Circles — Privacy Policy

Effective date: 18 September 2026 Last updated: 13 October 2026

1. Who we are

Circles is operated by Carlos Puigjaner, an individual developer established in Spain (the “we”, “us”, or “controller” in this policy).

Contact for privacy matters: circles@thisiscircles.com

Supervisory authority: Agencia Española de Protección de Datos (AEPD, aepd.es) — you can lodge a complaint with the AEPD or with your local EU data protection authority at any time. If you are in the United Kingdom, you can also complain to the Information Commission’s Office (ICO, ico.org.uk).

2. What Circles is

Circles is a personal relationship app: it helps you stay in meaningful, regular contact with the people who matter to you. You create entries for your own contacts, organize them into circles of closeness, set how often you’d like to reach out, log your interactions, and receive AI-generated suggestions to make each contact more thoughtful.

This has an important consequence: most of the data in Circles is data you write about other people (your contacts). Section 5 explains your role and responsibilities for that data.

3. Data we process

3.1 Your account

• Email address and name — from your sign-up method (email, Google, or Apple).
• Password — only if you sign up with email; stored as a bcrypt hash, never in plain text.
• Social sign-in identifiers — the stable account ID Google or Apple provides (not your password).
• Preferences — daily reminder time, timezone, push notification token (if you enable reminders).
• Away periods — date ranges you mark as time away (vacation mode), used to pause reminders and contact schedules.
• Consent records — the timestamp when you acknowledged the notes privacy notice.

3.2 Your contacts (data about third parties)

For each contact you choose to add, you may store:

• Name, last name, nickname, relationship type.
• Important dates (birthdays, anniversaries, other dates you add).
• Timezone.
• Free-text notes — anything you write about them.
• Interaction history — channel (call / message / in person), dates, status, and optional per-interaction notes.
• Contact frequency preferences (how often you want to reach out, per channel).

3.3 Technical and service data

• IP address — processed transiently for rate limiting (abuse protection) and, when you create your account, to work out the approximate country you connected from. Only the two-letter country code is stored, on your account; the IP address itself is never written to our database, never logged and never sent to anyone. The country is worked out on our own server against a table built from the public address-delegation files that the regional internet registries publish, so no third party ever receives your address. We use it only to see which countries new users come from. Accounts created before 6 October 2026 have no country, and we do not fill it in afterwards.
• Error diagnostics — technical error reports (error type, stack trace, endpoint) sent to Sentry, our error monitoring service, in its EU region (Frankfurt, Germany). The app and the server are configured not to attach notes, emails, request bodies or local variables. For errors reported from the app, Sentry’s servers infer the device’s IP address from the connection and derive an approximate country from it; we do not copy that address into our own systems, and it stays inside the error event at Sentry.
• Payment data — subscriptions are processed by Apple through In-App Purchase. Apple is the merchant for your purchase; we never receive or store your card details. Your subscription status is managed through RevenueCat (§7), which receives your account’s internal user ID, the App Store receipt, your device type and system version and the last time the app was used — never your card details.
• Website visits — when you open thisiscircles.com, our server records the page, the site that linked to you (if any), the campaign tag in the address (for example ?source=), whether you tapped the App Store button, and a daily, non-reversible hash of your connection used only to count unique visitors. No cookies, no IP address stored, no third-party analytics.
• Usage data — the date you last opened the app, one record per day on which you opened it (the day only: no time, no screen, no content), the dates you added your third contact and first read a monthly letter, and, for the first-run setup only, the time at which you first reached each of its screens (welcome, each circle, the example letter, the final screen), whether you skipped a step, and whether you allowed notifications. No content is recorded with any of this: no names, no notes, nothing you typed. We use these only to see whether Circles is being used and where new users stop, in aggregate. They are never used for advertising, never shared with anyone, and are deleted with your account.
• Using Circles without an account — from version 1.3, some new installations can use the app before creating an account. In that mode everything you enter (people, notes, rhythms and your Called / Messaged history) stays on your phone, protected by iOS data protection, and is not sent to our server, with one exception: to write the day’s suggestion, the app sends the same context the suggestion uses with an account (notes, relationship type, important dates within the next 20 days and days since the last contact — never the name) together with the installation identifier described below. Our server passes it to Anthropic (§6) and returns the phrase without storing any of it; the phrase is kept only on your phone, for that day. Notes travel only after you have accepted the notes notice the app shows the first time you tap a notes field. When you create an account, what is on the phone is uploaded to it and from then on is handled as described in this policy; if you sign in to an account that already exists, what is on the phone is discarded after a warning that tells you how many people would be lost.
• Installation identifier and product events — on its first open, the app generates a random identifier for that installation (a reinstall produces a new one) and keeps it on the phone. With it, the app sends our own server a small set of product events: the app being opened (at most once a day), the welcome screen, the add-person form and the sign-up screens being shown or used, a person being added (which circle, how many people in total, whether a note was written — never the note), a suggestion being shown or acted on, and the notification and account prompts being answered. Every event carries the identifier, which version of the first experience the installation was assigned to, the app version, the country of your App Store account (or, when the store does not say, the region set on your device) and the time. No event ever contains a name, a note or anything you typed. We use them to compare the two versions of the first experience (next point) and to see where new users stop. No third-party analytics service is involved: the events are stored on our own server, are linked to your account when you create one, and are deleted with it. The sending of events depends on a single switch in the app, so that it can be made conditional on a permission without any other change.
• Two versions of the first experience — new installations are assigned at random, once, to one of two versions of the first screens (one lets you use the app before creating an account; the other asks for the account first, as before). The assignment is stored on the phone and sent with the events above. It changes nothing about what data is collected beyond those events.
• Apple Ads attribution — if you installed Circles after tapping one of our ads in the App Store, Apple’s AdServices framework gives the app a token that our server exchanges with Apple for the numeric identifiers of the campaign, ad group and keyword the install came from. We keep those identifiers on the installation record and, once you create an account, on the account. There is no permission prompt, we send Apple nothing about you beyond that token, and we use the identifiers only to know which of our ads bring installs. If you did not come from an ad, Apple answers that there is no attribution and nothing further is recorded.

