CIRL Privacy Notice Terms package 2026-09-12

This notice describes how Michael Christen (Connect In Real Life / CIRL), Champs Thiébauts 12, 2735 Valbirse, Switzerland, processes personal data. Contact: support@cirl.app.

This is not blanket consent to every processing activity. Agreeing to the Terms of Service is separate. Sensitive matching (using sexual orientation, family plans and sensitive interests such as religion, politics or mental health in Discover filters and CIRL Match) is off unless you opt in, with no pre-ticked boxes. CIRL Match readings are part of providing the score explanation: names, bios, shared interests, and the match percent may be sent to the configured large-language-model (LLM) host. Orientation, family-plan values and sensitive interests are not put in that prompt unless you opted into sensitive matching (for a shared sensitive interest, both of you). If the host is down, CIRL uses a local template.

Unverified: launch countries, hosting/backup country of the Virtual Private Server (VPS), and processor contracts are not fully recorded yet. Present-tense vendor statements below match what the current software actually does.

1. Categories of data Depending on how you use CIRL, we may process:

- Account: email, password hash (not the password itself), role, signup device fields (operating system, app version, language, time zone), signup Internet Protocol (IP) address, a hashed Android device identifier and a Google Play Integrity result (both for abuse prevention only), session tokens.
- Profile: display name, @handle, photo, bio, interests (including want/avoid), languages, intentions (friendship / relationship / connection goals).
- Optional intimate fields: gender, sexual orientation, height, education, occupation, drinking, smoking, exercise, pets, family plans, communication style, love language, Myers–Briggs type, birth date/time/place/coordinates, natal-chart style text. These do not raise the access-score used for feature unlocks.
- Sensitive interests (optional): interests that can reveal religious or philosophical beliefs, political opinions, health or similar (for example a religion, politics, mental health, therapy, or a rights cause). You choose whether to add them. They are visible to your friends only unless you make an answer public, and they are used for matching only if you opt into sensitive matching.
- Photos you upload: profile photos, extra photos, banners, activity covers and organizer photos. Before others see them, they are checked automatically (see “Photo checks” in section 5). CIRL keeps a fingerprint (hash) of each photo and the check result.
- Messages: chat messages, photos, videos and voice messages are end-to-end encrypted (see “Messages” below).
- Push notifications: if you allow notifications, a push token for your phone, stored with your sign-in session together with the notification categories you switched on.
- Area and availability: a manually entered broad area (city or region) can earn access points. Device Global Positioning System (GPS) and home coordinates are optional. Birthplace is for optional astrology, not for earning access.
- Use of the service: activities you create or join, messages, groups, saved searches, reports and optional screenshots, Discover “first shown” records, access logs, feature-unlock and (when launched) reward records.
- Chat match signals (optional): only if you and a friend both allow it, categories derived on your phone from your one-to-one chat (ranges, contact-detail kind, meeting talk), never the text. See section 11.
- Computed data: CIRL Match scores and embeddings, cached explanations, optional large-language-model (LLM) bios or talk drafts. Sanitized CIRL Match generation snapshots (selected visible evidence and the written reading, not a raw profile copy) are kept for about 90 days for quality and abuse review, then dropped with account deletion. They are not exported for model training unless you later give a separate consent.
- ChatGPT connected app: if you connect ChatGPT to CIRL (Developer Mode / custom connector), ChatGPT may send relevant memory or conversation excerpts to CIRL only after you connect and authorize a write. CIRL stores only the catalog profile fields you allow (for example interests, languages, occupation). CIRL does not accept sexual orientation, politics, religion, or Myers–Briggs type from that connector.
- Speech: if you use voice typing, the phone may send audio to a platform/cloud speech service (`onDevice: false`). CIRL then stores the text, not a promise that audio never left the device.
- Maps: your device fetches map tiles from OpenFreeMap / OpenStreetMap. CIRL does not proxy those tiles on our server.
- Connected Instagram: if you connect a Creator or Business Instagram account, CIRL stores an encrypted access token on the server (not in the app) so other CIRL users can browse the media you chose to show on your profile. You can disconnect at any time. CIRL does not post, like, comment, or follow on your behalf.

Messages. Chat messages, photos, videos and voice messages are end-to-end encrypted: they are encrypted on your phone with keys that stay on the phones in the conversation, and CIRL's servers store only the encrypted form, which CIRL cannot read.

