Privacy Policy

Effective date: July 4, 2026
Last updated: July 4, 2026

Circa ("we," "us") is an intermittent fasting tracker built and operated by the team behind Circa, based in Texas, USA. This policy explains what information Circa handles, where it lives, and the choices you have. The short version: your health and fasting data stays on your iPhone. We never see it.

1. Health data stays on your device

Circa reads your step count and weight from Apple Health (HealthKit), and records your fasting sessions, weight log entries, and progress photos you add in the app.

All of this is stored locally on your device and processed on your device. It is never transmitted to our servers or to any third party. Specifically:

• We do not upload, sell, share, or use HealthKit data for advertising, marketing, or analytics of any kind. (Apple's rules prohibit this, and our architecture makes it impossible — there is no server endpoint that receives it.)
• Progress photos you attach to weight entries are saved only in the app's private storage on your device. They are not uploaded to our servers.
• Because this data lives on your device, it is included in your normal iPhone backups (iCloud or computer backups you control). If you delete the app or lose your device without a backup, this data cannot be recovered by us — we never had it.

You control HealthKit access in Settings → Privacy & Security → Health → Circa and can revoke it at any time. Circa continues to work without Health access; you'll simply see fasting timers without step overlays.

2. Information we do collect

We collect the minimum needed to run your account and improve the app:

Account information. When you create an account, we receive your email address, an account identifier, and — if you sign in with Apple or Google — your name if you choose to share it. This is stored with our authentication and database provider, Supabase. We use it solely to operate your account (sign-in, account recovery, account deletion). Note: if you use Apple's "Hide My Email," we only ever see the relay address.

Feedback you send. If you submit feedback in the app, we receive your message, the app version, and basic device model information, linked to your account ID. Feedback is delivered to our internal tools (a private Slack workspace and a private GitHub issue tracker) so we can fix bugs. Don't include sensitive personal or health details in feedback messages.

Purchase and subscription information. Payments are processed entirely by Apple through the App Store; we never see your payment card details. To manage subscriptions and show you the right paywall, we use Superwall, which processes your account identifier, purchase status, and standard device information (such as device model, OS version, locale, and app version) on our behalf. See Superwall's privacy policy at superwall.com/privacy.

Onboarding quiz answers (age, height, weight, goals) are used on your device to compute your plan. They are not uploaded to our servers.

3. What we don't do

• No advertising, ad networks, or ad tracking SDKs.
• No sale or sharing of personal information (as "sale/sharing" is defined under the California Consumer Privacy Act).
• No cross-app tracking; Circa does not use the Apple advertising identifier (IDFA) and does not request App Tracking Transparency permission because it does not track you.
• No use of your data to train AI models.

4. Service providers

We share account and feedback data only with processors that host or route it for us, under their standard data-processing terms:

We do not use analytics or crash-reporting services beyond what's listed.

5. Data retention and deletion

• Account data is kept while your account exists.
• Feedback is kept while relevant to improving the app, and no longer than 24 months.
• Delete your account any time in the app: Profile → Delete Account. This permanently deletes your account and feedback records from our systems and erases the app's local data from your device. It cannot be undone. You can also email us (below) to request deletion.

6. Security

Account data is encrypted in transit (TLS) and at rest by our providers. On-device data is protected by iOS's built-in encryption and your device passcode. No system is perfectly secure; we limit risk primarily by not collecting your health data in the first place.

7. Your rights

Depending on where you live (including the EU/UK under GDPR and California under CCPA/CPRA), you may have rights to access, correct, delete, or export the personal information we hold, and to lodge a complaint with your local supervisory authority. Because we hold so little — your email, account ID, and any feedback — the fastest path for any of these is the in-app deletion flow or an email to us. We respond within 30 days. For EU/UK users, our legal bases are performance of contract (operating your account and subscription) and legitimate interest (handling feedback you volunteer).

8. Children

Circa is not directed at children and is intended for users 17 and older. We do not knowingly collect information from anyone under 17. If you believe a minor has created an account, contact us and we will delete it.

9. Not medical advice

Circa provides general wellness information and estimates. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Projections shown in the app are illustrative estimates, not guarantees. Consult a physician before starting a fasting protocol, especially if you are pregnant, have diabetes or an eating-disorder history, or take medication affected by fasting.

10. Changes to this policy

If we make material changes — especially anything that would move health data off your device, which we do not plan to do — we will notify you in the app before the change takes effect and update the date above.

11. Contact

Questions about this policy or your data? Reach us through the Circa support page and we'll get back to you.