PRIVACY POLICY

Last updated October 30, 2026

This Privacy Notice for Promise Abel-Adegbite (doing business as Cirlo) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://www.cirlo.app or any website of ours that links to this Privacy Notice
• Download and use our mobile application (Cirlo), or any other application of ours that links to this Privacy Notice
• Use Cirlo. Cirlo is a mobile app for keeping in touch with the friends you want to keep. You play short question games with them: one-to-one games with a single friend (each one is called a Duo), and group games in a Group, a private group you create or join with an invite link. In most games you see the other answers once you have answered yourself. You can also keep the people you care about as connections, sort them into groups called Circles, get a reminder when it has been a while, and look back on a monthly Recap and a year-end Yearbook, which your friends can sign with a note and, if they like, a photo. Cirlo is private by design: there is no public feed, and nothing you write is published.
• Engage with us in other related ways, including any marketing or events

Who is responsible for your data. The controller of your personal information is Promise Abel-Adegbite, an individual trading as Cirlo, PO Box #1, Lower Sackville RPO Superstore Mall, Nova Scotia, B4C 2S8, Canada. Email: privacy@cirlo.app.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@cirlo.app.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? We do not collect information about your racial or ethnic origin, religion, politics, health, sex life or sexual orientation, genetics or biometrics. We do host the messages you send to other people in the app, which California law treats as sensitive because we are not the person you are writing to. We never use it to work out anything about you, and never for advertising. Learn more about sensitive information under US state laws.

Do we collect any information from third parties? We do not buy personal information, and we do not obtain it from data brokers, marketing partners, or public databases. The only information we hold that did not come from you is information about the people you choose to save as connections, which comes from you rather than from them. Learn more about information we receive about other people and about our notice for people who are not Cirlo users.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by visiting https://www.cirlo.app/support, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect?

Review the Privacy Notice in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?
6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
14. WHO CAN SEE WHAT YOU PUT IN CIRLO
15. IMPORTING CONTACTS FROM YOUR PHONE
16. DELETING YOUR ACCOUNT, AND WHAT HAPPENS TO THINGS YOU SENT OTHER PEOPLE
17. ANALYTICS, ADVERTISING, AND NOTIFICATIONS IN THE APP
18. A NOTICE FOR PEOPLE WHO ARE NOT CIRLO USERS
19. DO WE MAKE UPDATES TO THIS NOTICE?
20. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
21. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short:

We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services,

express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names
• phone numbers
• email addresses
• usernames
• passwords
• contact preferences
• contact or authentication data
• profile photos and the city you add to your profile
• your birthday (day and month, with no year), if you choose to add it. Your connections can see it unless you set it to Only me
• your birth year, which we ask for once when you first open the app, and again before you join or create a Group if your account does not have one yet, so we can check that you meet our minimum age of 14. It is stored on your account, it is never shown to anyone, and it is never shared with your connections or with anyone else
• information about the people you add as connections, including their names, phone numbers, email addresses, photos and, if you import them from your phone and the contact card has one, their birthday
• notes, messages, and other content you create in the app, including notes you write about a connection, your chat messages and replies in Groups and Duos, your answers, votes, emoji reactions and photos in games, questions you suggest for a Group, the names of Groups you create, yearbook signatures, and notes on a friend's birthday card, including any photo attached to one
• a rhythm you suggest to a friend in a Duo, meaning how often you would like to catch up. The friend you suggest it to can see it
• your device's time zone, so reminders and game nights happen at a sensible hour for you
• invite links: if you create a link inviting someone to Cirlo or to a Group, we store the link, who made it, when it expires, and who joined with it
• Android beta sign-up: if you leave your email on cirlo.app/android to join the Android beta, we store that email address, the first name if you type one, whether you ticked the box asking us to email you, which page it came from, and when you signed up
• feedback and support requests you choose to send us, including your Cirlo account identifier, your platform, the app version and build, and the screen you were on
• safety records: if you block someone, we store the fact of the block on both sides so we can keep you apart. If you report someone or something, we store who reported, who or what was reported, the reason you chose, anything you typed, and, where you report a Yearbook signature, a birthday card note or something posted in a Group, a copy of the words you reported and, where the reported content has a photo, a copy of the photo. We keep that copy so the report still means something after the content itself is deleted

Sensitive Information. We do not ask for, and do not want, information about anyone's health, race or ethnicity, religion, politics, trade union membership, sex life or sexual orientation, genetics or biometrics, and we do not process any of it. Our Terms ask you not to record that kind of information about the people you save as connections. We cannot read what you type into a private note, so if you put it there anyway, we hold it without knowing, and you should not. Note that California law uses a wider definition of "sensitive" than this. See the table in the United States section below for how that applies.

Payment Data. Cirlo is free, and we do not sell anything in the app. We never receive or store your card number, security code, billing address, or any other payment details. Earlier versions of Cirlo offered a subscription called Cirlo+, sold as an Apple In-App Purchase. If you subscribed then, Apple still handles that subscription and its billing, and our subscription provider, RevenueCat, still tells us whether it is active and when it ends, identifying you to us only by your Cirlo account identifier. To cancel it, use your Apple ID subscription settings. You may find the relevant privacy notices here: https://www.apple.com/legal/privacy/ and https://www.revenuecat.com/privacy/.

Sign in with Apple or Google. You can create your account with an email address and password, with Sign in with Apple, or with Sign in with Google. These are the only third-party sign-in methods Cirlo offers. If you use Google, Google sends us an identifier for your Google Account, your email address, and the name and profile photo on that account. If you use Apple, Apple sends us an identifier for your Apple Account, an email address, and, on the very first sign-in only, the name you agree to share. Apple lets you hide your real email address and give us a private relay address instead; if you do that, we only ever see the relay address, and we will not share it with your connections even if you turn email sharing on, because mail sent to it by another person would not reach you. See "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" below.

Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

• Mobile Device Access. Cirlo asks your device for permission to use exactly three things, and only at the moment you first use the feature that needs them: your contacts, if you choose to import people from your address book; your camera and photo library, if you choose to add a photo to a game, a Yearbook note or a birthday card, set a profile picture, or save a card to your photos; and permission to send you notifications. We do not ask for your location, your microphone, your calendar, your reminders, your health data, or permission to track you across other companies' apps and websites. You can change or withdraw any of these permissions at any time in your device's settings.
• Mobile Device Data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model Internet service provider and/or mobile carrier, and Internet Protocol (IP) address (or proxy server). If you are using our application(s), we may also collect information about the phone network associated with your mobile device, your mobile device’s operating system or platform, the type of mobile device you use, your mobile device’s unique device ID, and information about the features of our application(s) you accessed.
• Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

What you have to give us, and what happens if you do not. None of this is a legal requirement. It is what the app needs in order to work. To create an account we need a first name and either an email address and password or Sign in with Apple or Google, and we ask for your birth year once to check you are at least 14; without these you cannot have an account. Everything else is optional and the app still works without it, though some parts of it will not: with no connections there is nothing to remind you about, with no contact methods there is nothing to reach out with, and with notifications switched off we cannot remind you at all. Your last name, your city, your photo, your birthday, and whether you share your phone number or email with your connections are entirely your choice, and phone number and email sharing are off unless you turn them on.

Information automatically collected

In Short:

Some information, such as your Internet Protocol (IP) address and/or browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
• Location Data. Cirlo does not collect your device location. We do not use GPS, we never ask for location permission, and the app ships without the system permissions that would allow it. The only location-related information involved is the rough area that our hosting and analytics providers can infer from your IP address, in the same way that any website you visit can. That is approximate, typically no more precise than a city or region, and we do not receive it as a location or store it as one.

Information we receive about other people

In Short: We do not buy personal information or obtain it from data brokers. The only information we hold that did not come from the person it is about is information about the people you choose to save as connections.

We want to be exact about this, because generic privacy policies often are not. We do not obtain personal information from public databases, data brokers, joint marketing partners, affiliate programs, or social media platforms. We do not enrich, append to, or supplement your record from any outside source. We do not build profiles of people who are not Cirlo users, and we have no way to contact them.

There is one situation in which we hold information about someone that we did not get from them, and it is the heart of what Cirlo does. When you save someone as a connection, whether you type their details in yourself or pick them from your phone's address book, you are creating a private record about another person and we store it for you. That record can contain their name, a phone number or email address you chose, a photo, the city you noted, the circle you put them in, when you last spoke, and any notes you wrote. The source of that information is you, not them.

If you are reading this because you found out that someone has saved you as a connection in Cirlo, the section "A notice for people who are not Cirlo users" near the end of this notice is written for you, and it explains what we hold and how to ask us to remove it.

Separately, if you sign in with Apple or Google, that provider sends us the limited account information described under "Sign in with Apple or Google" above. That is information about you, from a provider you chose to use, and they are the only third-party sign-in methods we support.

The 13 kinds of data the app collects

This is the same list we give Apple for the App Store privacy label. The app collects these 13 kinds of data, links them to your account, and uses none of them to track you:

• Contact info: your name, your email address and your phone number
• Contacts: the people you save as connections, including any you pick from your phone's contacts
• User content: your chat messages and replies in Groups and Duos, your photos, and other content you create, such as notes, answers, votes and reactions
• Identifiers: your Cirlo user ID and your device ID
• Usage data: product interaction, meaning which features you use in the app
• Diagnostics: crash data and performance data
• Other data: the remaining details of your account, such as your birth year and the optional birthday you choose to share

We use this data to run the app and to keep it working, not for advertising. Cirlo shows no ads, contains no advertising code, and collects no advertising data.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process the personal information for the following purposes listed below. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To honour a subscription from an earlier version. Cirlo is free and we no longer sell subscriptions. If you bought Cirlo+ in an earlier version, we process whether that subscription is still active until it ends. Apple takes the payment and handles refunds; we do not process orders, returns, or exchanges of any kind.
• To keep people safe. We process blocks, reports, and the content that was reported so we can act on abuse, keep blocked people apart, including inside Groups, and review a decision if you tell us we got it wrong. We review every report and act on it within 24 hours: we remove the content and block or remove the account responsible. This includes an automated check of any photo attached to a Yearbook note before it is saved.
• To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To send you occasional email about Cirlo. We hold two small mailing lists. The first is addresses collected before launch. We are not adding new addresses to it, and we do not sign you up to it when you create an account. The second is the Android beta list: if you leave your email at cirlo.app/android and tick "Email me when my invite is ready", we use that address only to email you about the Android beta, starting with a message when your invite is ready. If you do not tick the box, we do not write to you. You can leave either list at any time using the unsubscribe option in any email we send, at cirlo.app/unsubscribe, or by writing to privacy@cirlo.app. See "WHAT ARE YOUR PRIVACY RIGHTS?" below.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.
• To surface drift and send you reminders. We use the dates you last contacted someone and the cadence you set for their circle to work out who you may be drifting from, and to send you reminders and a suggested person to reach out to.
• To match your connections with other Cirlo users. We create a one-way hash of the phone numbers and email addresses you save for a connection and compare it with hashes of other users' verified details, so we can offer to link you if that person is already on Cirlo. We do not use these hashes for advertising.
• To run games in Groups and one-to-one games. We store your answers, replies, votes and reactions, show them to the other people in the game when that game's rules allow, pick the next question, and keep points, streaks and badges for your activity in a Group. A Group shows its top player each month and your own total. It never shows the full ranking.
• To send you account emails. We email you when you ask us to: a link to verify your email address, a link to reset your password, or a short code to confirm an email address you want friends to find you by. These are sent through our email provider, Resend.
• To check a new password is not a known leaked one. When you choose a password, the app checks it against a public list of passwords that have appeared in data breaches. Only the first five characters of a scrambled version of the password leave your phone, never the password itself. See section 4.
• To run birthday cards. If you share your birthday, we remind your connections a few days before it, let them write a note on your birthday card, with a photo if they like, and show you the card on the day.
• To create your Recap and Yearbook. We summarize your own activity, such as who you reached out to and when, to build your monthly Recap and your year-end Yearbook, and to let people you are connected with write a signature in your Yearbook, with a photo if they choose to add one.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
• Legitimate Interests. We may process your information when it is reasonably necessary to achieve a legitimate interest of ours or of another person, and that interest is not overridden by your interests or your fundamental rights and freedoms. The law allows a legitimate interest to belong to someone other than us, and two of the interests below belong to another person rather than to Cirlo. The specific interests we rely on are:
  • Holding the connections you save. To hold the limited details of the people you choose to save as connections, so that we can give you the private contact book the app exists to provide, and so we can tell you when someone you have saved is already using Cirlo. This is the core function of the Service and it is not possible to provide it without storing a record about another person. What we hold is minimised to what you selected, it is never used for advertising, it is never combined with information from any outside source, and it is never used to contact the person. See "A notice for people who are not Cirlo users".
  • Keeping a message in the recipient's own history. To keep something one person deliberately sent to another, a Yearbook signature or a Duo post, in the recipient's records after the sender closes their account. The legitimate interest here is the recipient's, not ours. It is their record of an interaction they took part in, and deleting it would destroy one person's keepsake because a different person closed an account. This is explained in full, including how to object, in "Deleting your account".
  • Keeping people safe. To operate blocking, reporting and moderation, including checking Yearbook photos for explicit, violent or racy content before they are saved and keeping a record of a report and of the content reported, so we can act on abuse and so a decision can be reviewed.
  • Keeping the Service working. To diagnose problems, prevent fraud and abuse, and protect the security and integrity of the Service.
  • Understanding how the app is used. To analyse aggregated, non-identifying usage so we can improve the Service.
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct.