- Message content: CIRL stores the encrypted text for as long as the conversation exists, so your phone can load your history. Encrypted photos, videos and voice messages stay on CIRL's server only until every recipient's phone has downloaded them, and at most 7 days.
- Message metadata: who is in a conversation, who sent each message and when, message ids, the kind and size of attached media, and the public keys of the phones in a conversation. CIRL needs these to deliver messages. Metadata is not end-to-end encrypted.
- Your phone keeps the key that decrypts your messages and an encrypted copy of media you sent or received. Signing out deletes that media copy from the phone. A new phone cannot read messages sent to your previous phone.
- Limits: one phone per account; there is no “safety number” check yet, so you cannot verify the other person's key yourself.

Database fields on the profile are stored in PostgreSQL without field-level encryption, except connected Instagram (and later TikTok) access tokens, which are encrypted with Fernet before storage. Transport uses Hypertext Transfer Protocol Secure (HTTPS). Apart from end-to-end encrypted messages, we do not claim encryption at rest.

2. Why we use data (purposes) - Run, secure, and debug CIRL (account, sessions, abuse prevention). - Show you activities and people according to your settings and the server-side access ladder. - CIRL Match as a **computed suggestion**, not a probability that a relationship will work. Astrology text is optional interpretation, not a validated prediction. - Email you one-time codes and important account mail via the configured mailbox (Namecheap Private Email for `support@cirl.app` when that password is set). - Handle reports and keep a limited safety trail. - With your express opt-in, check internal research on whether CIRL Match predicts real connection (section 11). This never changes your Match. - Optional writing helpers: when an Application Programming Interface (API) helper is configured, prompts can include text you typed. CIRL Match readings may include **two** users’ names, bios, shared interests, and match score sent to the configured LLM host so the explanation can improve. That helper is part of providing CIRL Match text (not an off switch). Local template if the host is down. Orientation and family-plan values are omitted unless you opted into sensitive matching.

We load Google Mobile Ads (AdMob) on Android and iOS only, for optional rewarded ads that Community members can watch to unlock a named reach boost. Ads are not loaded on web or desktop. We do not sell your personal information for money to data brokers. Watching a rewarded ad is not consent to personalized advertising.

3. Legal bases (where the General Data Protection Regulation (GDPR) or Swiss Federal Act on Data Protection (FADP) apply) Launch markets are not finally declared. If those laws apply:

- Contract: account, core app features you request, including CIRL Match readings that may call the configured LLM host.
- Legitimate interests: security logs, fraud, automatic photo checks that keep illegal and harmful images off CIRL, aggregated product improvement that does not require sensitive data.
- Consent: optional sensitive matching (orientation, family-plan fields and sensitive interests used in Discover filters / matching), optional chat match signals (express consent for profiling with high risk, FADP Art. 6 para. 6 and 7), optional natal fields, optional precise location, push notifications (the permission on your phone). Withdrawal does not remove unrelated earned access (the access-score floor is kept).
- Legal obligation: where we must keep or disclose records.
- Article 9 GDPR (special categories): sexual orientation, religious or philosophical beliefs, political opinions, health and similar data are used for matching only with explicit opt-in. A hidden field or interest is not used as a Discover filter against people who did not opt in, so others cannot infer it from search results.

We have not appointed a Data Protection Officer (DPO) or an EU representative. Whether those are required depends on markets and processing scale — that is still an owner decision.

4. Who sees what You choose field visibility (only you / friends / wider) on Edit profile. That controls **profile display**. It is not the same as matching consent. Sensitive interests are visible to friends only by default; you can change this per answer under Edit profile, “Who can see each field”. Staff (the operator, and any future support person) can see reports, messages attached to a report, and account records in admin/ops tools. Other users see what your visibility and Discover settings allow.

CIRL staff cannot read your messages. If you report a message you can choose to attach it and the messages around it (section 12); only then does CIRL see that text, and only to review your report.

5. Recipients and locations - CIRL application database and file storage on the configured server (country **unverified** in the owner-decisions file). - Email delivery provider when mail is enabled. - Google Play Integrity (Google) checks, at sign-up on Android, that the app is genuine; CIRL stores only the result. - Map tile providers on your device (OpenFreeMap, OpenMapTiles, OpenStreetMap). - Optional inference host (`AI_BASE_URL`) and, if configured, an OpenAI-compatible compatibility request. - **Photo checks:** Sightengine SAS (France, EU), as our processor (see below). - **Push notifications:** Google (Firebase Cloud Messaging, USA), as our processor (see below). - Apple/Google if you later buy a store subscription (not launched). - Authorities if the law requires it. If Swiss authorities present a valid order, CIRL can hand over the encrypted messages and the metadata described in section 1 for the account named in the order. CIRL cannot decrypt them and holds no key that could.