4. What we use data for, and on what legal basis

Data about your contacts is processed on the basis of legitimate interest (Art. 6(1)(f)): your interest in maintaining your own personal relationships — the same interest that has always justified a personal address book or diary. That interest is balanced by strict limits we build into the product: your contacts’ data is private to your account, is never shared with other users or third parties, is never used for advertising, profiling, or any purpose other than providing the service to you, and is deleted the moment you delete it or your account.

5. Data about your contacts — your role

The people you add to Circles are your contacts: they are not users of the app and Circles has no relationship with them. You decide what to record about them, and you are responsible for that content.

• Write only what you’d be comfortable with them reading. Notes are private to your account, but they are personal data about real people.
• Sensitive information. Do not record special-category data about others (health, religion, political opinions, sexual orientation, etc.) unless you have a genuine personal reason tied to caring for that relationship. Such notes stay private to your account and are used for nothing beyond providing the service to you. Recording data about others in ways that harm them is prohibited by our Terms of Service.
• Their rights. If someone whose data a user stored in Circles contacts us to exercise their rights, here is what we do: we verify the request, and where the requester can be identified in the data at issue, we will delete or anonymize the data referring to them, informing the account holder where appropriate. Requests: circles@thisiscircles.com. We respond within one month.

6. AI processing (Anthropic Claude)

Circles uses Anthropic’s Claude API (a commercial AI service) for three things. Each one receives a different, deliberately limited slice of data:

• Contact suggestions — short, thoughtful prompts about how to reach out. To write them, your contact’s notes, relationship type, important dates and timing signals are sent to Anthropic. The contact’s name is deliberately never sent.
• Note summarization — merging your quick post-interaction notes into a contact’s notes. The notes being merged are sent; the name is not.
• The monthly letter — the letter that closes each month’s story. This is the most restricted of the three: Anthropic receives only structural signals — how many conversations you had and on which days, through which channel (call, message, in person), the contact rhythm you chose for each person and whether the month kept it, and whether you had marked time away. No notes, no relationship type, no important-date labels and no names are sent: every person is replaced by a placeholder token before the request leaves our server, and the real names are put back only after the letter comes back. This restriction is enforced by an automated test in our codebase.