The third parties we may share personal information with are as follows:

• Allow Users to Connect to Their Third-Party Accounts

Sign in with Apple and Sign in with Google

• Cloud Computing Services

Google Firebase

• Functionality and Infrastructure Optimization

Cloud Firestore, Cloud Storage for Firebase and Google Cloud Functions

• Image safety screening

Google Cloud Vision (SafeSearch), which checks a photo attached to a Yearbook note or a birthday card note for explicit, violent, or racy content before it is saved. It receives only the cleaned image, with no name, account identifier, or location. See "Who can see what you put in Cirlo".

• Invoice and Billing

Apple App Store and RevenueCat, for subscriptions bought in earlier versions of Cirlo only. We do no direct marketing and no lead generation.

• User Account Registration and Authentication

Firebase Authentication

• Web and Mobile Analytics

Google Analytics for Firebase

• Website Performance Monitoring

Crashlytics and Firebase Performance Monitoring

• Email delivery

Resend. It delivers the account emails you ask for: email verification links, password reset links, and the code that confirms an email address you want friends to find you by. Each of these contains the address it is sent to and, for verification and password reset, your first name. It also delivers two internal emails to us: one when you submit feedback from inside the app, which contains what you wrote, your account identifier, your platform and the app version, and one when someone files a report, which contains the reported account's identifier and the reason, but not who reported. It also sends the Android beta emails described in section 2 to people who ticked the email box on cirlo.app/android (the sign-up itself is stored in our Google Firebase database), and it holds a legacy mailing list of addresses collected before launch, which you can leave at cirlo.app/unsubscribe. We do not add new addresses to the legacy list.

• Website hosting

Vercel, which hosts cirlo.app and therefore receives the IP address and request logs of anyone who visits the website. The website itself sets no analytics or advertising cookies.

• Password safety check

Have I Been Pwned (Pwned Passwords). When you create or change a password, in the app or on our password reset page, we send the first five characters of a SHA-1 hash of the password, along with your IP address as part of the request. That is not enough to work out your password, and we send nothing else.

• Push notification delivery

Firebase Cloud Messaging and Apple Push Notification service. They carry what a notification shows, which can include a short preview of a message and a profile photo. See section 17.

• App integrity and abuse prevention

Firebase App Check, using Apple App Attest on iPhone and Google Play Integrity on Android

• Bot protection on the Android beta sign-up form

Google reCAPTCHA Enterprise, used through Firebase App Check on the Android beta page (cirlo.app/android). When you submit the sign-up form, it checks that you are a person and not a bot, using information about your browser and device and how you use the page, which is sent to Google. We only get a pass or fail result. The Google Privacy Policy and Terms of Service apply.

We also may need to share your personal information in the following situations:

• Police, child protection bodies and the law. We may share information with the police, courts and regulators where the law requires it, and with Cybertip.ca (the Canadian Centre for Child Protection) and, for US reports, the National Center for Missing & Exploited Children (NCMEC), where we find or are told about child sexual abuse material. We may also share it where we believe it is needed to protect a child or another person from serious harm. That can include a copy of the content reported to us and the details of the account that posted it. See our Child safety standards.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Other Users. When you share personal information (for example, by posting comments, contributions, or other content to the Services) or otherwise interact with public areas of the Services, that information is visible to the people you shared it with. Cirlo has no public areas, no feed, and no timeline, so your content is not broadcast to all users and is not made publicly available outside the Services. Other signed-in users who look you up can see only your limited public profile: your first name, username, profile photo, and avatar colors. Your profile photo is stored at a web address that anyone who has the address can open, which is how it appears on an invite page. People you are mutually connected with additionally see your last name, your city, your birthday if you share it, and the contact methods you publish. People in a Group you join see your first name, your profile photo, what you post in that Group, when you last opened it, and how many game nights you have played there. Your phone number and sign-in email are shared with your connections only if you turn those options on yourself. See "Who can see what you put in Cirlo" below.

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

In Short: We are not responsible for the safety of any information that you share with third parties that we may link to or who advertise on our Services, but are not affiliated with, our Services.

The Services may link to third-party websites, online services, or mobile applications and/or contain advertisements from third parties that are not affiliated with us and which may link to other websites, services, or applications. Accordingly, we do not make any guarantee regarding any such third parties, and we will not be liable for any loss or damage caused by the use of such third-party websites, services, or applications. The inclusion of a link towards a third-party website, service, or application does not imply an endorsement by us. We cannot guarantee the safety and privacy of data you provide to any third-party websites. Any data collected by third parties is not covered by this Privacy Notice. We are not responsible for the content or privacy and security practices and policies of any third parties, including other websites, services, or applications that may be linked to or from the Services. You should review the policies of such third parties and contact them directly to respond to your questions.

