What we hold, and what we do with it

What is collected

Your email address, because it is how you sign in and how invitations reach you.

What you choose to put in your profile: a name, a nickname, a photo, a birthday, an anniversary. All optional. Only the day and month of a date is ever shown to anyone — never the year.

What you write and upload inside a circle, and who is in it with you.

A push subscription, if you turn on notifications: an anonymous address your browser issues, which lets us send a notification to that device and nothing else.

Photographs are shrunk and re-encoded in your browser before they are uploaded, which removes the EXIF data — including the GPS coordinates of where the photo was taken. That information never reaches our servers at all.

What it is used for

Running the app: showing your circles to you, letting the people in a circle see what is in it, and sending the emails and notifications you have asked for.

That is the entire list. There is no other purpose.

What is never done

Your data is not sold, rented, or shared with advertisers. There are no ad trackers.

Nothing is ever shown across circles. A circle cannot learn that you belong to another one, cannot see its name, and cannot be told about anything that happens in it. This is enforced by the database itself rather than by a rule in the code — the app cannot fetch a row from a circle you are not in, even if it asks.

There is no public profile, no discovery, no “people you may know”, and no way for a stranger to find you here.

Where it lives

On servers in the United States: a Postgres database hosted by Neon, file storage and hosting by Vercel, and email delivery by Resend, who see the emails we send you in order to deliver them.

Deleting things

You can remove your profile photo at any time, and leaving a circle stops you seeing it or being seen in it.

You can delete your whole account from the You screen. You leave every circle immediately and every device is signed out, so you are invisible from that moment.

For 30 days after that, nothing else is touched — your email, name, photo and passkeys are all still here, seen by nobody, so that signing in again brings the whole account back including the circles you were in. That window exists because people delete things in bad hours.

When the 30 days are up it is erased automatically: the row itself, and the photographs from storage. Nothing is left connecting you to anything. Nobody has to run anything for that to happen, and it cannot be undone.

Two things survive, and you should know which. What you wrote inside a circle stays there, shown as “Someone who left” — it belongs to that circle’s shared history as much as to you, and removing it would edit other people’s memories of an evening. And a circle you started keeps going for the people still in it. A circle with nobody else in it is deleted outright, along with everything in it.

An owner can also delete a circle itself, which is a different thing from deleting your account: it takes that circle away from everybody in it, with every photograph, plan and message in it. Everybody in the circle is told when it happens, so there is time to save anything worth keeping, and the owner who did it has 30 days to put it back. After that it is erased the same way an account is — the rows, and the photographs from storage — and it cannot be undone.

One thing outlives the erasure, and it names nobody: a line in a log saying that an account was deleted on a date, and who did it — you, or an admin if you asked one to. Nobody can edit or remove it afterwards, including the admin it might name.

Children

The app is not designed for or directed at children under 13, and accounts are only created for people somebody has invited.

Changes

If this page changes in a way that matters, the date at the top changes and the people using the app are told. It will not change quietly.