Privacy Policy
Draft revision: 2026-11-09. Effective date: pending operator and counsel approval. This draft describes Circava's current product behavior. The operator identity, final contact, retention periods, and jurisdiction-specific notices still need approval.
Circava in plain language
- Circle content is intended for authorized members, not a public feed.
- Circava uses account and Circle data to provide the service.
- AI processes text only when an eligible user requests a suggestion and the feature is configured.
- Settings provides Circle export and account or Circle deletion controls, with the limits described below.
Information Circava processes
Account and Circle: email address, authentication identifiers, display name, settings, membership and Admin roles, invitations, and the active Circle preference. Circava does not ask for date of birth in the current signup flow.
Shared experiences: Tradition and Occurrence details, plans, tasks, activities, memories, recipes, stories and interviews, reflections, lessons, votes, notes, and content you and other members choose to add. Private Storage holds uploaded photos and documents. Authorized Circle members may see content shared in their Circle. The service does not put that content in a public discovery feed.
Technical and service records: authentication/session cookies, an active Circle preference cookie, operational logs, and provider request data such as IP address and browser information processed to run and secure the service. Circava does not currently use a marketing analytics cookie. The need for any jurisdiction-specific cookie notice remains for counsel to assess.
Product signals and beta feedback
First-party product events record action names and timestamps, with internal user or Circle IDs for signed-in actions. Public marketing actions are counted by day. Event records do not include Circle names, memory or recipe text, photos, search terms, email addresses, or invitation tokens. This helps understand use and diagnose product problems. Feedback you choose to submit includes your message and category plus limited context such as environment, build version, Settings route, timestamp, and your account/Circle identifiers. Do not include passwords, invitation tokens, or private Circle content in feedback.
Messages, payments, and AI
Supabase Auth handles account confirmation, email change, and recovery messages; custom SMTP is planned for staging verification. When configured, Resend handles Circle invitations and optional occurrence or preparation reminders. Settings lets you turn off optional reminders; account and security messages are separate. Circava does not currently operate a marketing email campaign.
Stripe would process payment details if paid billing is enabled. Circava stores subscription and Stripe customer or subscription identifiers and status, not full card numbers. Live paid checkout is not enabled for the initial beta.
If optional AI is configured and an eligible user requests it, Circava sends the text entered for planning or reflection, with instructions, to OpenAI for a proposed response. It does not automatically send a Circle's full history, photos, or recipes. The user reviews suggestions before saving; manual workflows remain available. Provider retention or training terms need separate review before enabling the feature for external users.
Providers and access
Supabase supplies authentication, database, and private Storage; Vercel hosts the app; Resend is used for app mail when configured; Stripe processes payments when billing is enabled; OpenAI processes optional AI requests when configured. These providers may process the information needed for their functions. Provider locations, agreements, and international transfers require operator and counsel review.
Circle access is checked against membership using database rules. Private media uses restricted Storage access and signed links. No security control guarantees absolute protection. Circle Admins choose whom to invite and manage members; an invited person who joins can see content shared in that Circle.
Export, account deletion, and Circle deletion
A Circle Admin can download a JSON export of Circle records. It includes signed media URLs that expire after one hour; it does not bundle the media bytes. The export is subject to a size limit. An authenticated user can request account deletion in Settings. Active billing or being the final Admin of a Circle must be resolved first. The current flow removes sign-in and memberships and changes the retained profile display name to “Former member”; content previously contributed to shared Circles may remain available to those Circles.
An Admin can request deletion of a Family or Group Circle. The request can be canceled during a seven-day waiting period while pending. After that, an operational job removes Circle Storage objects and the Circle data. Processing can fail and be retried, so seven days is a waiting period, not a guaranteed completion time. Copies in backups and provider logs may persist for periods that have not yet been approved.
Retention, children, and requests
Live Circle data remains while the Circle exists unless removed through a supported flow. Exact retention periods for logs, analytics, feedback, email records, and backups have not been set in this draft. We will not claim immediate deletion from every backup. Circava has no child-account, date-of-birth, or parental-consent workflow. Adults may choose to add stories or photos involving children; a minimum account age and children's-content policy need operator and counsel review.
You can change profile and reminder settings and use the export or deletion controls described above. The final process for access, correction, deletion, and other applicable privacy requests, including response times and identity checks, needs approval. A monitored privacy contact is still required. See Help for current guidance.
We should communicate material changes to this policy before they take effect. The notice method, effective date, and any renewed acceptance process remain under review.