MyCircle — Privacy Policy
This Privacy Policy explains how Rui Almeida, a sole individual operator based in Portugal, trading as MyCircle ("MyCircle", "we", "us", "our"), collects, uses, shares, retains, and protects your personal data when you use the MyCircle mobile application and related services (collectively, the "Service").
We take your privacy seriously. This policy is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Portuguese Data Protection Act (Lei n.º 58/2019), the California Consumer Privacy Act of 2018 as amended by the CPRA (CCPA/CPRA), the UK GDPR, and other applicable privacy laws.
If you do not agree with this policy, please do not use MyCircle.
1. Who is the data controller?
The data controller for the purposes of GDPR Article 4(7) is:
- Operator: Rui Almeida (individual natural person, established in Portugal)
- Country: Portugal
- Contact email for privacy matters: mycircle.app.2026@gmail.com
- Website: https://mycircle-page.vercel.app
MyCircle is operated as an independent personal project by a single natural person. There is no parent company, no group of companies, and no formal data-protection officer (DPO). Because of the scale and nature of the processing, MyCircle is not legally required to appoint a DPO under Article 37 GDPR. You may contact the operator directly at the email above for all privacy-related matters.
2. A summary in plain language
Before the formal sections below, here is the short version of what we do and do not do:
- We collect the minimum amount of personal data we need to make MyCircle work: who you are, your approximate or precise location, the content you post, and a small amount of technical data from your device.
- We do not sell your personal data, ever, to anyone, for any purpose.
- We use your location to show you nearby people, posts, Moments, and events. You can switch to approximate location at any time, or revoke location permission entirely through your device settings.
- We share data with a small set of infrastructure providers (Supabase, Google Cloud, Apple, Expo, Sentry) and with advertising and ticketing partners we name in §6. They process data on our behalf or, where they decide their own purposes, become independent controllers (Google AdMob, Apple Sign-In, the Ticketing Partners). Our primary backend is hosted in the United States (Supabase, us-west-1), so your data is transferred to the U.S. under the safeguards described in §7.
- You can delete your account and all your data at any time, with one tap, from inside the app. We will not ask you why. See §10.
- We use Google AdMob to show ads. In the EU and the UK we ask for your consent through Google's Consent Management Platform before any personalised ads are shown.
- MyCircle is strictly 18+. We do not knowingly collect data from anyone under 18.
3. What personal data we collect
We collect the categories of personal data listed below. Where the legal basis is "consent", you can withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.
3.1 Data you give us when you register or use the app
| Category | Examples | Why we need it | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Identifiers | Email address, username, display name | Account creation, login, identifying you on the platform | Performance of contract (6(1)(b)) |
| Profile data | Date of birth, gender, city, avatar photo, bio | Verifying 18+ eligibility, personalising the feed, displaying your profile to other users | Performance of contract; legitimate interests for age verification (6(1)(b), 6(1)(f)) |
| Location data | GPS coordinates (precise or snapped to a ~1 km grid) | Showing nearby people, posts, Moments, events | Consent (6(1)(a)) — you grant location permission at the OS level |
| User content | Posts, Moments, captions, comments, likes, messages in Circles and DMs, saved events | Operating the social features | Performance of contract (6(1)(b)) |
| Social graph | Friend requests, accepted friendships, blocks, reports you file, Circles you join | Operating the social features and the safety features | Performance of contract; legitimate interests for safety (6(1)(b), 6(1)(f)) |
| Communications | Emails you send us, in-app reports, appeals | Customer support, safety triage | Legitimate interests (6(1)(f)) |
3.2 Data we collect automatically
| Category | Examples | Why we need it | Legal basis |
|---|---|---|---|
| Technical / device data | Device model, OS version, app version, language, time zone, push token (when push is enabled), crash and error logs (collected via Sentry — see §6.1), build identifier used for over-the-air updates (delivered via Expo — see §6.1) | Running the app, debugging, security, delivering app updates between store releases | Legitimate interests (6(1)(f)) |
| Authentication data | Session tokens, refresh tokens, login timestamps, IP address at login | Keeping you logged in securely | Performance of contract; legitimate interests for security (6(1)(b), 6(1)(f)) |
| Usage data | Which screens you open, which features you use, approximate session length | Improving the app | Legitimate interests (6(1)(f)) |
| Advertising identifiers | IDFA on iOS (only after you accept the App Tracking Transparency prompt), Google Advertising ID on Android | Showing ads through AdMob | Consent (6(1)(a)) — collected only after you opt in via ATT / UMP |
3.3 Data from third parties
If you sign in with Google or Apple, we receive your email address and (for Google) your name and profile picture. We do not receive your password, your contacts, or any other information from those providers.