6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: Sign in with Apple and Sign in with Google are the only third-party sign-in methods we offer. They give us an account identifier, an email address, and a name (and, from Google, a profile photo). They do not give us a friends list, contacts, or anything from any social network.

You can create a Cirlo account with an email address and a password, with Sign in with Apple, or with Sign in with Google. There is no Facebook, X, or other social sign-in, and Cirlo does not connect to any social network account.

If you use Sign in with Google, Google sends us an identifier for your Google Account, your email address, and the name and profile photo on that account. Google never sends us your contacts, a friends list, or anything else from your Google Account. Google's privacy policy is at policies.google.com/privacy.

If you use Sign in with Apple, Apple sends us: an identifier for your Apple Account; an email address; and your name, but only on the very first time you ever sign in to Cirlo with that Apple Account, and only if you choose to share it. Apple never sends us a friends list, a profile picture, contacts, or anything you have posted anywhere else.

Apple lets you choose Hide My Email, which gives us a private relay address instead of your real one. If you do that, the relay address is the only email address we ever hold for you. It is also the reason we will not include your email address in what your connections can see, even if you switch email sharing on: mail that another person sent to that relay would not reach you, so publishing it would be a promise we could not keep.

If you delete your Cirlo account, we also ask Apple to revoke the sign-in token, so Cirlo stops appearing in the list of apps connected to your Apple Account.

We use what Apple or Google sends us only for the purposes described in this Privacy Notice. We do not control, and are not responsible for, Apple's or Google's own use of your personal information; Apple's their privacy notice is at apple.com/legal/privacy.

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own.

Cirlo is run by an individual, Promise Abel-Adegbite, based in Nova Scotia, Canada. Our servers are in the United States: Cirlo runs on Google Firebase, with the database in Google's multi-region North American location and our server code in Iowa. So if you are in the EEA, the UK or Switzerland, your information leaves your country. There are no other group companies (Cirlo is one person), so there are no intra-group transfers.

Because your information is stored and processed in the United States, courts, law enforcement and national security authorities there may be able to access it under United States law, in the same way Canadian authorities may under Canadian law. We only give anyone access where the law requires it.

These are the safeguards we actually rely on, rather than a generic statement:

• To Canada, where we are. The European Commission has decided that Canada provides an adequate level of protection for personal data handled by commercial organisations subject to Canada's federal privacy law, PIPEDA, and the UK recognises Canada in the same way. We are such an organisation, so no additional contract is needed for this leg.
• To the United States, where the servers are. Google LLC, which operates Firebase and Google Cloud Vision, is certified under the EU-US Data Privacy Framework, its UK Extension, and the Swiss-US Data Privacy Framework. Google's data processing terms also incorporate the European Commission's Standard Contractual Clauses as a further safeguard.
• To our other providers. Apple, RevenueCat, Resend and Vercel each process data under their own data processing terms, which incorporate the Standard Contractual Clauses or an equivalent approved mechanism where one is needed.

We do not hold a separately negotiated set of Standard Contractual Clauses of our own; the clauses that apply are the ones incorporated into each provider's terms, and we can point you to them on request.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We keep your personal information only for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer period is required or permitted by law. Most of what you create is kept until you delete it or until you delete your account. Some things have their own, shorter clock, and two things deliberately outlive your account. The specific periods are:

When we no longer have a reason to keep your personal information, we delete it or anonymise it. Where that is not immediately possible, for example because a copy sits in a backup, we isolate it from any further use until deletion is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to minors.

You must be at least 14 years old to use the Services. When you first open the app we ask for your birth year so we can check this, and we check it again before you join or create a Group. We store it privately on your account, we never show it to anyone else, and we never share it with your connections. Apart from the age check, the only other use is to show you your own age on your birthday card. You can correct it from your orb > Account > Account & Security. To change it to an earlier year, email support@cirlo.app. We do not knowingly collect, solicit, or market to children under 13 years of age, and we do not knowingly sell or share the personal information of anyone under 16 years of age. If you are between 14 and the age of majority where you live, you may use the Services only with the involvement and consent of a parent or legal guardian. Where the law of your country or region sets a higher minimum age for consenting to the processing of personal information (for example, up to 16 years of age in parts of the European Economic Area and the United Kingdom), you must be at least that age or have the consent of the holder of parental responsibility. If we learn that we have collected personal information from a child under 13, or from a user below the applicable minimum age in their jurisdiction, we will deactivate the account and take reasonable steps to promptly delete that information from our records. If you believe we may have collected information from or about a child, please contact us at privacy@cirlo.app.

If you live in the EU. The EU sets 16 as the age at which a child can agree on their own to an online service like this one, and each country may lower that to as low as 13. The age depends on your country. For Cirlo, if you live in the EU and you are under 16, you need a parent or guardian to agree to you using it, unless your country sets a lower age and you are at least that old. If you are a parent and think your child is using Cirlo without your agreement, email privacy@cirlo.app and we will close the account and delete the data.

Child safety. Cirlo has zero tolerance for child sexual abuse and exploitation. If we find it or are told about it, we remove the content and the account, keep a secure copy as the law requires, and report it to Cybertip.ca and the police, and to NCMEC where US law applies. How to report a concern, and what we do, is on our Child safety standards page.

Intimate images shared without consent. If a private or intimate picture of you was shared on Cirlo without your consent, you can ask us to remove it, and we remove it within 48 hours of a valid request. How to ask is on our Report an intimate image page. We use what you send only to find and remove the image and to answer you, and we do not tell the person who shared it who made the request.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section " HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

We will consider and act upon any request in accordance with applicable data protection laws, and we will respond within one month. If a request is unusually complex we may extend that by up to two further months, in which case we will tell you within the first month and explain why.

Automated decision-making. We do not make any decision about you by automated means that produces a legal effect or similarly significantly affects you, and we do not profile you for that purpose. Cirlo does work out a "drift" score for each of your connections from dates you recorded yourself, and uses it to decide who to remind you about and when. That counts as profiling in the sense the law uses, so we would rather name it than leave you to discover it: it is arithmetic on dates you entered, it produces a reminder addressed to you about your own address book, it has no legal or similarly significant effect on anyone, and it is never used for advertising or shared with anyone.