For all three:

• Anthropic processes this data as our processor under a Data Processing Agreement and does not use it to train AI models.
• Anthropic processes data on infrastructure outside the EU (including the United States), under the safeguards described in §8, which also lists the other providers outside the EU.

Without an account (§3.3) the contact suggestion works the same way with one difference: the context travels from your phone through our server to Anthropic and back, and our server stores none of it — not the notes, not the dates, not the phrase. Only your phone keeps the phrase, for that day.

7. Who else processes data (sub-processors)

8. International transfers

Your application data is stored in the EU: on Railway’s servers in Amsterdam, and, for error events, in Sentry’s region in Frankfurt. Personal data leaves the EU and the UK in these cases:

• Anthropic (United States, §6): the Standard Contractual Clauses in Anthropic’s Data Processing Agreement, with supplementary measures — contact names are excluded from what we send, and transport encryption is enforced end-to-end.
• RevenueCat (United States, §7): the EU Standard Contractual Clauses (module two, controller to processor) and the UK International Data Transfer Addendum, both part of RevenueCat’s Data Processing Addendum.
• Expo (United States, §7): the Standard Contractual Clauses (module two) in Expo’s terms; Expo states it is certified under the EU-U.S. Data Privacy Framework and its UK Extension. It receives only your push token and a notification containing a number.
• Railway and Sentry are United States companies. Our data is stored in their EU regions, but they can access it from the United States for support and operations. Both Data Processing Agreements include the EU Standard Contractual Clauses (Decision 2021/914) and the UK addendum; Sentry also states it participates in the EU-U.S. Data Privacy Framework and its UK Extension.

9. Retention and deletion

• Your data lives as long as your account does. Everything you store remains available to you until you delete it or delete your account. We do not expire or clean up inactive accounts without notice.
• Account deletion is immediate and complete: deleting your account (Settings → Delete my account) permanently removes your account and all data in cascade — contacts, notes, interactions, schedules, away periods, AI suggestions, usage data. There is no soft-delete or recovery.
• Database backups exist solely for disaster recovery and expire automatically on a rolling basis: daily backups are kept for roughly one week, and a point-in-time recovery archive covers approximately the previous four weeks. Deleted data disappears from backups as they expire.
• Without an account, your people and history exist only on your phone: deleting the app deletes them. The installation record and its product events live on our server; once you create an account they belong to it and are deleted with it. An installation that never creates an account leaves behind only its random identifier, the version assigned, the app version, the store country, the Apple Ads identifiers if any, and its events — none of which identifies a person.

10. Your rights

Under the GDPR you can, at any time:

• Access the data we hold about you (the app itself shows essentially all of it).
• Rectify anything inaccurate (editable directly in the app).
• Erase your data (delete individual contacts, interactions, or your whole account in-app).
• Export / portability — request a machine-readable export of your data by email; we provide it within one month.
• Object to or restrict processing based on legitimate interest.
• Withdraw consent where processing is based on it.
• Complain to the AEPD (aepd.es), to the UK Information Commission’s Office (ico.org.uk) if you are in the United Kingdom, or to your local data protection authority.

To exercise any right you can’t action directly in the app, email circles@thisiscircles.com. We respond within one month.

11. Security

Data is encrypted in transit (HTTPS) and at rest. The notes you write about people are also encrypted at the application level, with a key stored outside the database. Passwords are hashed with bcrypt. Access to your data requires your authenticated session; accounts are strictly isolated from each other. We apply rate limiting, input validation, and server-side session revocation. Error monitoring is configured not to receive notes, emails, request bodies or local variables; the device’s IP address that Sentry infers for app errors is described in §3.3.

12. Children

Circles is not directed at children, and you must be at least 16 years old (or the minimum age of digital consent in your country, e.g. 14 in Spain) to create an account. We do not knowingly collect data from children as users. If your notes mention minors (e.g., a friend’s children), the responsibilities in §5 apply with special care.

13. Changes to this policy

We’ll post any changes here and update the date at the top. For material changes we’ll notify you in the app before they take effect.

14. Contact

circles@thisiscircles.com