3.4 Sensitive data
MyCircle is not designed to collect special-category data under Article 9 GDPR (health, religion, ethnicity, sexual orientation, political opinions, biometrics, etc.). If you voluntarily include such information in your bio, posts, or messages, you do so on your own initiative and you consent to its processing for the purposes set out in this policy.
4. How we use your personal data
We use personal data only for the purposes for which it was collected, namely:
- To operate the Service — register your account, authenticate you, store and display the content you post, deliver messages, surface nearby users and events.
- To personalise your experience — sort the feed by proximity, age band (±5 years by default), and social context.
- To keep MyCircle safe — run automated content moderation (Google Cloud Vision SafeSearch), enforce blocks, process reports, detect spam, prevent fraud, and respond to safety incidents.
- To communicate with you — send transactional emails (email confirmation, password reset, security alerts), respond to your support requests, notify you of changes to this policy.
- To show ads — display banner ads through Google AdMob, subject to your consent in the EU/UK. We share only the minimum data needed for ad delivery (see §6).
- To monetise event listings — when you tap "Buy Tickets", we redirect you through an affiliate-tracking URL so that the Ticketing Partner can attribute the sale to MyCircle and pay us a commission. We do not pass your name, email, or any other personal data through the affiliate link — only an opaque click identifier.
- To improve the Service — analyse aggregated, anonymised usage to fix bugs and design better features.
- To comply with law — respond to lawful requests from public authorities, enforce our Terms of Service, and defend our legal rights.
We will not use your personal data for any new, materially different purpose without first notifying you and, where required, obtaining your consent.
5. Location data — special section
Because location is central to MyCircle, we explain its processing in more detail.
5.1 Why we need it
MyCircle is, by design, a proximity-based social-discovery app. Without your location we cannot surface nearby people, Moments, posts, or events. Location is the core feature, not an optional add-on.
5.2 What we collect
Your most recent location point at the time the app refreshes a discovery feed. We do not maintain a continuous tracking trail. We do not collect location data in the background unless you explicitly grant the "Always" permission (which we do not currently request).
5.3 Precise vs. approximate
In Settings → Privacy → Location accuracy you can choose between:
- Precise — your real GPS coordinates, accurate to the device's GPS resolution.
- Approximate — your coordinates snapped server-side to a ~1.1 km grid (rounded to 2 decimal places). This dramatically reduces the precision visible to other users while still allowing discovery within a city.
Posts and Moments you create are also tagged with a location stamp that respects your accuracy setting at the time of posting.
5.4 Who sees your location
- Your distance (e.g., "3 km away") is shown to other users on people, post, and Moment cards within your selected discovery radius.
- Your exact coordinates are never shown to other users.
- Your location is never sold and is not shared with advertisers.
5.5 Turning it off
You can:
- switch to Approximate in the app at any time;
- toggle the OS-level location permission off entirely in your device settings (iOS or Android);
- stop sharing entirely by deleting your account.
Disabling location will leave the discovery features empty. The rest of the app (your friends, your Circles, your DMs, your profile) will continue to work.
