Built so we can't read your private life.
Encrypted before it leaves. Decrypted only where it lands.
Sunday lunch at ours?
Encrypted with the circle key
Unreadable ciphertext: x9Kq2f…Z0vP7c+e4mTb…Qa1=
Stores and relays. Holds no key.
Each device decrypts locally
Well-known cryptography
Public is deliberately public
A teal lock means sealed
A key design that has been reviewed in public.
1.Every device has its own key pair
Created in your browser. The private half never leaves that device.
2.Your account has a key
The per-user key is sealed separately to each of your devices. Each new version is signed by the previous one, forming a chain anyone can verify.
3.Your password unlocks it, in your browser
We keep a copy of your account key locked with a key your browser makes from your password (or, with Google sign-in, a Circles passcode). Circles never receives your password, so we can't open that copy or reset it.
4.Removing a device rotates the key
A new account key is made and shared only with the devices you keep, so a lost device can't read anything new.
5.A strong password matters
Anyone who got the locked copy would have to guess your password, and Argon2id makes every guess slow. Forget it, and a reset gives you new keys: older encrypted content can't be read any more.
When someone leaves, the lock changes.
- When a member leaves or is removed, a remaining member's device creates a new key for everyone else.
- People who left can't read anything posted afterwards.
- Group keys are delivered once per person, not once per device, which keeps large circles fast.
Media, calls and paid content too.
Photos, video and files
Calls and livestreams
Paid content
Private deduplication
Know who you're talking to. Report abuse without breaking encryption.
- Compare safety numbers in person or on a call. If they match, nobody is in the middle.
- Report an encrypted item and choose to reveal just that one item's key to moderators.
- A cryptographic commitment stored with every item proves the disclosed content is exactly what was sent, so evidence can't be fabricated.
- Automated scanning for known child-abuse images runs on public content only, when a licensed provider is configured.
Gone seconds after it's viewed.
What's deleted, and when
- Each person sees it for the chosen time from the moment it's on their screen, then it's gone for them, and their device forgets what it held.
- It's gone for everyone, the sender included, once every recipient's time has run out, or 7 days after it was sent if not everyone has viewed it.
- About 10 minutes after it's gone from screens, our servers delete it: the encrypted text, the keys for it, who viewed it, and every stored copy of its photos and videos. The 10 minutes are so whoever saw it can still report it.
- Notifications and previews of it go too. A reply never quotes it, and later shows only that it disappeared.
When it isn't, yet
- An open report keeps it until the report is closed. Someone who saw it can report it for 10 minutes after their time ran out.
- A legal hold pauses deletion, including a hold on any member of a direct or group chat.
- Either way it stays encrypted and hidden from everyone, and is deleted once the report is closed or the hold ends.
- Copying, downloading, casting and forwarding are off, but anyone who views it can still screenshot or photograph it.
What our servers can and can't see.
We can't see
- The text and attachments of direct and group messages, and group titles
- Posts, comments and media in encrypted circles
- Media you share privately or sell as a paid item
- Audio and video in calls and encrypted livestreams
- Your private keys, and the password that unlocks them
We can see
- Account details: email, username, profile, birth year, and anything you make public
- Your social graph: follows, friends, blocks, circles and conversations
- Metadata of encrypted items: sender, conversation or circle, time, size, media type, and for a disappearing one its timer and who viewed it when
- That two accounts hold the same large video or photo (50 MB or more)
- IP addresses and browser details for sign-ins
- A locked copy of your account key, which only your password or Circles passcode opens
- Payments and payouts, through Stripe
- Everything given to an AI persona, the questions members ask it and its answers. Google Gemini processes them too
- Games: who plays whom, in which chat or circle, every move and the result, because our servers referee them
- Public posts and who likes, replies to and reposts them, how often each public post is seen in feeds (counted per post, not per person), and their text, which Google Gemini reads to sort them by topic
No system is perfect. Here's where ours stops.
No per-message forward secrecy yet
Keys rotate when membership changes. Within one key period, a stolen key could read everything encrypted under it. We plan to move conversations to MLS (RFC 9420) using an audited implementation.
Automatic key delivery trusts the server
When paid or new members get keys automatically, the creator's device relies on the server's word that they paid or were admitted. Creators can switch to manual approval.
Metadata is visible
The server knows who communicates with whom, when and how much. Not what was said.
Large files are linked, not uploaded twice
Videos and photos of 50 MB or more that are already on Circles are linked instead of uploaded again. Our servers can tell that two accounts hold the same large file, and someone with a copy of a file and an account can find out whether it's here, a limited number of times per hour. Someone who copies our storage can't test files offline.
AI personas aren't end-to-end encrypted
When a circle owner adds an AI persona of themselves, its material, members' questions to it and its answers are read by our servers and processed by Google Gemini. The app says so before anyone types. Nothing else in the circle is sent to the AI.
Games aren't end-to-end encrypted
Our servers referee games, so they see who plays whom, every move and the result. The invitation in a chat is an encrypted message like any other, and a game post's text in an encrypted circle stays encrypted.
Identity is trust-on-first-use
If the first key you see for someone is already an impostor's, only comparing safety numbers will reveal it.
Your devices are part of the system
Anyone with an unlocked device of yours can read what it can. Remove lost devices promptly.
Casting hands one video's key to your Chromecast
To play a video on a Chromecast, Chrome sends that video's key to it over your network, and the Chromecast decrypts the video there. It gets a short-lived ticket for that video's encrypted files, never your account's keys. The Cast button loads Google's Cast script, only when you tap it.
The basics, done carefully.
Argon2id password hashing
With OWASP-recommended parameters.
Two-factor authentication
Authenticator-app codes (TOTP) on sign-in.
Revocable sessions
Random tokens stored only as hashes, in secure HTTP-only cookies.
Rate limits
On sign-in, messaging, uploads, reports and payments.
Strict content security policy
No third-party scripts on signed-in pages, except Google's Cast script, which loads only when you tap Cast.
Append-only audit log
Security and moderation actions, including staff viewing reports.
Privacy you don't have to think about.
Create a circle and invite your people. The encryption takes care of itself.