Privacy Policy

1. Who we are and what this Policy covers

This Privacy Policy explains how Mariia Tararova (OIB 17233930874), Primorska 8, 51000 Rijeka, Croatia, operating as CircleOK (“CircleOK”, “we”, “us”), processes personal data when you use the CircleOK iOS application, our websites, or related services (the “Service”). For the purposes of the EU General Data Protection Regulation (“GDPR”), Mariia Tararova is the data controller. It applies to users in the caregiver role, users in the older-adult role (in the app: “loved one”), and website visitors. The Service is intended for adults and is not directed to children (see Section 13).

Contact: privacy@circleok.app

2. What we collect — and what we deliberately do not

We designed CircleOK around data minimization. Here is the whole of it, at a glance — one row per thing you might do. The detail follows below the table.

In detail:

a. Account and profile data. A display name you choose, your selected role (caregiver or loved one), and an internal account identifier created when you first use the app. Registration does not require an email address or phone number. If you use optional account recovery through your Apple account, we process the identifier Apple provides for that purpose.

b. Circle data. Circle names, membership (who belongs to which circle, roles, join dates), and invite codes (stored in a form that lets us validate them; codes are single-use and rate-limited to prevent guessing).

c. Safety signals (the core of the Service). From the loved one’s device, with their consent: a coarse activity status (for example “activity detected today” / “no recent signal”), the time of the most recent signal, time zone, and simple non-numeric or bucketed activity indicators derived on the device (for example “steps present today”, “device was charged”, “device awake”). We also process device-permission states relevant to signal delivery (for example whether Background App Refresh is enabled), so both the loved one and the family can see why updates might be delayed. Optionally, CircleOK also compares today’s coarse activity or sleep pattern with the loved one’s own recent history — entirely on the device — and may share a simple relative label with the circle (for example “quieter than usual today”). This comparison is only ever against the loved one’s own past days, never a number, and never a comparison with anyone else’s data.

d. Moments (optional). Photos and short notes a user chooses to share with their circle. Moments are visible only inside that circle.

e. Device and technical data. Device model, operating system version, app version, language, time zone, push-notification tokens, and the network metadata (such as IP addresses) that our infrastructure providers process to deliver connectivity and security. Detailed diagnostic logs are stored locally on the device and reach us only if you choose to export and send them.

e2. Whether the daily check-in worked. A service that quietly stops working is worse than one that says it cannot: if the loved one's phone fails to send its signal, the family sees calm where there is no information. So the loved one's app reports a short technical record each time it wakes — what woke it, whether a signal was collected and sent, and the reason if it was not. It contains no location, no health values, and nothing about what the person was doing. We keep it 30 days. It stops entirely when sharing is paused or consent has not been given, and anything waiting to be sent at that moment is discarded rather than sent later.

f. Support communications. If you contact us, we process what you send us.

What we do NOT collect — by architecture, not just by policy:

• Location, only if you opt in. By default coordinates never leave the phone: location permission, if you grant it, is used by the operating system to wake CircleOK on the device after major place changes so it can send a fresh status. If — and only if — you enable “Share my place if my day goes quiet” in Settings, the app keeps one last-known place on our servers, private and invisible to everyone, revealed to your circle only while a 24-hour-silence alert is active, and deleted automatically when the alert clears, when you turn the setting off, or when the circle or account is deleted. Never a map, never a route, never continuous tracking.
• No raw health data. If you enable Apple Health signals, readings such as heart rate, sleep periods, or energy are read and evaluated on the device. Only coarse derived indicators (Section 2.c) are transmitted; any raw value is discarded by our servers and never stored.
• No continuous movement history, no route data, no audio, no camera access except when you actively take a photo for a Moment.
• In the app: no advertising identifiers, no third-party advertising or tracking SDKs, no cross-app tracking, no sale or renting of personal data — ever. This is a property of the build, not a promise about our intentions: the app ships with no such SDK linked into it. Our website is a separate matter and is described in full in Section 8.
• We do not use your personal data to train artificial-intelligence models.

3. Apple Health, Motion & Fitness (please read — this is health data)

If, and only if, you enable it, CircleOK reads a limited set of Apple Health and Motion & Fitness signals (such as steps, walking activity, heart activity, sleep, and energy) on your device to recognize that your day looks normal. In accordance with Apple’s requirements and our own rules:

• Health data is used solely to derive your activity status for the circle you chose. It is never used for advertising, marketing, analytics profiling, or data mining, and is never disclosed to third parties for such purposes.
• Raw values never leave your device (Section 2). Your family never sees numbers — only the derived status.
• You can turn Health access off at any time in the Apple Health app or in CircleOK’s settings; the Service keeps working with reduced signal frequency.
• Where GDPR applies, we process health-related data only on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give in the app before any health signal is used and can withdraw at any time in the app’s settings without affecting prior processing.