5.6 Legal basis
We rely on your consent under Article 6(1)(a) GDPR, given by granting location permission at the OS level. You can withdraw consent at any time as described above. Consent withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
6. Who we share your data with
We share your personal data only as described below. We do not sell personal data and we have not sold or shared personal data for cross-context behavioural advertising in the meaning of the CCPA/CPRA in the preceding twelve months, except as described under "Advertising" below.
6.1 Processors acting on our behalf (Article 28 GDPR)
These providers process personal data on our written instructions, under a data-processing agreement that meets Article 28 requirements:
| Processor | Role | Data location |
|---|---|---|
| Supabase, Inc. | Backend infrastructure: database, authentication, storage, edge functions, realtime | United States (us-west-1, Northern California) |
| Google Cloud Platform (Cloud Vision API) | Automated content moderation of uploaded images and videos | Processed in transit; not retained by Google beyond the API call |
| Expo, Inc. (Expo Application Services) | Build infrastructure and over-the-air (OTA) updates to deliver app updates between store releases; push-notification infrastructure (planned, not yet active in V1). Expo receives a build identifier and your device's OS version to deliver the correct update. | United States |
| Functional Software, Inc. (Sentry) | Crash and error reporting — detecting and diagnosing app crashes and runtime errors. When an error occurs, we share with Sentry: your user identifier (UUID only, no email or name), device model, OS version, app version, IP address (briefly, for delivery routing only — not retained for analytics), and the technical context of the error (stack trace, breadcrumbs, app state at the time of the crash). | United States |
| Apple Inc. | iOS push notifications (APNs) — planned, not yet active in V1 | United States |
| Google LLC | Android push notifications (FCM) — planned, not yet active in V1 | United States |
6.2 Independent controllers we share data with
These third parties decide the purposes and means of their own processing. When you interact with them, their privacy policy applies in addition to ours:
| Party | When we share | What is shared | Their policy |
|---|---|---|---|
| Google AdMob | While you use the app and ads are shown | Advertising identifier (IDFA / Google Advertising ID), coarse IP-derived location, ad interaction signals, consent string | policies.google.com/privacy |
| Google Sign-In | If you sign in with Google | Your Google email and basic profile, returned to us by Google | policies.google.com/privacy |
| Apple Sign-In | If you sign in with Apple | Your Apple Relay email and a unique Apple identifier | apple.com/legal/privacy |
| Ticketing Partners: SeatGeek, TicketNetwork, StubHub, viagogo | When you tap "Buy Tickets" and are redirected to their site | An anonymised click identifier through our affiliate-tracking partners (currently Impact.com, with Partnerize Ltd. as a secondary network) — we do not transmit your name, email, or any directly identifying personal data; any information you then enter on the Ticketing Partner's site (payment, address, etc.) is collected directly by them | Each partner publishes its own privacy policy on its own site |
| Impact.com (Impact Tech, Inc.) | Affiliate-link tracking (primary network) | Click identifier, referrer, partner program ID | impact.com/privacy-policy |
| Partnerize Ltd. | Affiliate-link tracking (secondary network) | Click identifier, referrer, partner program ID | partnerize.com/privacy |
6.3 Other recipients
- Public authorities and law enforcement — when required by valid legal process (court order, subpoena, lawful production order) or when we believe in good faith that disclosure is necessary to protect the safety of any person, to detect or prevent a crime, or to enforce our Terms.
- A successor entity — if MyCircle is transferred, sold, merged, or reorganised, your personal data may be transferred as part of that transaction, subject to the same protections set out in this policy.
6.4 What we never do
- We never sell your personal data to data brokers, marketing networks, or any other third party.
- We never share your precise location with advertisers.
- We never share your messages, DMs, friend list, or social graph with advertisers.
- We never share your photos or videos with advertisers.
7. International transfers
MyCircle's primary backend (database, authentication, storage, edge functions) is hosted by Supabase, Inc. in the United States (us-west-1, Northern California). This means that personal data of users located in the European Economic Area (EEA), the United Kingdom, and Switzerland is transferred to and processed in the United States. Several of our other processors are also U.S.-based.