Objecting. Where we rely on legitimate interests, you can object at any time. Two places where this matters most are the record another user holds about you if you are not a Cirlo user (see "A notice for people who are not Cirlo users") and a Yearbook signature or Duo post you sent before deleting your account (see "Deleting your account"). Both sections explain how.

If you are located in the UK and are unhappy with how we have handled your personal information, you can make a complaint directly to us. This is in addition to the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018.

How to contact us:

• Online: https://www.cirlo.app/support
• Email: privacy@cirlo.app

What happens after you complain

• We will acknowledge your complaint within 30 days of receiving it.
• We will investigate without unjustifiable or excessive delay.
• We will keep you informed of progress and explain the outcome.

If you are not happy with our final response, you can refer your complaint to the Information Commissioner's Office, the UK supervisory authority.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Because we are based in Canada, you can also complain to the Office of the Privacy Commissioner of Canada, wherever you live.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section " HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below or updating your preferences.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications:You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, Emailing us at privacy@cirlo.app and asking to be removed from our mailing list, or by contacting us using the details provided in the section " HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. You will then be removed from the marketing lists. However, we may still communicate with you, for example to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account.
• Contact us using the contact information provided.
• In the Cirlo app, tap your orb > Account > Account & Security to delete your account, or Settings > Privacy to export your data.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

If you have questions or comments about your privacy rights, you may email us at privacy@cirlo.app.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not respond to DNT browser signals. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

Global Privacy Control and other opt-out preference signals. These signals exist to tell a business not to sell or share your personal information for targeted advertising. We do not sell or share your personal information and we do not run targeted advertising, so there is nothing for such a signal to switch off here. Our website sets no advertising or analytics cookies at all. If we ever started doing anything that one of these signals is designed to stop, we would honour the signal and we would say so here first.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of Personal Information We Collect

The table below shows the statutory categories of personal information we have collected in the past twelve (12) months. Where only part of a statutory category applies to Cirlo, we have said which part rather than answering a bare yes. For the full picture, see " WHAT INFORMATION DO WE COLLECT?"

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;
• Participation in customer surveys or contests; and
• Facilitation in the delivery of our Services and to respond to your inquiries.

We will use and retain the collected personal information as needed to provide the Services or for:

• Category A - As long as the user has an account with us, then 30 days
• Category B - As long as the user has an account with us, then 30 days
• Category C - Your birth year is kept for as long as you have an account with us, then 30 days
• Category D - Only for subscriptions bought in an earlier version: as long as the user has an account with us, then 30 days
• Category F - As long as the user has an account with us, then 30 days
• Category H - As long as you have an account with us, then 30 days. The working copy of a photo you add to a Duo or a game is deleted after about 60 days, but a copy of a Duo photo is saved to the Duo history of each person who took part and is kept until that person deletes their account. A photo attached to a Yearbook note is deleted with the note, or when either the book owner's or the signer's account is deleted, and a copy of a reported photo is kept for up to 180 days
• Category L - As long as you have an account with us, then 30 days, except a message you sent to another person, which stays in that person's own history. See "Deleting your account"

For the full retention table, including exports, safety records and Yearbook signatures, see "HOW LONG DO WE KEEP YOUR INFORMATION?" above.

Sources of Personal Information

We collect personal information directly from you, and, for the people you save as connections, from you and from the address book on your own device. We do not obtain personal information from data brokers, public databases, or social networks. Learn more in "WHAT INFORMATION DO WE COLLECT?".

How We Use and Share Personal Information

Learn more about how we use your personal information in the section, " HOW DO WE PROCESS YOUR INFORMATION?"

We collect personal information through the Cirlo app and through our website. Cirlo shows no ads and contains no advertising code, so we do not "sell" or "share" your personal information as California law defines those words, and there is nothing here for you to opt out of.

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, " WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months.

We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:

• Category A. Identifiers
• Category B. Personal information as defined in the California Customer Records law
• Category D. Commercial information
• Category F. Internet or other electronic network activity information
• Category H. Images
• Category L. Sensitive personal information, being your log-in credentials and the messages you send to other people, which are stored by our hosting provider so that we can deliver them to the person you sent them to

These disclosures are all to service providers acting on our instructions under a written contract, listed in "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" above. We did not disclose Category C (your birth year), and we have no Category G geolocation data to disclose.

The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to Exercise Your Rights

To exercise these rights, you can contact us by visiting https://www.cirlo.app/support,

or by emailing us at privacy@cirlo.app. You can also act on most of these rights yourself, inside the app: open Settings > Privacy to export a copy of your data, tap your orb > Account > Account & Security to delete your account, or edit your profile at any time to correct your information.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at privacy@cirlo.app. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?". For the avoidance of doubt, we do not disclose personal information to third parties for their own direct marketing purposes.

14. WHO CAN SEE WHAT YOU PUT IN CIRLO

Cirlo is not a social network and has no public feed. Most of what you put into Cirlo is private to you. The people you add as connections, the circles you sort them into, your notes about them, your contact history, and your drift reminders are visible only to you. Your Recap and your Yearbook are yours. A limited profile, consisting of your first name, username, profile photo, and avatar colors, can be seen by other signed-in Cirlo users who look you up, and it is how someone confirms they are connecting with the right person. Your last name, your city, your birthday (unless you set it to Only me), and your contact methods are shared only with people you are mutually connected with. Your phone number and your sign-in email are shared with your connections only if you switch those options on yourself; both are off by default. Content you deliberately send to another person, such as a Duo post or a signature in someone's Yearbook, is visible to that person. Anonymous accounts have no public profile at all.

