Privacy policy

Effective 29 September 2026

CircleUp is a Chrome extension for messaging, calling and screen sharing with a private circle of up to 10 people. This policy explains what CircleUp stores about you, for how long, where, who else is involved, and how to delete it. It covers the CircleUp extension, the CircleUp server at api.getcircleup.app, and this website.

What we store

Your Google account details

You sign in with Google. CircleUp asks Google only for your basic profile (the openid, email and profile permissions) and stores:

• your Google account ID, so we recognise you next time;
• your email address;
• your name;
• the web address of your Google profile photo (not the photo itself).

People in your circle see your name and profile photo. The photo is loaded from Google's servers when it's shown. We don't get access to your Gmail, Drive, contacts or any other Google data.

Your circle

• Your invite code, which you share with people you want to add.
• The list of people in your circle (up to 10). Adding someone puts each of you in the other's circle.
• When you were last online. People in your circle see whether you're online now, or when you were last online.
• The time your account was created.

Messages

To deliver messages to someone who is offline and to show them on your other devices, CircleUp stores each message on its server: its text (or screenshot), who sent it and to whom, and when it was sent, delivered and seen. Messages are deleted automatically:

• 24 hours after the recipient has seen them, or
• 7 days after they were sent, if they are never seen,

whichever comes first. They are also deleted at once when either of you removes the other from your circle, or when either of you deletes your account. Messages are never saved in your browser's storage: the extension keeps them in memory only while it's running.

Screenshots

CircleUp only captures a screenshot when you click the screenshot button, and only of the tab you're looking at. You see a preview first, and nothing is uploaded unless you press Send. A sent screenshot is stored in CircleUp's file storage and follows its message's expiry: it is deleted within a few minutes of the message expiring, and when its message is deleted for any of the reasons above. A screenshot upload that never becomes part of a message is deleted within about 30 minutes. As a safety net, the storage deletes every screenshot 8 days after upload regardless.

Sign-in sessions

Each device you sign in on gets a random device ID and a sign-in session. The session is kept on the server only as a one-way hash, and expires after 30 days (sooner if you sign out). Expired sessions are deleted automatically. If a session looks stolen (an old token used again), CircleUp records that for the same period so the device is signed out safely.

In your browser, the extension keeps your sign-in tokens, your device ID, and small preferences such as where you placed the bubble, in Chrome's extension storage on your computer.

Server logs

CircleUp's server logs technical events so we can keep the service running: when a device connects or disconnects, when a call rings, starts and ends, and the type of any error. These entries identify users, devices and calls only by random IDs. They never include message text, screenshots, sign-in tokens, names, email addresses or IP addresses, and the web server in front of CircleUp writes no access logs. Logs are rotated automatically, so old entries are overwritten. Our hosting providers may keep standard network and security logs of their own.

What we never store

• Call audio and screen sharing. These go directly between the two people in the call (peer to peer) whenever possible. When a direct connection isn't possible, they are relayed through a TURN relay server. Either way the media is encrypted end to end: the relay cannot access its content, and nothing is recorded. The relay necessarily sees the network addresses of both participants.
• The pages you visit. The extension shows its bubble on web pages but doesn't read, collect or send their content. The only exception is a screenshot you choose to take and send.
• Your contacts outside CircleUp. People only join your circle through invite codes.

Where your data lives

• The CircleUp server and screenshot storage run on Oracle Cloud, in the Mumbai region (India).
• The database runs on MongoDB Atlas, Mumbai region.

Connections between the extension and the server are encrypted (HTTPS and secure WebSockets).

Third parties

• Google, for Sign in with Google, and for serving profile photos.
• MongoDB Atlas, which hosts the database.
• Oracle Cloud, which hosts the server and screenshot storage.
• A TURN relay service, which relays encrypted call and screen-sharing media when a direct connection isn't possible, as described above.
• Google's public STUN service, which the extension may use to find a direct network path for calls. Like any server your browser connects to, it sees your network address, and nothing else about the call.

CircleUp has no ads and no analytics or tracking. We don't sell your data or share it with anyone for advertising.

Deleting your account

You can delete your account at any time, in either of two ways:

• In the extension: open the bubble, go to Settings, choose Delete my account and confirm. This takes effect immediately.
• By email: write to privacy@getcircleup.app from the email address of your CircleUp account. We'll confirm when it's done.

Deleting your account removes you from everyone's circle; deletes your messages (sent and received), your screenshots and your sign-in sessions; and signs you out on all your devices. Any call you're in ends. See Delete your account for details.

Children

CircleUp is not meant for children under 13, and we don't knowingly collect data from them. If you believe a child under 13 is using CircleUp, contact us and we'll delete the account.

Changes to this policy

If we change this policy, we'll update it here and change the effective date above. If a change affects how your existing data is used, we'll email you at your account's email address before it takes effect.

Contact

Questions about privacy: privacy@getcircleup.app. Anything else: support@getcircleup.app.