We ensure that an adequate level of protection is in place for these international transfers through one or more of the following safeguards under Articles 44–49 GDPR:
- the recipient is in a country covered by an adequacy decision of the European Commission. Supabase, Inc., Google LLC, Apple Inc., Expo, Inc., Functional Software, Inc. (Sentry), and Impact Tech, Inc. are, or are eligible to be, certified under the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the DPF, and the Swiss-U.S. DPF, which the European Commission recognises as providing an adequate level of protection;
- Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c) GDPR, included in our data-processing agreements with processors whose DPF certification is not active or not applicable, supplemented where necessary by additional technical and organisational measures (encryption in transit and at rest, row-level security, minimisation);
- where neither applies, your explicit consent to the transfer after we informed you of the risks (Article 49(1)(a) GDPR).
By creating an account and using MyCircle, you understand that your personal data will be processed in the United States and you accept the transfer on the legal bases above.
You can request a copy of the safeguards in place by emailing mycircle.app.2026@gmail.com.
8. How long we keep your data
We keep personal data only for as long as we need it for the purposes set out in this policy or as required by law.
| Data | Retention |
|---|---|
| Active account profile, posts, Circles, friends | For as long as your account is active |
| Moments | Automatically deleted 24 hours after creation by a scheduled job |
| Messages in Circles and DMs | For as long as the Circle exists; DMs are deleted when the last member leaves; group Circles auto-archive after 14 days of inactivity (event Circles 14 days after the event end date) and are hard-deleted 7 days later |
| Content rejected by moderation | Media file deleted immediately; the database row is kept as an audit record (no personal data displayed) until account deletion |
| Reports filed by you or against you | Kept until the underlying incident is closed; aggregated statistics may persist |
| Push tokens | Deleted when you disable push notifications or delete your account |
| Backups and logs | Operational logs are kept for up to 90 days; database backups for up to 30 days. After deletion of your account, residual data in backups is purged through the normal backup-rotation cycle |
| Data exports | The signed download link is valid for 1 hour; the file itself is auto-deleted from our storage after that |
| Anonymised analytics | May be kept indefinitely in a form that cannot be linked back to you |
When your account is deleted (see §10), all directly identifying personal data is purged from the live database immediately. Backups are purged through the standard rotation as described above.
9. Your rights
Under the GDPR (Articles 12–22) and equivalent rights under the UK GDPR, the CCPA/CPRA, and similar laws, you have the following rights regarding your personal data:
| Right | What it means | How to exercise |
|---|---|---|
| Access (Art. 15) | Get confirmation of what data we hold about you and a copy of it | Settings → Privacy → Export my data, or email us |
| Rectification (Art. 16) | Correct inaccurate or incomplete data | Edit your profile in-app, or email us for fields you cannot edit |
| Erasure / right to be forgotten (Art. 17) | Delete your data | Settings → Account → Delete account (see §10), or email us |
| Restriction (Art. 18) | Pause processing while a dispute is resolved | Email us |
| Portability (Art. 20) | Receive your data in a machine-readable format (JSON) | Settings → Privacy → Export my data |
| Objection (Art. 21) | Object to processing based on legitimate interests, including for analytics | Email us |
| Withdraw consent (Art. 7(3)) | Revoke any consent you previously gave (location, ads, push) | Toggle the relevant permission off in your device settings or in-app, or email us |
| Automated decisions (Art. 22) | Not be subject to solely automated decisions with legal effect — we do not make any such decisions (automated moderation is reviewable on appeal) | n/a |
9.1 How to ask
Email mycircle.app.2026@gmail.com from the email address tied to your account, or use the in-app shortcuts above. We will respond within 30 days of receipt, as required by Article 12(3) GDPR. In complex cases we may extend that period by a further two months, in which case we will let you know.