Groups and games. A Group is a private group you create or join with an invite link. Groups are invite-only: there is no public list, and no way to search for one. Everyone in a Group can see the other members' first names and profile photos, and the questions, answers, replies, reactions and photos posted in that Group's games, following each game's rules: in most games you see the other answers only after you have answered yourself. In most games, votes are shown without saying who voted. In a few games, such as Hot take, where everyone picks a side, the result shows which side each person picked, by name. A one-to-one game works the same way between you and one connection. Members can share a result card for a finished game outside Cirlo. It shows the Group's name, the question, how many people answered and how the group split, without names and without anyone's written answers, and it carries the Group's invite link. If you block someone, we hide what they post in a shared Group from you, and what you post from them. They can still appear on the member list, so you can leave the Group or, if you made it, remove them. You can report anything posted in a Group from inside the app.

Invite links. You can create a link that invites someone to Cirlo or to a Group, and send it however you like. Anyone who opens a link to Cirlo sees your first name and profile photo, unless you turn off showing your name on invite links. Anyone who opens a link to a Group sees your first name and the Group's name, and in the app also how many people are in it, the current question, any message you added to the invite, and whether you have answered it. Anyone who has a Group link and a Cirlo account can join that Group, so share it only with people you want in the group. The person who made a Group can remove members and turn its links off. Group links stop working after 30 days. Your personal link to Cirlo works until you reset it.

Birthday cards. If you share your birthday, your connections, and people in your Groups who have saved you as a connection, get a reminder a few days before it, which names you and the day of the week. They can write a note on your birthday card, with a photo if they like. Their photo goes through the same metadata removal and automated safety check as a Yearbook photo. You see the notes, with the writer's name, on your birthday. A writer sees only their own note. You can report a note.

Rhythm. In a Duo you can suggest how often the two of you catch up. The other person sees your suggestion. Your drift reminders themselves stay private to you.

Yearbook signing links. During the Yearbook season you can create a link to your own Yearbook and send it to whoever you like. Anyone who opens that link can sign your Yearbook, even if they are not connected to you, and opening it shows them your first name and the year. This is the one place where something in Cirlo can reach beyond the people you are connected to, and it only happens because you chose to send the link. You can revoke the link at any time, and it stops working at the end of the season either way. Revoking a link does not remove signatures that were already written with it: you can delete any individual signature from your own Yearbook whenever you want.

Photos on Yearbook notes. Someone signing your Yearbook can attach one photo to their note, taken with their camera or picked from their photo library. Because anyone with your signing link can sign, this includes people you are not connected to, unless you turn off "Accept photos" for your Yearbook. This is what happens to the photo:

• Metadata is removed. Before a photo is saved, we re-create it as a new image. Details such as location, camera or phone model, and the time it was taken are dropped, and only the picture itself is kept.
• An automated safety check. The cleaned image is sent to Google Cloud Vision (SafeSearch), a Google Cloud service that works for us. It rates the image for explicit, violent, or racy content. If the image fails the check, or the check cannot run, the photo is not saved. The check only rates the image and does not identify anyone. No name or account identifier is sent with it. We do not look at photos ourselves unless someone reports one.
• Where it is stored and who can see it. The photo is stored under the book owner's account, with the note, and not under the signer's name. Only the book owner can see it in Cirlo, and the signer cannot look at it again in the app after sending. It is included in the signer's own data export if they request one. The one exception is sharing: if the signer signed with their name and allowed the note to be shared, the photo can appear on a share card the owner creates. Unsigned notes are never shareable.
• Unsigned notes. If a note is unsigned, we never tell the owner who sent it, and nothing in the photo file or its address names the sender. A photo can still show the sender's face or surroundings, and the sign screen tells them so before they send it.
• Deleting a photo. The photo is deleted when the book owner deletes the note, when the signer replaces the note, and when either the book owner's or the signer's account is permanently deleted. Blocking someone does not hide a photo they already sent, but you can delete that note at any time.
• Reported photos. If someone reports a photo, we keep a private copy for up to 180 days so we can review the report, and then it is deleted automatically. We keep it longer only if a legal hold applies, for example where a photo may show child sexual abuse.

What a signature keeps. If someone signs your Yearbook without showing their name, we never tell you who they were, and we do not give you any way to find out. If you delete a signature it is removed from your Yearbook and its text is cleared, and its photo, if it has one, is deleted too. You can also report a signature to us, which keeps a copy of the reported words, and of the photo if it has one, for our review even after you have deleted it. A copy of a photo is kept for 180 days at most, unless a legal hold applies.

15. IMPORTING CONTACTS FROM YOUR PHONE

If you choose to import contacts, Cirlo asks your device for permission and then reads the names, nicknames, phone numbers, email addresses, birthdays, and photo thumbnails in your address book so it can show you a list to pick from. That matching happens on your device. Cirlo never uploads your whole address book. Only the people you explicitly select are saved to your account, and for each of them we store their first and last name, every phone number and email address on their contact card, their birthday if the card has one, and their photo. There is a safety limit on how many connections one account can hold, and at most 100 can be sent in one batch.

If someone you are connected with on Cirlo only has a username as their name, and you have already allowed Cirlo to read your contacts, Cirlo may save the nickname you gave them in your phone's contacts as your private nickname for them. If there is no nickname there, it saves the name you have for them instead. It does this once, and only when their phone number or email matches a contact. The nickname is stored with your account, it is never shown to them or to anyone else, and you can change or clear it any time on their profile. If you clear it, Cirlo does not fill it in again.

Because a connection is a record about another person, you should only add people whose details you are entitled to keep, and you should not put information about them in your notes that they would not expect you to hold. Our Terms ask you not to record anything about their health, religion, politics, sexual orientation, or racial or ethnic origin.

Our servers also create a one-way hash of a connection's phone number and email address so we can tell you if that person already uses Cirlo. Those hashes cannot be reversed back into the original number or address, and we do not use them for advertising. The check runs in both directions: when someone new joins Cirlo, we compare their own verified phone number and email address against those hashes, and if there is a match we tell the person who saved them that their contact is now on Cirlo. We do not tell the person who joined who has them saved.

You can delete any connection at any time, which removes it and its hashes immediately.

If the person you saved is not a Cirlo user, we still hold a record about them, and data protection law gives them rights over it even though they have never used the app. We explain what we hold and what they can do about it in "A notice for people who are not Cirlo users" below.