Photo checks. Photos you upload (profile photos, extra photos, banners, activity covers, organizer photos) are checked automatically before others see them. For this we send the picture, without your name or account details, to Sightengine SAS (France, EU), which acts as our processor. It checks for nudity, sexual content, violence, weapons and hate symbols, and whether a person in the photo may be under 18. The result is kept only as a category and a score; we do not use it to identify anyone. A photo that is clearly fine is shown. A borderline photo is blurred while it is reviewed. A photo that breaks the rules is refused, and you can contest the decision in the app or at support@cirl.app. Chat photos are end-to-end encrypted and are not checked.

Push notifications. If you allow notifications, your phone registers a push token with Google (Firebase Cloud Messaging, USA) so we can notify you when the app is closed. Push messages contain only a short generic text (for example “New message” or “Friend request”), never the text of a message or the name of another person. You can switch notifications off per category in Settings, or in your phone's settings; signing out removes the token from your account.

International transfers are not documented with signed processor clauses in this repository. Treat that as an open operator task before public launch in the EU.

6. Retention (engineering targets, not a legal safe harbor) Account deletion runs as a live job; the other rows are targets:

| Record | Target idea |
|---|---|
| Active account | Until you delete it or we close it |
| Ordinary account data after a verified deletion request | Hidden at once, erased from live systems 14 days later (always within 30 days); see the deletion notice |
| Access logs / archives | About 90 days |
| Bug screenshots | After the report is done, with a 90-day default cap — still partly a TODO in code; deleted with your account |
| Backups | Rolling: daily for 7 days, weekly for 4 weeks, monthly for up to about 6 months; a deleted account is never restored as a live user |
| Safety reports, bans, legal holds | Kept only as long as needed for the incident or the law |
| Ban record | If moderation bans or closes an account, keyed hashes of its email and device identifiers (never the email or the raw identifiers) are kept for as long as the ban lasts (for a closed account, until staff lifts them), also after the account is deleted, to stop the same person signing up again |
| Financial records | Referral ledger and payout records are kept without your account where they record money CIRL paid or owed; in-app purchase records are deleted with your account (Google Play keeps the transaction) |
| Optional AI drafts after you withdraw consent | Remove from active stores and caches |
| Chat match signals | While the chat exists and both allow it; deleted on withdrawal, account deletion or chat deletion (section 11) |
| Encrypted messages | As long as the conversation exists, then removed under the account-deletion rules |
| Encrypted chat media on the server | Until all recipients' phones have it, at most 7 days |
| Photo check results | Fingerprint (hash), category and score: kept to stop the same picture being uploaded again. A refused original: 30 days after the decision (or after your appeal is closed). A photo that may be illegal: kept longer on legal hold and reported to the competent authorities as required by law |
| Push token | Until you sign out or Google reports it invalid |

Safety is not a reason to keep everything forever. Legal holds are recorded per case.

7. Your rights Depending on the law that applies, you may ask for access, correction, deletion, restriction, objection, and portability. You may withdraw consent without losing unrelated features. We will ask enough to verify it is you. We will not put another person’s messages or password hashes in your export.

Complaints: support@cirl.app. You may also contact the Swiss Federal Data Protection and Information Commissioner, and if you are in the European Economic Area, your local data protection authority.

How to delete: in the app (Settings → Delete my account) or the public page `/legal/delete-account` (also linked from the website). Legal documents are a separate list under Settings → Legal / About CIRL → Legal documents. You do not need to reinstall the app to learn how. Closing (hiding) an account is not the same as erasure.

8. Children CIRL is 18+. We will close underage accounts we learn about.

9. Changes We will post a new version date. A new Privacy Notice is not automatically new consent. Material new purposes need a fresh lawful basis.

2026-10-06: added section 11 (chat match signals). It is an optional feature that is off by default and starts only with your own express choice in the app, so the Terms package version is unchanged and no new acceptance is required.

2026-10-15: end-to-end encrypted messages (section 1), automatic photo checks by Sightengine and push notifications through Firebase Cloud Messaging (section 5), and sensitive interests (sections 1, 3 and 4).

