Your privacy, in plain language.

Every Circlo conversation is end-to-end encrypted following the design pioneered by the Signal protocol: X3DH key agreement to start a session, then a ratcheting session that advances as you talk. This is how the app works. There is no switch that turns it off, and a payload that is not encrypted is rejected by our servers.

How a message travels

1. 1The first time you open Circlo on a device, it creates a long-term identity key pair locally. Only the public half is uploaded; the private half stays encrypted on that device.
2. 2When you message someone, your device fetches their published prekeys and performs an X3DH key agreement, establishing a separate session for each of their approved devices.
3. 3Your message is encrypted with a key derived for that message from the session chain before it leaves the device. Our servers receive ciphertext, and store ciphertext.
4. 4The recipient's device derives the matching key and decrypts locally. Keys are never transmitted to us in a usable form.

Group conversations

Group messages use a sender key that is distributed to each member's approved devices separately, and rotated when membership changes. Someone who joins later cannot read what was said before they arrived, and someone who leaves or is removed cannot read what is said afterwards.

Your devices and your keys

A browser or phone becomes trusted only when a device you already trust approves it, by proving possession of its private key. To link a device, scan its short-lived, single-use QR code on a trusted device and compare the new device's key fingerprint before approval. The QR expires after three minutes and never contains private keys. Revoking a device removes its trust immediately, so it stops receiving keys. We hold an encrypted backup of your device key, so a returning browser can be restored — but the 32-byte secret that unlocks that backup is generated on your device and is never sent to us, which is why the backup is unreadable without it, including to us.

No one — not our engineers, not an administrator, not anyone with a court order — can read your encrypted conversations, because the keys needed to do so are never on our servers. The same fact has a hard edge: if you lose every trusted device and your recovery material, your earlier history cannot be recovered. We would rather say that plainly than offer a backdoor.

What encryption does not cover

• Your profile: display name, username, bio, avatar and links, which other people must be able to see.
• Group and community structure: names, avatars, membership, roles and admin settings.
• Status updates, which are stored in a readable form so they can be shown to your chosen audience and reviewed if reported.
• Conversation metadata: who is talking to whom, when, how often, and how large the messages are.
• Security and account data: sign-in history, device and browser labels, and approximate country.
• Anything you deliberately send to us, such as a report, a support message or a verification request.

Because we hold only ciphertext, we cannot build a searchable index of your conversations across the service, and notifications cannot show what a message said. A push notification tells you that a message arrived, not what it contains.

Verification. Our encryption design is documented in full, and the client is written so its cryptographic layer can be reviewed and replaced on its own. We have not yet published an independent third-party audit of that layer, and this page will say so plainly when we do.

We collect what a messaging service needs and no more, keeping content separate from metadata.

• Account and profile. Display name, username, email address, and anything optional you add such as a bio, avatar, phone number or links. Your password is stored only as a bcrypt hash with a per-account salt. We never store the password itself and we never email it to you.
• Encrypted content. Message text, captions, edits, reactions, attachments and voice notes. All of it is sealed on your device and stored as ciphertext alongside the wrapped keys that only the intended devices can open.
• Readable content you publish. Profile photos, group and community names and avatars, and status updates. These are processed and stored in a readable form because they have to be displayed to other people and can be reported.
• Security and device data. Sign-in timestamps and outcomes, IP address, browser and device labels, an approximate country derived from the network, active sessions, and the public keys of your encryption devices.
• Operational data. Sending rates and abuse signals such as excessive or duplicate sends, reports you file, and administrative actions, which we keep for accountability.
• Device permissions. Camera, microphone, files and notifications are requested only when a feature needs them, and used only for that feature.

This website and the app carry no advertising networks and no third-party behavioural analytics, and we do not build advertising profiles of you.

Encrypting content does not erase the fact that it was sent. Our servers necessarily see the envelope: which accounts are in a conversation, when a message or reaction was written, its size and type, who has opened it, and which devices are online to receive it. Delivering messages needs that information, and abuse prevention relies on it.

We use metadata to route messages, keep sessions and notifications working, rate-limit and block spam and abuse, and understand service health in aggregate. We do not sell it, and we do not use it to build advertising profiles.

• To provide the service: authenticating you, delivering messages to the right devices, syncing state, and showing your own data back to you.
• To keep it secure: rate limits, session management, same-origin request checks, device approval, and sign-in alerts.
• To prevent abuse: pattern-based signals such as sending rates, duplicate sends and reports, plus blocking. We cannot scan encrypted message content, and we do not try to.
• To support you: answering in-app support threads and resolving the account problems you raise.
• To meet legal obligations: responding to valid legal requests to the extent we are able, and keeping the audit records that make administrative actions accountable.