16. DELETING YOUR ACCOUNT, AND WHAT HAPPENS TO THINGS YOU SENT OTHER PEOPLE

You can delete your account in the app: tap your orb > Account > Account & Security. When you do, you are signed out straight away and your account stays recoverable for 30 days in case you change your mind. During those 30 days your connections stop being linked to you and your username can be claimed by someone else after 14 days, but you stay a member of your Groups and what you posted there stays visible until the permanent deletion. If you sign back in within those 30 days, your orbit is restored. After 30 days a scheduled job permanently and irreversibly deletes your profile, your connections, your circles, your username, your connection requests, your Recap and Yearbook data, your uploaded files (including Yearbook photos you attached to other people's Yearbooks or received in your own), and your sign-in credentials. It also removes you from other people's accounts, clearing the link and the cached copy of your name and photo from their connection records, and it deletes what you posted in Groups, current and former: your answers, replies, reactions, votes, the questions you suggested, your invite links, and your membership. Photos you posted in games are removed by our automatic cleanup about 60 days after posting, and a Group picture you uploaded is deleted on request; see the retention table in section 8. An account you never saved with an email, Apple or Google is deleted automatically if it is not opened for a year. Apart from that, there is one exception, and it is deliberate.

Things you sent to other people

Some features let you send something to another person: a signature in their Yearbook, or a Duo post. A copy of that stays in the other person's own history and remains available to them after you delete your account. We do not delete it, because it is their record of an interaction they took part in, and deleting it would destroy one person's keepsake because a different person closed an account. This is the same principle as an email or a text message you have already sent: closing your account does not empty other people's inboxes.

Photos are the exception. If you attached a photo to a Yearbook note, the photo is deleted when your account is permanently deleted, even though the words of the note stay in the other person's Yearbook. It is also deleted if the other person deletes their account.

What we remove, and what stays. When your account is purged we strip the identifier that links that content to your Cirlo account. What is left depends on how you sent it. If you signed a Yearbook with your name shown, your first name stays attached, along with what you wrote. If you signed it anonymously, no name was ever stored, so nothing identifying you remains attached to it at all. We keep the first name on a signed entry because removing it would convert something you deliberately signed into an unsigned message, leaving the recipient with words from nobody, or worse, words that look like they came from the wrong person.

We do not claim this is anonymous. Removing the account identifier reduces what is held, but for a signed entry we treat what remains as still being personal information about you, and this Privacy Notice continues to apply to it.

Our legal basis for keeping it is legitimate interests, and the interest is the recipient's, not ours. UK and EU law expressly allows us to rely on a legitimate interest belonging to another person. We think the recipient's interest in keeping a message someone chose to write to them outweighs the sender's interest in removing it afterwards, particularly when the sender chose to send it and could have edited or replaced it at any time while their account was open.

If you disagree, you can object. You have the right to object to this, and we will not brush it off. Email privacy@cirlo.app telling us what you want removed and why. We will look at your case on its own facts rather than applying a blanket rule, and we will tell you what we decided and why. If the content is abusive, if it puts you at risk, or if the balance otherwise favours you, we will remove it. We do not make this self-service, and there is a reason: a sender who could silently withdraw a signature from someone's book on demand could use the result to work out who wrote an anonymous one, which is a worse outcome for everybody who signs a Yearbook.

One thing worth knowing before you delete. While your account is open you can edit or replace a Yearbook signature you wrote. Deleting your account is the one act that takes that ability away. If there is something you would rather soften or take back, do it before you delete.

17. ANALYTICS, ADVERTISING, AND NOTIFICATIONS IN THE APP

Analytics. Cirlo records product analytics only in the released app, never in development builds. These events are designed to contain no personal information: they use counts grouped into ranges, yes or no values, short labels, and screen templates rather than the actual screen you are on. We do not send names, phone numbers, email addresses, notes, search text, or the identifier of any specific person you track. The only identifier we attach is your Cirlo account id. Google's analytics and crash reporting tools also generate their own identifier for your installation of the app and collect standard technical details such as device model, operating system version and the country derived from your IP address. We also collect crash and performance diagnostics so we can fix problems. If you are in the European Economic Area, the United Kingdom or Switzerland, analytics, crash reports and performance data stay off until you choose Allow or No thanks on a one-screen "Help improve Cirlo" choice, and you can change your mind any time in Settings under Privacy. Advertising. Cirlo shows no ads. The app contains no advertising code, does not use the Apple advertising identifier, and does not ask for permission to track you across other companies' apps and websites. Crash reports can include the name of the screen you were on and our internal identifier for it. Notifications. If you turn on notifications, the messages we send are delivered through Apple and Google. They can include another person's first name, or the nickname you gave them, and their profile photo, the name and picture of a Group, a game's question, and a short preview, up to 100 characters, of a chat message or Duo reply someone sent you. A preview can appear on your lock screen, depending on your phone's settings. Answers in a game you have not played yet are never shown in a notification. On iPhone, the app lets your phone know who sent a message so it can show their name and photo the way it does for other messaging apps. You can turn notifications off entirely, or adjust them by category, in Settings.

Our website

Almost everything in this notice is about the app. The website at cirlo.app is deliberately plain: it sets no advertising cookies, no analytics cookies, and no tracking of any kind, apart from the bot check on the Android beta sign-up form described below, and there is no cookie banner because we have nothing optional to ask you about. Our host, Vercel, receives the IP address and request details of anyone who visits, in the ordinary way any web server does. An invite page loads the inviter's profile photo straight from Google's file storage, so Google receives your IP address too. The sign-in action page, which you reach from a password reset or email link, uses Google Firebase to do what the link asks, stores what it needs in your browser while it does, and checks a new password against Have I Been Pwned as described in section 4. That is strictly necessary for the page to work and is not used to track you.

The Android beta page (cirlo.app/android) has one more thing. When you press the button to join the beta list, the page loads Google reCAPTCHA Enterprise through Firebase App Check to check that you are a person and not a bot, so Google receives information about your browser and device and how you use the page, and may store a small token in your browser. We use it only to protect that form. The Google Privacy Policy and Terms of Service apply. The form itself saves your email, the first name if you type one, and your email choice, as described in sections 1 and 2.