10. Contact support@cirl.app — Michael Christen, Champs Thiébauts 12, 2735 Valbirse, Switzerland.

11. Chat match signals (optional, off by default) This section covers one optional feature. It is **off** unless **both** people in a one-to-one friend chat switch it on. It is described here because Swiss law (Federal Act on Data Protection, FADP, Art. 19) requires us to tell you before we process data in this way.

What it is. CIRL Match is checked against what really happens between people. If you and a friend both allow it, the CIRL app on your own phone reads the messages that are already open on your screen and works out a few categories. Reading messages to derive these categories is profiling under the FADP (Art. 5 lit. f). We treat it as profiling with high risk (Art. 5 lit. g) because it looks at private conversations, so we ask for your express consent (Art. 6 para. 6 and 7 FADP).

What your phone sends to CIRL (and nothing else):
- rough activity of the chat: how many messages you sent (a range, not the exact number), how quickly you usually reply (a range), how long your messages usually are (short, medium, long), on how many days the chat was active (a range), whether both of you wrote, and the date of the first message;
- the kind of contact detail you shared, if any (phone, email, WhatsApp, Telegram, Signal, Instagram, TikTok or another app), but not the number, address or username itself;
- whether a meeting was talked about or planned, how sure the app is (low, medium or high), and roughly how far ahead it is (same day, 1 to 3 days, 4 to 14 days, more).

What never leaves your phone or is never stored by CIRL: message text, phone numbers, email addresses, usernames, links, names of places, and exact times. The app does not upload the messages for this feature, and CIRL stores no text column for it. The analysis is a fixed set of rules in the app. No artificial-intelligence model reads your messages for this feature.

Why (purpose). Only to check, for internal research, whether CIRL Match predicts real-world connection, and to ask "Did you meet in person?" once, 24 hours after a meeting plan was detected, so that outcomes are recorded under the same rules as other private outcomes. The signals are not used to change your CIRL Match score, to rank you, to show anything to other people, to decide anything about your account or to sell or advertise anything. Nobody, including the other person in the chat, can see them. Staff use them only for internal research tables.

Both people must agree. If either of you has not agreed, or has switched it off, nothing is analysed or stored for that chat. The app may show you that the feature is active in a chat, which can reveal to you that the other person agreed. Chats with an activity host or group, and chats that are blocked, are never analysed. After the first confirmed in-person meeting between two people, no further meeting signals are stored for that pair.

Your choices.
- It is not pre-selected. You are asked once when you first open Messages, and you can say "Not now". You can change your mind at any time under Settings, "Learn from friend chats".
- Withdrawing deletes the chat signals CIRL stored about you and the meeting and contact-type records derived from them, including those stored for the other person in your shared chats. Records of what you reported yourself (for example "I met this person") are kept. Withdrawal does not affect any other feature.
- You have the rights in section 7, including access (FADP Art. 25), data portability (Art. 28) and deletion or blocking (Art. 32).

How long. The signals are kept while the chat exists and both of you allow them. They are deleted when you withdraw, when you delete your account, or when the chat is deleted. Pair-level meeting records follow the private-outcome rules: minimized when the first meeting question is answered or the 30-day window ends, and anonymized after about 365 days.

Security and design. Data is minimized by design (FADP Art. 7): buckets and categories only, enforced by the server schema (no text field exists). Transport uses HTTPS and access is limited to staff who need it (Art. 8). We keep a short data protection impact assessment for this feature (FADP Art. 22), available on request at support@cirl.app.

Earlier behaviour. Before this section, the server looked for mentions of other apps in plain-text direct messages without a separate opt-in. That check now runs only in chats where both people allowed this feature.

12. Messages you attach to a report (optional)

When you report a chat message, the app offers a box: "Include these messages so CIRL can review them". Only if you tick it, the app sends the reported message and about 10 messages around it (sender name, text, time) from your device to CIRL together with your report. Nothing is sent without the tick, and the report works without it.

- Who sees it: CIRL staff reviewing the report, in the admin and ops tools. The other people in the chat do not see it, and neither does the person you reported.
- Why: so staff can judge the report with its context. Without the messages, staff only see the single reported message.
- How long: with the report evidence, for as long as the report or incident needs it (see section 6, "Safety reports, bans, legal holds").
- Legal basis: your consent (the tick), which you can decline at no cost. Messages from other people in the chat are included only as context for the report and only for safety review (legitimate interest in keeping the community safe).
- Languages: the in-app wording of the box is available in English, French, German and Spanish. The legal text of this notice is English only for now.