hate and discrimination, harassment and personal attacks, calls to violence, spam. Illegal content is removed. Each ekko also gets a reliability score: below 40, it is not distributed. Anyone can report content; the ekko team decides, and keeps a log of its decisions.
Below 20, you can no longer earn anything on your own: write to the ekko team (“Need help?”), who review the situation and can restore the karma to 50 — never higher, trust is regained by taking part.
What you can ask of us.
Access and export
You can obtain a copy of the data concerning you. It is a right; it does not depend on your plan.
Correction and erasure
You can correct your data or have it erased. For a participant without an account, the request goes through the organisation that ran the session, as data controller.
No advertising, no resale
No advertising, ever. Your data is neither sold nor passed on. No device identifier is requested beyond what is needed to count a participation.
For minors (class representatives, quizzes in class): no real name is ever requested in a session without attestation, and everything is erased at the end of the school year.
For any request
Write to support@ekkonetwork.eu. It is also the address of the data protection officer.
You have read it all. Now try it.
Request an invitationThis page describes what the code does today. When the code changes, so does the page.
ekko.