Echo sells anonymity, AGPL source, and “no ID verification, ever.” The live app on chat-echo.com keeps messages in a form the operator can read. The public GitHub is a rewritten nightly dump of a private GitLab. The lead developer grades competing chat apps on Reddit as the only reviewer, then grades Echo 3.3 out of 9 and calls it a ghost town.
Scroll sideways on a phone if the table is tight.
| 3.3 / 9 | Adel’s own EDAR score for Echo, August 2026. He called it a ghost town and told readers to pick a higher-scoring app. |
|---|---|
| 103 | Ranked backend findings in Echo’s own vulnerability ledger. Closed the day after a public security warning. |
| never | Homepage: “No ID verification, ever.” Terms: they may require age or consent verification, including extra information from a parent. |
| 0 | Public GitHub issues from humans. The open tickets are Dependabot pull requests. |
Echo is a Vue / Fastify / Socket.IO / Postgres chat app by GitHub user ad3lre (Adel) and Reddit user u/ad3lyt. Marketing lives at app-echo.net. The live product is chat-echo.com. The public source is github.com/ad3lre/echo. Legal copy says a German Kleingewerbe runs it.
The pitch is a privacy-minded Discord alternative: AGPL, self-host, no ads, no ID. The files say text chat is not end-to-end encrypted, GitHub is a sanitized mirror, Windows / macOS / Linux “Stable” download buttons open the website, and the founder’s review series is a one-person scoreboard of his competitors.
This page is the product they described, written in English, with the claims checked against the live marketing site, the legal docs, the public GitHub tree, and Adel’s own Reddit posts. Research current as of 20 September 2026.
The marketing site leads with “We don’t ask for your ID” and “Join freely and stay anonymous.” The privacy policy requires an email, collects IP addresses and device identifiers, and states in so many words that text chat and group messages are not end-to-end encrypted. Operators of an instance, and anyone with database access, can read message bodies. Voice may use client-side encryption. Your DMs do not.
The README tells contributors to clone GitHub. The agent charter in the same repo says day-to-day history lives on GitLab origin/main, and GitHub only gets branch release/1.0.0, rewritten so public SHAs never match internal ones. A cron job mirrors the tip at 23:00 Europe/Berlin. SECURITY.md: the public repository is published “without prior private development history.” CONTRIBUTING.md tells maintainers to run gitleaks on a clean tree before the first GitHub push.
Homepage feature card: “No ID verification, ever.” Terms of Service, 28 June 2026: if they cannot verify required consent or eligibility, they may “require age/consent verification (including additional information from a parent/guardian where applicable)” and suspend the account until that is confirmed.
The download page advertises Windows, macOS, and Linux with a “Stable” badge. Every desktop button points at https://chat-echo.com, the web app. Adel’s own August 2026 EDAR: Echo is “only out as a Web platform,” and there is “a reason” the Tauri builds have not been officially released. The Apple tree is still an “iOS first shipping target.”
The public tag is 1.0.0. The in-repo production-readiness rollup, 1 June 2026, puts a “serious text chat MVP” at about 90 to 95 percent and a full-feature platform at about 52 to 62 percent. Voice / SFU sits around 37 percent. Adel’s own review scored Readiness 1 out of 9: a ghost town, single-digit active people, web only.
EDAR stands for Echo Discord Alternative Review. u/ad3lyt posts numbered scores of competing chat apps, and of Echo, on r/DiscordAlternatives. Each post includes a conflict-of-interest line, then continues: he is the owner of a direct competitor, and the only reviewer. He also built alternatives-discord.com so people can rank those scores. Community guidelines on Echo forbid self-promotion.
On 30 May 2026 a r/DiscordAlternatives thread claimed stored XSS, CSRF bypasses, and other holes, plus upvote botting. Adel replied, score below zero: “Everything he said was a lie.” “Echo has no real vulnerabilities at this moment for my knowledge.” “I have done 0 botting.”
Echo’s own docs/reviews/security/patched-security-issues.md dated 31 May 2026 lists a High-severity upload Content-Type XSS, a High-severity bot-install IDOR, a CSRF and XSS regression suite, and HTML stripping on profile fields. The 25 April ledger had 103 ranked findings. On 31 May they marked all of them Fixed, Mitigated, or Accepted. On 3 June Adel posted “Is Echo a secure discord alternative that can be trusted?” and, in the same post, admitted an early incident: the app ran in dev mode and leaked source including API keys.
Voice and video calls may use separate client-side encryption where enabled. Text chat and group messages are not end-to-end encrypted in the current product.
That sentence is in the live privacy policy at app-echo.net/privacy. Read the security file.
Adel writes as “we” and “the team” on the marketing site, and as “I” on Reddit. GitHub lists one contributor on the Echo repo. The privacy policy is a German Kleingewerbe. A SaaS post in June: he came off “making a really good and complex discord bot,” then built Echo with “a couple of friends.” The official marketing site ships an “Adel Approval Poll”: fifty scored questions, a live leaderboard, and country flags for where people played from.
If you would not hand a community’s messages to a person who publicly called a security warning a lie the same week his repo logged High XSS and High IDOR as patched, you already understand the product.