We may need to ask for additional information to verify your identity before fulfilling certain requests, in order to protect you against unauthorised disclosure.
9.2 California residents (CCPA/CPRA)
If you are a California resident, you also have the right to know which categories of personal information we collected, the sources, the purposes, and the categories of third parties with whom we shared it (this policy provides all that information). You have the right to opt out of the "sale" or "sharing" of personal information — though, as stated above, we do not sell personal data. You have the right not to be discriminated against for exercising your rights. Authorised agents may submit requests on your behalf with written proof of authorisation.
9.3 Right to lodge a complaint
If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Portugal, that authority is:
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º — 1200-651 Lisboa, Portugal
geral@cnpd.pt — https://www.cnpd.pt
You may also complain to the supervisory authority in your country of residence within the EU/EEA.
10. Account deletion — the one-tap right to be forgotten
You can delete your MyCircle account and all associated personal data at any time, with no friction:
- Open the app
- Tab → Profile
- Settings → Account → Delete account
- Type DELETE in the confirmation field
- Tap Confirm
What happens next, immediately:
- your profile, username, display name, date of birth, gender, city, avatar, and bio are deleted;
- all your posts, Moments, captions, and media files are deleted from our database and from our storage buckets;
- your identity is detached from messages you sent in group conversations (the message text remains visible to other participants under "Deleted user"); your direct-message conversations follow the auto-archive timeline in §8; any copies that other users have already seen or saved locally are beyond our control;
- your saved events, likes, friend list, friend requests, blocks, and notifications are deleted;
- your authentication session is revoked and your account record is purged from Supabase Auth;
- the storage folders associated with your user identifier are emptied so that no orphan files remain.
You do not need to give us a reason. We will not try to talk you out of it. There is no "deactivate" middle state — deletion is permanent and immediate.
Residual copies in encrypted backups are purged through the standard backup rotation within 30 days. Some anonymised, aggregated statistics that cannot identify you may persist indefinitely.
If you cannot access the in-app deletion flow (for example, you lost access to your account), email mycircle.app.2026@gmail.com from your account email and we will process the deletion manually within 30 days.
Uninstalling the app from your phone does not, by itself, delete your account. To exercise your right to erasure, please use the in-app flow or contact us.
11. Children
MyCircle is strictly 18+. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have collected data from a person under 18, we will delete it immediately. If you are a parent or guardian and believe your child has provided personal data to MyCircle, please contact us at mycircle.app.2026@gmail.com and we will take prompt action.
12. Security
We protect your personal data through a combination of technical and organisational measures, including:
- Encryption in transit (TLS 1.2+) on every connection between the app and our backend;
- Encryption at rest for the database, storage buckets, and authentication store, provided by our infrastructure provider;
- Row-level security (RLS) on every database table, so that users cannot read or modify data that does not belong to them;
- Storage path scoping, so that media files are isolated under a per-user folder enforced by RLS policies;
- Session tokens stored in the device keychain (iOS Keychain / Android Keystore) through
expo-secure-store, never in plain-text storage; - Automated content moderation to reduce exposure to harmful material;
- Mandatory MIME-type and file-size limits on every storage bucket;
- Strict separation between client-readable anonymous keys and server-side service-role keys;
- Principle of least privilege for every administrative operation;
- Audit logs of authentication events and edge-function executions.
No system is perfectly secure. We cannot guarantee absolute security, and you remain responsible for protecting your device, your credentials, and your own copies of any media you upload.
Data breach notification
If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by Article 33 GDPR, and we will notify affected users without undue delay where Article 34 GDPR requires it.
13. Cookies and similar technologies
The mobile app itself does not use browser cookies. It does use the following equivalent technologies:
- Authentication tokens stored securely on your device (essential);
- Advertising identifiers (IDFA / Google Advertising ID) used by Google AdMob, only after you consent through Apple's App Tracking Transparency prompt and Google's User Messaging Platform consent form;
- Local cache for images and assets, to make the app fast and to reduce data usage.