4. How we use personal data

• To provide the Service: create circles, validate invites, derive and deliver statuses, deliver push notifications to caregivers, show Moments within a circle, and provide support.
• To keep the Service safe: validate membership, rate-limit invite attempts, detect abuse, and secure our systems.
• To improve reliability: we use aggregated or de-identified technical metrics (for example delivery success rates). Diagnostics identifying you are used only when you send them to us.
• To comply with law and to establish, exercise, or defend legal claims.

We do not use data from the app for advertising, we build no marketing profiles about you, and we make no automated decisions that produce legal or similarly significant effects about you (see Section 14). Website advertising measurement is a separate, consent-based matter and never draws on app data — see Section 8.

5. Legal bases (EEA/UK)

• Contract (Art. 6(1)(b)): account, circles, status delivery, Moments.
• Explicit consent (Art. 6(1)(a) and, for health-derived data, Art. 9(2)(a)): Apple Health / Motion signals, and each optional permission. Consent is granular, and every permission can be declined or withdrawn while continuing to use the Service.
• Consent (Art. 6(1)(a)) for website advertising measurement, and for the corresponding storage on your device under the ePrivacy Directive as implemented in your country. Nothing non-essential is placed or read until you agree; you may refuse without losing any part of the site, and withdraw as easily as you agreed (Section 8).
• Legitimate interests (Art. 6(1)(f)): service security, abuse prevention, reliability diagnostics, and website analytics that store nothing on your device — balanced against your rights, and stopped on objection or on a Global Privacy Control or Do Not Track signal (Section 8).
• Legal obligation (Art. 6(1)(c)): where retention or disclosure is required by law.

6. Who can see what inside a circle

CircleOK is asymmetric by design: caregivers see the loved one’s status (and whether a delivery-critical permission is off); the loved one sees who is in their circle and controls sharing. The loved one can pause sharing or leave a circle at any time. Circle members are private individuals acting in a personal or household capacity; each member is responsible for using information from the circle only for the care purpose it was shared for.

7. Sharing with third parties

We do not sell personal data. We share it only with:

• Processors. Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging) hosts our backend. Our backend runs in the European Union (europe-west1). Apple delivers push notifications. Netlify hosts this website, Porkbun answers DNS for the domain, and Migadu carries email to and from our @circleok.app addresses. PostHog (analytics, EU region) and — where you have consented — Google (advertising measurement) also act as recipients for the website; see Section 8. Processors act under data-processing agreements and only on our instructions.
• Legal reasons. If required by law or to protect the rights, safety, or security of users or the Service.
• Business transfers. In a merger or acquisition, with notice to you.
• Aggregated/de-identified data that cannot reasonably identify you.

8. Cookies and trackers on this website

This section is about circleok.app only. The CircleOK app is a separate matter and contains no advertising or tracking SDKs at all (Section 2).

What is set, and why

We no longer record visits at all

Until 26 August 2026 our analytics could record a replay of a visit — the movements and clicks on a page. That is gone. Recording someone’s screen is exactly the kind of thing consent exists to protect, and we would rather not do it than ask for permission to. Nothing of the kind is collected now, and past recordings have expired under the 30-day limit that applied to them.

This page is still never measured at all, nor are our Terms or Support pages. Reading a privacy policy should not itself be observed.

What remains is a count of page views. It has no connection to the app, to your circle, or to anyone’s status — those never pass through PostHog.

Changing your mind

Use the “Cookies” link at the bottom-left of any page. Withdrawal is one click, is as easy as consent was, and takes effect immediately — the page reloads so that anything you switched off genuinely stops running, rather than merely being asked to stop. To stop the cookieless analytics as well, turn on Do Not Track or Global Privacy Control in your browser; we honour both.

8a. If you leave your address on this website

Two things on this site ask for something. The early-access form takes an email address and a separate, explicit tick: we write to you when CircleOK is ready, and nothing else. The short survey takes whatever you choose to answer about what worries you — closing it without finishing sends nothing at all. Both are handled by Netlify, which stores the submissions for us, and the notification reaches us by email through Migadu.

This is consent under Art. 6(1)(a), given separately from accepting the Terms, and you can take it back at any time: reply “stop” to any email we send, or write to privacy@circleok.app. We keep an address only until you unsubscribe or ask us to delete it. Neither form has anything to do with the app: an address left here is not an account, and it is never joined up with a Circle.

9. International transfers

Our primary data residency is the EU: the app’s backend runs in europe-west1, and everything the app itself collects stays there. Four services sit wholly or partly outside it, and all four relate to the website or to email rather than to the app’s own data:

• Google (United States) — advertising measurement on the website, only if you accept it. Transfer basis: Standard Contractual Clauses and the EU–US Data Privacy Framework. The app’s own backend is a separate Google service and runs in the EU.
• Netlify (United States) — hosts this website and serves it from the content delivery network node nearest you, which may be outside the EEA. What travels is what any web server sees: the page you asked for, your IP address, and your browser’s own headers. Transfer basis: Standard Contractual Clauses in Netlify’s data processing addendum.
• Migadu (Switzerland) — email sent to and from @circleok.app addresses, including support correspondence and messages sent through the contact form. Switzerland is covered by a European Commission adequacy decision, so no additional safeguard is required.

