Privacy Policy
Effective 30 October 2026Circular, by Zovhra
Circular is a private messaging app. You give it your circle and your conversations. This page tells you exactly what reaches us, what stays on your device, and what we can never read.
We don't sell personal information, we don't run advertising, and we don't track you across other apps or websites. Encryption happens on your device before your messages leave it.
01What we collect
We describe each collection by the feature that needs it. If a feature doesn't need something, we don't ask for it.
Account details
- Email address — your sign-in identity, and the only way we can reach you about your account.
- Password — never stored as text. Authentication is handled by a credential system that keeps only what is needed to verify it.
- Username — the handle people use to find you. Usernames are public; that is what makes discovery work without phone numbers.
Profile
- Display name, bio, profile image and profile colour — all optional, all yours to change or clear at any time.
- Who can find and open your profile — stored as the settings you choose, so the rules you set are enforced on our side and not just hidden in the app.
Conversations
- Message content — text, photos, videos, voice notes, documents, stickers and GIFs you send. This is encrypted on your device before upload. We hold the encrypted form.
- Delivery state — sent, delivered and read status, reactions, edits and deletes, replies, and whether a message is part of a poll.
- Conversation membership — who is in a direct chat or a group, and the roles and permissions inside it.
- Typing and presence — broadcast briefly so a chat can show someone is writing, then dropped.
Media and files
- Files you send are encrypted on your device with a key for that item, then stored as an opaque blob. We cannot read the contents, and the storage provider never sees plaintext.
- Media you save to your gallery, and media cached for performance, stays on your device. You control auto-save in Settings.
Camera and microphone
Used only while you actively take a photo, record a video, record a voice note, or scan a QR code to add someone. Nothing is captured in the background, and the app does not record when you are not using one of those screens.
Location
Only when you choose send my location in a chat. We read it at that moment, attach it to that message, and don't keep a history of where you have been.
Device and push-notification data
- Device model, OS version, app version — so we know which builds break and which don't.
- Push-registration token — required to deliver notifications to your phone.
- Device identifiers for messaging security — each device you sign in on gets its own identity so sessions can be established and revoked. These exist inside the encryption system, not for tracking you across products.
Crash signals
When the app hits an unhandled error, we send a deliberately content-free record: app version, platform, the type of error, and a one-way hash of the error text. No message, no stack trace, nothing that could carry your conversations or your files. Capped at a small number per session, and capped again on our side.
Feature availability and experiments
Some features are turned on for a share of accounts before everyone gets them. We store which account was in which group, and whether you reached the screen, so a staged rollout can be judged on real behaviour instead of guesses. This is a 180-day record that prunes itself, and it deletes with your account. It never carries content.
Purchases
If you buy a subscription or coins, the payment itself is processed by your app store and our payments provider. We receive the entitlement — what you're allowed to use and until when — plus a purchase reference so we can support you if a receipt goes missing. We don't take your card number.
GIF and sticker search
Searching for a GIF or sticker sends your search text to the image provider that supplies that library. The query goes from your device to them; it isn't a message and we don't attach it to your account history.
Assisted replies and AI features
Where you use an AI persona or an assistant feature, the text you send it is passed to a model provider so it can answer. Usage volume, latency and cost are recorded. Treat AI chats as disclosures to a third party — don't put sensitive personal information in them.
Private storage
Encrypted storage features keep your notes and files sealed on your device before upload. We hold ciphertext and cannot recover the plaintext for you.
Reports, blocks and safety
When you report someone, or block them, we keep that record and the content you attach to the report — which may include message text you chose to share with us. Safety and audit logs exist so abuse can be handled, and so a moderation decision can be explained later.
Support conversations
Whatever you send our support team, including your email thread and any screenshots you attach.
What we don't ask for
- Your contacts list is not uploaded. Friend requests go through usernames.
- No phone number is required to sign in.
- No advertising identifiers.
- No browsing history outside the app.
02How we use it
- Deliver the service — authentication, conversations, groups, media, notifications, presence, purchases.
- Keep it honest and safe — enforce blocks, spot abuse, respond to reports, prevent spam and automated misuse.
- Keep it working — crash signals and diagnostics, so a bad build can be stopped before more people hit it.
- Decide what to build next — aggregate feature availability and usage data.
- Talk to you about your account — security notices, receipts, support replies, and changes to these terms.
- Meet our legal obligations — where law requires us to keep or disclose something, we do, and we tell you when we're allowed to.
We do not use your data to build advertising profiles, and we do not sell it.
03Encryption on your device
Human-to-human conversations — direct and group — are encrypted with a system that establishes keys on your device and changes them as you write. The result is that the text we store is unreadable to us, and the keys to read it were never uploaded.
- Keys are created on your device. We never receive the private keys that decrypt your conversations.
- Sending keys are handed out once. Each one-time key can be claimed by exactly one sender, and every key in the public bundle carries your own signature, so our server cannot quietly substitute a different one.
- Sessions roll forward. Message keys advance with the conversation, so a single key does not protect everything you have ever written.
- Encrypted history recovery is opt-in. If you enable recovery, you hold the secret. Without it — including the recovery secret and your device keys — a restored account starts empty rather than handing us your history.