You can clear the local cache by reinstalling the app. You can reset your advertising identifier through your device settings (iOS: Settings → Privacy & Security → Tracking; Android: Settings → Google → Ads).
Our marketing website at https://mycircle-page.vercel.app may use a minimal set of cookies for analytics or functionality. Where applicable, the cookie banner on that site explains and obtains consent for them.
14. Advertising and consent
14.1 How ads are delivered
We use Google AdMob to display banner advertisements in the Feed and Events tabs. We do not show ads in Circles, Profile, or Search.
14.2 Consent in the EU and the UK
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you will see a Google-provided consent message (the User Messaging Platform, "UMP") when you first open the app. The consent message lets you choose between personalised ads, non-personalised ads, or to manage your choices in more detail. You can change your choice at any time in Settings → Ad preferences.
If you choose non-personalised ads, AdMob will still serve you ads, but they will be based only on coarse context (e.g., your country) rather than on your behaviour.
14.3 App Tracking Transparency on iOS
On iOS, Apple's framework also requires the App Tracking Transparency prompt before any cross-app or cross-site tracking. Refusing the prompt means you will see non-personalised ads only.
14.4 Premium users
If a "premium" or ad-free option is offered in the future and you subscribe to it, ads will be turned off entirely.
15. Third-party ticket sales — privacy implications
When you tap "Buy Tickets" or any equivalent call-to-action, you leave MyCircle and are redirected, through an affiliate-tracking URL, to a third-party Ticketing Partner's website or app (SeatGeek, TicketNetwork, StubHub, viagogo, or another partner we may add in the future).
- We do not transmit your name, email, or any other directly identifying personal data through the affiliate redirect. Only a click identifier and the program ID are passed.
- Any data you then enter on the Ticketing Partner's site or app — payment information, billing address, contact details, government ID for ticket transfers, etc. — is collected directly by the Ticketing Partner, not by us.
- Each Ticketing Partner has its own privacy policy. We strongly recommend you read it before completing a purchase.
- All refunds, disputes, cancellations, ticket-validity issues, and data-protection requests relating to the purchase must be raised directly with the Ticketing Partner. We are not the merchant of record and have no access to your transaction data.
See §9 of our Terms of Service for the full liability disclaimer regarding ticket sales.
16. Automated decision-making and profiling
We use limited automated processing for the following purposes:
- Content moderation: every image and video upload is scanned by Google Cloud Vision SafeSearch. Media likely to be adult, violent, or otherwise prohibited is rejected automatically. You receive an in-app notification and may appeal to mycircle.app.2026@gmail.com.
- Feed ranking: posts and people are sorted by a combination of proximity, ±5-year age band, and social context. This is not a decision with legal or similarly significant effect on you and you can change radius and visibility settings to adjust it.
We do not engage in any other form of automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.
17. Changes to this policy
We may update this policy from time to time. The most current version is always published at https://mycircle-page.vercel.app/privacy, with a "Last updated" date at the top.
For any material change (for example, a new third-party processor, a new category of personal data we collect, or a change in retention periods), we will:
- publish the updated version on our website with the new "Last updated" date; and
- mention the change in the App Store and Google Play release notes of the app version that introduces it.
We will not apply a material change to your personal data until at least 30 days after the updated version is published on our website, unless the change is required by law or addresses a security issue, in which case it may take effect immediately.
We encourage you to review this policy periodically. Continuing to use MyCircle after the effective date of an update means you accept the updated policy. If you do not accept it, your remedy is to delete your account (see §10) before the effective date.
18. Contact us
For any privacy-related question, request, or complaint, please contact:
Rui Almeida — operator of MyCircle
mycircle.app.2026@gmail.com
Portugal
We will acknowledge your message and respond within 30 days.
Thank you for using MyCircle. Your privacy matters, and we will continue to design the product to keep it that way.