18. A NOTICE FOR PEOPLE WHO ARE NOT CIRLO USERS

This section is for you if you do not use Cirlo and have found out that somebody has saved you as a connection. You do not need an account to read it or to act on it. It is also the notice required by Article 14 of the UK and EU GDPR, which applies when an organisation holds information about someone that it did not get from them.

Who we are

Cirlo is run by Promise Abel-Adegbite, an individual (a sole trader) based in Nova Scotia, Canada, trading as Cirlo. Our mailing address is PO Box #1, Lower Sackville RPO Superstore Mall, Nova Scotia, B4C 2S8, Canada. You can reach us at privacy@cirlo.app. We are the data controller for the information described here.

What has happened

Cirlo is a private address book. Somebody who uses it has chosen to save you as one of the people they want to stay in touch with. They either typed your details in or picked you out of the contacts already on their phone. Nothing was published, nothing was shared with anyone else, and no account has been created for you.

What we hold

Only what that person chose to save. Typically that is your name, the phone numbers and email addresses on the contact card they have for you, sometimes your birthday if their phone had it, and sometimes the photo their phone already had for you. It can also include a city, which circle they put you in, when they last spoke to you, and any private notes they wrote. Our servers also hold a one-way cryptographic hash of your phone number and email address, which cannot be turned back into the original, and which exists only so that we can tell that person if you ever join Cirlo yourself.

Where it came from

From the Cirlo user who saved you, and from the address book on their own phone. We did not buy it, and we did not get it from a data broker, a public database, a social network, or any other outside source.

What we do with it, and why we are allowed to

We store it so that the person who saved you can use their own address book, and so we can tell them if you join Cirlo. That is all. Our legal basis is legitimate interests: their interest in keeping a private contact book, and ours in providing one. We do not use your information for advertising, we do not profile you, we do not sell it, and we do not combine it with information from anywhere else.

Things we deliberately do not do

• We never contact you using what someone saved about you. Cirlo has no way of sending a message to the people its users save, and we have not built one. The only emails Cirlo sends go to an address that someone types in as their own, to verify it or reset a password.
• We never send invitations. A Cirlo user can choose to send you an invite link themselves, from their own phone, but Cirlo does not send it and does not use the details they saved about you to do so. The only person Cirlo ever tells anything is the person who saved you, and the only thing we tell them is that a contact of theirs has joined Cirlo, if you ever do. Nobody else is told that you exist in our systems, and you do not appear in any search, directory, or suggestion anywhere in the app.
• We do not build a profile of you, and we do not combine what one person saved with what anybody else saved.
• We do not use your information to serve advertising, and we do not disclose it to advertisers.

Why we did not write to you

The law normally expects us to contact you within a month of receiving your details, and it allows an exception where doing so would take disproportionate effort. We rely on that exception, and we want to be straight about the reasoning, because it is unusual for the exception to favour the person whose data it is.

The only way we could notify you is by using the phone number or email address a friend of yours saved, to send you an unsolicited message from a company you have never heard of. We would have to build an outbound messaging system we deliberately do not have, to do the exact thing this notice tells you we never do. Writing to you would be more intrusive than the storing we would be writing to tell you about. Instead we keep what we hold to a minimum, hash your contact details, never use them for anything else, never contact you, and publish this notice so that it is available to you whenever you want it. If you think we have the balance wrong, tell us: it is a judgement, and we would rather hear that we got it wrong than not.

Who else sees it

The person who saved you, and nobody else. Our service providers hold it on our behalf under contract: Google (Firebase) hosts our database and files, in the United States. It is not shown to other Cirlo users, it does not appear in any search or discovery feature, and it is not published anywhere.

How long we keep it

For as long as the person who saved you keeps the connection. It is deleted when they delete it, and it is deleted when they delete their account. We do not keep it independently of them.

Your rights, and how to use them

You have the right to ask us what we hold about you, to have it corrected, to have it erased, to restrict what we do with it, and to object to us holding it at all. Because we rely on legitimate interests, the right to object is the strongest one here, and it does not require you to give a reason.

Email privacy@cirlo.app. Tell us the phone number or email address you think has been saved, so we can find the record. That is the only way we can look you up, because we hold no other key. We will respond within one month.

Two honest limits. Because we are only holding somebody else's private address book entry, the practical result of an objection may be that we delete the record and tell the person who saved you that a contact was removed. And if you give us a phone number or email address to search for, we will use it only to run that search and to reply to you, and we will delete it afterwards.

There is no automated decision-making here, and nothing about you is profiled.

If you are not happy with our answer

You can complain to a data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk/make-a-complaint, 0303 123 1113). In the EEA it is the authority in your own country. In Canada it is the Office of the Privacy Commissioner of Canada.

19. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

20. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at privacy@cirlo.app.

Promise Abel-Adegbite, doing business as Cirlo
PO Box #1, Lower Sackville RPO Superstore Mall, Nova Scotia, B4C 2S8, Canada

I am the data controller for Cirlo. I am an individual, not a company. This is my mailing address for legal notices and for requests under data protection law. Email is faster, and I answer privacy requests within one month.

Cirlo is a one-person business, so the individual accountable for our compliance with privacy law, and the person responsible for the protection of personal information for the purposes of Quebec's Law 25, is Promise Abel-Adegbite, the owner, reachable at privacy@cirlo.app. There is no larger team behind that address, which means you are writing to the person who can actually decide. That address is also our data protection contact for the purposes of the laws of other countries, including Singapore.

Complaints. If you have a privacy complaint, write to privacy@cirlo.app. I will acknowledge it and answer within one month, and I will tell you what I found and what I did about it. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or, if you live in Quebec, to the Commission d'accès à l'information du Québec.

If something goes wrong. If personal information we hold is lost, accessed, or disclosed without authorisation, and it creates a real risk of significant harm to you, we will tell you and the relevant authorities as soon as we reasonably can, and we will keep a record of the breach. Depending on where you are, those authorities are the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Information Commissioner's Office in the UK, or your own supervisory authority in the EEA.

These Legal Terms sit alongside this notice and are available at https://www.cirlo.app/terms.

21. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please visit https://www.cirlo.app/support or email privacy@cirlo.app.