Where any processor transfers data outside the EEA/UK we rely on the European Commission’s Standard Contractual Clauses, an adequacy decision, the EU–US Data Privacy Framework where the recipient is certified, or another valid transfer mechanism. This section says where the data is today rather than where we would like it to be.

10. When your data reaches us from a family member

A circle is usually created before the older adult has the app: a family member types the name they use for that person, their relationship, and a phone number kept only on the family member's own device. So the first data we hold about an older adult can arrive from someone else, under Art. 14 GDPR. It is limited to that name and relationship, it is visible to the circle that person is being invited to, and when the invitation is never accepted the circle and its invitation expire and are removed. Once the older adult installs CircleOK, they can change or delete this information themselves, and they are shown what is shared before anything is switched on.

11. Retention

• Account, profile, and circle data: for the life of your account, then deleted within 30 days of account deletion.
• Records needed to demonstrate consent and compliance — the version and time of your acceptance of the Terms and of each consent, and technical logs showing whether an alert was dispatched — are kept in minimal form for as long as legal claims relating to the Service could be brought (Art. 6(1)(f) and Art. 17(3)(e) GDPR), and are used for no other purpose.
• Safety signals and statuses: we keep the current status and a limited recent history (up to 30 days); older entries are deleted or de-identified.
• Moments: until you delete them, you leave the circle, or the account is deleted.
• Support correspondence and records we must keep by law: as required by the applicable statute.
• Accounts nobody uses any more: if an account shows no activity at all for 24 months, we delete it and its data. We send a notification about a month beforehand, and simply opening the app is enough to keep the account — the countdown starts again from that moment. Where the account belongs to someone in a shared Circle, the Circle is preserved for the others in the same way it would be if that person deleted their account themselves.

Deleting your account in the app (Settings → Account) triggers server-side deletion of your account, circle memberships, signals, and Moments, subject only to legally required records.

What you must give us, and what happens if you do not. Providing data here is neither a legal requirement nor something a statute obliges you to do. To operate an account at all we need a display name and the account record itself — without those the Service cannot be provided, which is a contractual necessity under Art. 6(1)(b). Everything else is optional: refusing activity data, Apple Health, location, or notifications does not close your account and does not remove you from a circle. It only makes the corresponding feature stop working — for example, without activity signals the family sees no status, and without notifications they are not told about a long silence.

12. Your rights

Depending on where you live, you have the right to access, correct, delete, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time (without affecting prior processing). The fastest paths: deletion — in-app account deletion; consent withdrawal — the app’s Data & Permissions screen; anything else — privacy@circleok.app. We may verify your identity before acting and will respond within statutory deadlines. EEA/UK users may complain to their supervisory authority; in Croatia this is AZOP (Agencija za zaštitu osobnih podataka), Selska cesta 136, 10000 Zagreb. Residents of US states with privacy statutes (California, Colorado, Connecticut, Virginia, and others) have the corresponding state rights; note that we do not sell personal data or process it for targeted advertising. We honour Global Privacy Control signals on this website: a browser that sends one is treated as having refused analytics and advertising, and is not asked again.

Telling us to stop. Some of what we do rests on our own legitimate interest rather than your consent — keeping the service secure, preventing abuse, and diagnosing why alerts fail to arrive. You can object to any of that at any time, on grounds relating to your situation, by writing to privacy@circleok.app. We then stop unless we can show compelling legitimate grounds that override your interests, and we will explain our reasoning to you rather than simply refusing.

13. Children

The Service is not directed to children, and CircleOK is built for adults looking after adults. To use CircleOK at all — in either role — you must be an adult under the law of the country you live in (18 in most of Europe, including Croatia). One threshold, the higher one, replaces the mix of ages that used to sit here: both roles accept the Terms, and both make decisions that touch another person's data. We do not knowingly collect children’s data; if you believe a child has provided data, contact privacy@circleok.app and we will delete it.

14. Automated processing — honest description

CircleOK’s status classification is a simple, transparent rule set over coarse activity indicators and elapsed time (for example, “no signal for 24 hours → alert”). The optional activity/sleep trend feature (Section 2.c) works the same way: a statistical comparison (a median and typical range over recent days) computed on the device, not a machine-learning model, and not trained on or compared against other users’ data. It produces no legal or similarly significant effects: it informs family members, who decide what to do. It is not a high-risk AI system within the meaning of the EU AI Act. We will update this section if that ever changes.

15. Security

Data is encrypted in transit; backend access is restricted by role-based rules; invite codes are rate-limited; clients cannot read other circles’ data. No system is perfectly secure — please protect your device passcode, and tell us at privacy@circleok.app if you suspect a breach. Where a breach creates risk to you, we will notify you and the competent authority as the law requires.

16. Changes and contact

We will post updates here and change the date above; material changes will be announced in the app, and, where the law requires, re-consented.