Where data protection law requires us to name a legal basis, we rely on the performance of our contract with you (operating the service), our legitimate interests (security, abuse prevention and service integrity), your consent (optional notifications, and anything you choose to publish), and compliance with legal obligations where they apply. We do not sell personal information, and we do not share message content or contact lists for advertising.

• With other users. People in your conversations receive the content you send, and their devices do the decrypting. People who can see your profile see the fields and activity signals your privacy settings allow.
• With the people who run Circlo. Administrators can see account records and conversation metadata, and can remove content that violates our terms — but what they remove is ciphertext they cannot read. Administrative actions require a fresh verification challenge and are written to an audit log.
• Legal requests. If we receive a valid request, we can produce account records, metadata and stored ciphertext. We cannot produce readable message content, because we do not hold the keys, and we will not weaken encryption for anyone. Where we are permitted to, we will tell you about a request that concerns your account.
• With service providers. We use a small number of processors under contract, each limited to what it needs to do its job. We never hand them your message keys.

Security is layered, and the encryption in section 1 is the outermost layer: the data most worth stealing is never stored in a form we could lose.

• Transport is encrypted in transit with TLS, and HSTS and a strict content security policy are enforced on the app.
• Passwords are stored as bcrypt hashes with per-account salts; sign-in, reset and sensitive actions are rate-limited.
• Sessions use HTTP-only, secure, same-site cookies, and state-changing requests are checked for same-origin.
• Consequential actions — deleting your account, revoking devices, resetting encryption trust — require fresh authentication and, when enabled, a second factor.
• Media lives in a private store. Every read is authorized through the app, and encrypted attachments are served as ciphertext only.
• Uploads that are meant to be readable are validated, scanned where a scanner is configured, and re-encoded so embedded metadata and scripts are discarded.
• Trust changes are recorded: device approvals, revocations and key rotations are visible in your encryption settings and in the audit trail.
• We reduce exposure by default: previews, transcripts and search work from data decrypted on your own device rather than from a readable server copy.

These live in your profile and take effect immediately.

• Access and portability. You can export your account information from your profile at any time, and download any single conversation as a JSON file. Encrypted messages are exported exactly as they are stored — as ciphertext — because the export runs on servers that cannot read them.
• Correction. You can edit your profile, contacts and settings yourself at any time.
• Deletion. You can clear a conversation, set messages to disappear, or delete your account permanently. Account deletion needs a typed confirmation plus fresh authentication.
• Objection and restriction. You can turn off read receipts, typing indicators, last-seen sharing and notifications, and you can block accounts at any time.
• Complaints. If you are in the European Economic Area, the United Kingdom, or another region with data protection authorities, you may complain to your local supervisory authority. We would appreciate the chance to put things right with you first.

• Account and profile data is kept for as long as your account exists.
• Messages and attachments stay until you delete them, until the conversation is deleted, or until a disappearing-message timer or retention cleanup removes them.
• Media that is no longer referenced by any message, status or profile is removed by a retention process once it is older than 24 hours.
• Status updates expire, and their media is deleted after they expire.
• Sign-in and security records are kept for a limited window so we can show you recent activity and investigate misuse.
• Administrative audit records are retained so that moderation and trust changes stay accountable.

Deleting your account removes your account data, the messages you sent and the encryption keys registered to you from the live database. Unreferenced uploads are eligible for cleanup after 24 hours; failed storage deletions are retried. Files still referenced by other users or groups remain. Limited security and moderation records may be retained for abuse investigation, and provider backups follow their configured lifecycle. Deletion does not erase a copy that another participant's device has already decrypted or downloaded. Read the account-deletion instructions before proceeding.

Circlo runs on the providers listed in section 5, in the United States and the European Union. Where personal data moves between regions we rely on appropriate safeguards such as standard contractual clauses, and each provider publishes its own transfer terms. To the extent we hold encrypted content at all, we hold ciphertext that cannot be read in any region.

Circlo is not intended for children under 13, or under a higher minimum age where local law sets one. We do not knowingly collect personal information from children below that age. If we learn that such an account exists we will remove it and its data, and a parent or guardian can contact us if they believe this has happened.

When our practices change, we update this page and its date. If a change materially affects what we collect or how encryption works, we will tell you in the app before it takes effect. Previous versions are available on request, so you can see exactly what changed.

Visit Circlo support for account access, reporting and the available contact options. You can request account deletion from your browser without installing the Android app. Do not send your password, verification codes or encryption recovery material with a request.