Privacy Policy

Zircel is run by its operator, who decides how your data is used (the "controller"). To reach the operator about your data, use Me > Settings > Contact us while signed in - a private message only the operator reads.

• Account: your email address and password (stored only in a protected, one-way form), your username, and the interests you choose.
• What you add: Notes (text, photos, places, links), Circles, votes, stars and their colors, reminders, Collections, follows, blocks, shares, invitations and requests.
• Messages: what you write in a Circle's chat (read by its members), comments you send under a Note (read only by its owner), and the messages you send with Contact us (read only by the operator).
• Flags and feature suggestions: when you flag a Note, your flag and what you wrote (seen by the operator, and - without your name - by that Circle's owner and moderators); when you suggest a feature, it becomes a Note in "What You Can Do with Zircel", seen only by the Zircel team and you.
• Push subscriptions: when you turn on notifications while Zircel is closed, the address your phone or browser gives us for sending notifications to that device (in the Android app, a token from Google's Firebase), and your choice of which notifications to get.
• Location, only when you choose: a place or GPS position you attach to a Note, the home place you pick in Explore, and the place of a "When I'm near it" reminder. When Zircel checks such a reminder, your current position is compared on your own device and is not stored. In the Android app, if you allow location "all the time", Zircel collects location data to fire these reminders even when the app is closed or not in use: your phone watches for the places you chose and tells Zircel only that a reminder fired, never where you are. Voice search in the Android app is done by your phone's own voice input (for most phones, Google's); Zircel receives only the resulting words.
• Activity in the app: notifications, the records behind Zircel News, Note history, and a daily count of your AI requests (to keep within limits).
• Anonymous usage statistics: which parts of the app are opened and for how long, under a random id kept on your device and not linked to your account, to see what helps and what gets in the way.
• Circle Insights: when you open a Circle or its Notes, search in it, or star, comment or vote there, a record is kept under a code made from your account, the Circle and a secret key - the database can't tell from it who you are, and the code differs in every Circle. Its owner sees only counts (never names), and only when 3 or more people did something (2 for search words, with numbers and addresses removed). A Circle's owner, its moderators and the Zircel team aren't counted.
• Technical: a sign-in cookie that keeps you logged in, settings stored in your browser (such as dark mode and dismissed cards), and the usual server logs of the hosting providers (including IP addresses). On a device where the account switcher is used, the sign-ins (not the passwords) of the accounts used there are kept on that device until they are removed or you log out.

Zircel has no advertising and does not sell or rent personal data.

• To provide Zircel - your account, your Notes and Circles, sharing, search, reminders and notifications (performance of our agreement with you, the Terms of Service).
• Location and AI features are used only when you choose them (your request, and for location your consent, which you can withdraw by removing it or refusing location access).
• Security and abuse prevention - limits, logs and enforcing the Terms (legitimate interests in keeping Zircel safe).
• Legal duties - where the law requires us to keep or hand over information.

Other people see your username and what you share under the rules on Your data in Zircel (private and public Circles, shared Notes, "My eyes only"). Your email address is never shown to other users.

We use these service providers, who handle data on our behalf:

• Supabase - database, sign-in and photo storage. Data is stored in Ireland (EU).
• Vercel - hosting of the app. The app's server code runs in Dublin, Ireland; pages are delivered through Vercel's worldwide network.
• OpenRouter and the AI model providers it routes to - only when you use an AI feature, the text needed for it (your question, the Note you are writing, or Notes of the Circle involved). Zircel asks OpenRouter to use only providers that neither store nor train on what they are sent. When OpenRouter cannot answer, short requests go to Groq instead, on an account set to keep nothing that is sent (zero data retention). A Circle's owner can turn AI off for that Circle.
• Google Maps (Places) and OpenStreetMap - when you look up a place or name a location, the place text or coordinates are sent from our server (not your IP address or your name) to Google's Places service and, when Google is not used, to OpenStreetMap's Nominatim and Overpass, to find place names. The map page loads its map pictures (tiles) from OpenStreetMap directly in your browser, so OpenStreetMap sees your IP address.
• Google - when you paste a short Google Maps link into a Note, our server asks Google where the link leads, to name the place. Your IP address is not sent.
• Your browser's or phone's push service - if you turn on notifications while Zircel is closed, each one (its short text, such as "Hadar mentioned you") is delivered through the push service of your browser or phone maker; in the Android app that is Google's Firebase Cloud Messaging.
• Sentry (error reports) - when a page or our server fails, a technical report goes to Sentry, stored in the EU: the error, the page's address with ids removed, your browser and the app version. It carries no Note text, no account, no cookies and no form contents, and your IP address is not stored.

Some of these providers are based outside the EU (for example in the United States). Where data is transferred outside the EU, this relies on the providers' legal safeguards, such as the EU Standard Contractual Clauses.

Links you open from Zircel (for example Google Maps) take you to other services, which have their own privacy policies.

• Your account and content: until you delete them or your account.
• A deleted Note: 30 days in your Deleted Notes, kept 60 days in all (so it can be recovered), then removed for good.
• Earlier versions of a Note (History): 90 days.
• Notifications: removed 24 hours after you have read them.
• Circle chat messages: 30 days, unless the Circle's owner sets another period (7 to 365 days). Zircel chat messages: 365 days.
• A deleted Circle: kept 30 days so the operator can restore it, then removed for good.
• Flags and Contact us messages: until the operator deletes them or you delete your account. Feature suggestions are Notes and are kept like your other Notes.
• Push subscriptions: until you turn notifications off on that phone or log out there.
• Anonymous usage statistics: 90 days.
• Circle Insights records: 90 days; daily totals: 2 years.
• Records behind Zircel News: kept while your account exists; the Feed shows the last 30 days.
• When you delete your account, your personal data is removed. Circles you own that have other members pass to another member, and Notes you wrote in Circles that keep existing stay there, no longer linked to you.
• Provider backups and logs are kept for the providers' limited retention periods.

Depending on where you live (for example under the EU and UK GDPR), you can ask to access your data, get a copy of it, correct it, delete it, restrict or object to its use, and withdraw consent at any time. You can change most things yourself in the app, download a copy of your data from Me > Settings > Your data in Zircel, and delete your account from the same page. For anything else, contact the operator as described above. You also have the right to complain to your data protection authority.

Data travels encrypted (HTTPS) and is encrypted on disk; access rules are enforced by the database itself. Zircel is not end-to-end encrypted, so the operator and the hosting providers can technically access stored data. No system is perfectly secure; we will act on security problems and tell you where the law requires it.

Zircel is for people aged 18 and over. We do not knowingly collect data from children.

We may update this policy. The date at the top shows the latest version, and significant changes will be announced in the app. See also the Terms of Service.