- Encryption is not a switch we can flip off. There is no operational toggle that turns your conversations back into plaintext. A message stored in the clear fails at the database boundary.
Two honest exceptions. Conversations with bots are plaintext by contract — a bot needs to read what you send it. And content you report to us is decrypted by your own action, because reporting means showing us the message.
04What our servers can see
Encryption protects content. It does not make the service invisible, and pretending otherwise would be a marketing claim rather than a fact. To route a message we must know:
| Visible to us | Why it is needed |
|---|---|
| Who sent, who received | A message cannot be delivered without endpoints. |
| When it was sent and delivered | Ordering, retries, read state. |
| Message type and size | A photo and a text note take different paths. |
| Group membership and roles | Authorisation is enforced on our side, not trusted from the app. |
| Your device identities | So sessions can be established, and a stolen device revoked. |
| IP address at sign-in | Handled by our authentication infrastructure for security, not stored as a profile field. |
| Content you report | Only what you choose to show us. |
We don't see: message plaintext, file contents, vault contents, your keys, or your passwords in readable form.
05Who else touches your data
We don't share your data with advertisers, data brokers, or anyone who buys lists. These are the parties that help us run the service under contract:
| Category | What they handle |
|---|---|
| Cloud hosting and database | Accounts, settings, relationships, encrypted messages and their state. They store what we write; they have no reason or means to read conversation keys. |
| Object storage and content delivery | Encrypted file blobs, plus delivery of media you send. Content is ciphertext before it reaches them. |
| Push notification providers | Device tokens and notification payloads, so alerts reach your phone. Notification content follows the settings you choose. |
| Payments | Your purchase, your app-store account reference, and the entitlement we should grant. Card details stay with them. |
| Image libraries | GIF and sticker search queries, answered directly to your device. |
| Model providers | The prompts you send to AI features, and the answers back. |
| Infrastructure security | Network protection and abuse screening for the service as a whole. |
When we disclose without your action
- To comply with law, a valid legal process, or a verified request from public authorities, where we are permitted to act on it.
- To investigate fraud, abuse, or a threat to someone's safety.
- If our business changes hands — a restructuring or transfer of the service — users will be told before their data moves under new ownership.
06How long we keep it
- While your account is open. Profile, relationships, conversations in encrypted form, and settings.
- Until you change it. Device and session records are replaced as you add or remove devices.
- Short windows for transient state. Typing indicators and presence are dropped once they stop being useful.
- 180 days for feature-experiment exposure records, pruned automatically.
- Until resolved for reports and the safety record around them.
- As long as the law or a financial record requires for purchase receipts.
- Encrypted history you leave behind is not readable by us, and is deleted on the schedule below rather than kept indefinitely.
Disappearing and time-limited content behaves the way you set it to. Once content is deleted from a conversation, it is removed for everyone in it and cleaned from our side on the same schedule.
07Deleting your data
You can delete your account from inside the app — Settings → Delete account — without contacting anyone. The request is confirmed, then a 22-day window opens in which you can still cancel by signing back in.
- Immediately on request — sign-in is disabled, your profile stops appearing to others, and you can't be found by username.
- During the 22 days — a background process removes your profile, relationships, devices, key material, conversation membership, encrypted content and stored files.
- At the end — your authentication record is closed and the remaining encrypted material is removed as our backup retention expires.
If you can't reach the app — you lost the device, you can't sign in — write to us and we'll verify you and do it for you.
Full instructions, including what deletion cannot reach, are on the account deletion page.
08Your rights
These are yours regardless of where you live, and most of them are self-service in the app:
- Access — see your account, profile and conversations in the app.
- Correction — edit your details, or ask us to fix what we hold about you.
- Deletion — in-app, or by request.
- Portability — export what you can from the app, or ask us for a machine-readable copy of the data tied to your account.
- Objection and restriction — turn off presence, notifications, discoverability, and the features that rely on them.
- Consent withdrawal — camera, microphone, and location permissions are yours to revoke in your device settings at any time; features that need them will simply stop.
- Grievance — for users in India, contact our Grievance Officer below. We acknowledge and act within the timelines the DPDP Rules require.
Requests are free. We may ask for information to confirm it's really you before we act, and we won't accept a request that comes from somebody else's mailbox.
09Age limits
Circular is not for children under 16, and a higher minimum may apply where local law or an app store requires it. We don't knowingly collect a child's data. If you tell us an account belongs to someone under the minimum age, we delete it — and encrypted content tied to it goes with it.
10Where we operate
Zovhra develops Circular. Your data is processed and stored on infrastructure we operate for that purpose, which may sit in more than one region. Whichever region holds a record, this policy holds for it.
11Changes to this policy
If we change what we collect or how we use it, we update this page, change the date at the top, and give you notice in the app or by email where the change matters to you. Continuing to use Circular after a change means the new policy applies.
12Contact
- Support and privacy questions — support@zovhra.com
- Grievance Officer (India) — grievance@zovhra.com
- Account deletion without the app — support@zovhra.com, subject "Account Deletion Request"
Please don't send your password, your recovery secret, or one-time codes by email. We will never ask for them.