Privacy policy
Last updated October 20, 2026
What we can and can't see
We can't read your private messages, private circle posts and comments, private photos, videos and files, or your calls and encrypted livestreams. They're encrypted on your device with keys we never receive.
We can see metadata we need to run the service: who you message and which circles you're in, when things are sent, how big they are, and the IP addresses you connect from. We also see everything you make public.
1. Information we can't access
The following are end-to-end encrypted. Our servers store only ciphertext and never hold a key that can decrypt it:
- The text and attachments of direct and group messages, and group conversation titles.
- Posts, comments and media in encrypted circles, and media you share privately or sell as a paid item.
- Audio and video in calls and encrypted livestreams (our media server forwards encrypted frames only).
- Your private keys. Each device keeps its own key; your recovery backup is encrypted with your recovery key, which we never see.
The one exception is content you choose to disclose: when you report an encrypted item, you can send us that single item's key so a moderator can review it. That disclosure is optional and reveals nothing else.
2. Information we collect
| What | Why |
|---|---|
| Email, username, display name, password hash (Argon2id), birth year | To run your account, apply age-appropriate defaults (13+ only; under-18 accounts start private), and contact you about your account |
| Profile: bio, website, avatar and banner, privacy settings | To show your profile as you choose. Avatars and banners are public and re-encoded in your browser to strip location data before upload |
| Social graph: follows, friends, blocks, circle memberships and roles, conversation membership | To deliver content to the right people and enforce your privacy and blocking choices |
| Message and content metadata: sender, recipients or circle, timestamps, encrypted size, media type and duration, when media was last opened | To route and store encrypted content, enforce quotas, and move unused media to cold storage |
| Sign-in data: IP addresses, browser user agent, device names, session times, failed sign-in attempts | Security: detecting account takeover, rate limiting, letting you see and revoke sessions |
| Public keys and device approvals | So others can encrypt to you and verify your identity (safety numbers) |
| Public content: public posts, public circle pages, paid-content previews | To display, search and recommend it. Public images may be checked against known child-abuse hash lists |
| Payments: purchases, subscriptions, amounts, payout status, Stripe account identifiers | To grant access you paid for and pay creators. Card details go directly to Stripe; we never receive them |
| Aggregate analytics: page views, unique visitors (counted with probabilistic counters, not stored per person), referral clicks | To show creators how their circles are doing |
| Reports you file or that concern you, moderation actions, audit log | Trust & safety and legal compliance |
| Push notification endpoints | To send notifications you enabled. Notifications never contain message content |
We don't sell your data, and we don't use the contents of your messages or private circles for advertising — we can't read them. Promotions target public circle categories only.
3. Who processes data for us
- Stripe — payments, creator identity verification and payouts, under Stripe's own privacy policy.
- Object storage providers (Wasabi for active media, Scaleway for cold archives) — they store encrypted media split into shards across separate buckets. They can't decrypt it.
- Our real-time media server (LiveKit) — forwards encrypted call and livestream frames, and necessarily sees participants' IP addresses.
- Email delivery — for verification, security alerts and receipts.
- Browser push services (Apple, Google, Mozilla) — deliver notifications you turned on. Payloads contain no private content.
- Hash-matching providers (such as Microsoft PhotoDNA or Thorn Safer), when enabled by the operator — check public images only.
4. Child safety and legal requests
US law requires us to report apparent child sexual abuse material that we become aware of to the National Center for Missing & Exploited Children (NCMEC), and to preserve related data for one year. A report like this may include the reported account's identifiers, email, IP address history and any content disclosed in the report. We respond to valid legal process from law enforcement; for encrypted content we can only provide ciphertext and the metadata listed above. Data under a legal hold is kept even if you delete it.
5. How long we keep things
- Account data: while your account exists. On deletion your profile is removed immediately and content is erased after 7 days, except data under a legal hold.
- Sessions and sign-in IPs: while the session is active and for a limited period afterwards for security investigations.
- Media you haven't opened in 90 days moves to cold storage; it's still yours and is restored on request.
- Payment records: as long as tax and accounting law requires, even after account deletion.
- Audit and moderation records: as long as needed for safety and legal obligations.
6. Your rights and controls
- Access and portability — download your data as JSON in Settings → Your data. Encrypted content is exported as ciphertext only your devices can open.
- Deletion — delete your account in Settings → Your data.
- Correction — edit your profile at any time.
- Privacy controls — private account, discoverability, online status and who can message you, in Settings → Privacy.
- Depending on where you live (for example under the GDPR or CCPA), you may also have rights to object, restrict processing, or complain to a data protection authority.
7. Children
Circles is not for children under 13 and we don't knowingly collect their data; we delete accounts we learn belong to under-13s. Teens aged 13–17 get private accounts and friends-only messaging by default.
8. Security
Beyond end-to-end encryption, we use Argon2id password hashing, two-factor authentication, revocable per-device sessions, rate limiting, a strict content security policy and an append-only audit log. Read how encryption works for the details and the honest limitations.
9. Changes and contact
We'll tell you in the app before material changes take effect. Privacy questions and requests can be sent to the contact address published by the operator of this Circles server.