Version 1.0 · Effective 16 September 2026
Circa is a mobile application that helps you track your energy, focus and mood through the day and shows you when your deep focus, shallow work and recharge zones fall.
The controller of your personal data is Jakub Nowacki SwiftIT, Ks. Kazimierza Ciuby 14, 43-600 Jaworzno, Poland, NIP 6322036596, REGON 527957448 ("Circa", "we", "us").
For anything in this policy, including exercising your rights, write to privacy@joincirca.app.
All of it comes from you or from the sign-in provider you choose. We run no advertising, no analytics SDK and no cross-app tracking.
| Data | Where it comes from |
|---|---|
| Email address | The Google or Apple identity token you sign in with |
| First name, last name, display name | The identity token and what you type in onboarding |
| Avatar image URL | The Google identity token, where present |
| Account identifier | Generated by us; also sent to RevenueCat to key your purchase |
| Timezone and working hours | Your device, and anything you edit in Settings |
| Wake time, morning ramp, afternoon dip, peak focus, caffeine timing, sleep hours | The onboarding questions |
| Energy, focus and mood ratings, with their timestamps | Each check-in you make |
| Check-in tag names you create | Typed by you |
| Device push token | Your device, when you enable reminders |
| Subscription state and transaction records | Apple and Google, through RevenueCat |
Sleep, mood and energy are sensitive. We treat the sleep, mood and energy data you give us as health-related data under Article 9 GDPR and process it only on your explicit consent, which you can withdraw at any time.
| Purpose | Legal basis |
|---|---|
| Creating and running your account, authenticating you, keeping you signed in | Performance of a contract (Art. 6(1)(b)) |
| Storing your check-ins, building your energy profile, showing your zones, trends, badges and challenges | Explicit consent for the health-related parts (Art. 9(2)(a)), performance of a contract for the rest (Art. 6(1)(b)) |
| Generating daily insights and weekly refinements with a third-party AI model | Explicit consent (Art. 9(2)(a) and Art. 6(1)(a)) |
| Sending the reminders you switch on | Consent (Art. 6(1)(a)), withdrawable in Settings |
| Taking payment and managing your subscription | Performance of a contract (Art. 6(1)(b)) |
| Keeping transaction records for tax and accounting | Legal obligation (Art. 6(1)(c)) |
| Keeping the service secure and preventing abuse | Legitimate interests (Art. 6(1)(f)) |
Your daily insight and your weekly energy refinement are generated by Anthropic PBC (United States), using the Claude model family, acting as our processor under a data processing agreement.
What we send for an insight:
We do not send your email address, your name, your avatar or your account identifier. The model receives the data without those identifiers attached.
Anthropic processes this only to return the requested output. Under Anthropic's commercial terms your inputs and outputs are not used to train its models.
This is a transfer to a third country. It is covered by the European Commission's Standard Contractual Clauses together with the supplementary measures agreed with Anthropic.
If you withdraw your consent to AI processing, we stop sending your data for insights. The rest of the app — check-ins, zones, history — continues to work.
| Recipient | What for | Where |
|---|---|---|
| Our hosting and database provider | Running the servers, the database and the job queues | European Union |
| Anthropic PBC | Generating insights and energy profiles (section 4) | United States — Standard Contractual Clauses |
| RevenueCat, Inc. | Managing subscription entitlements and receipts, keyed by your account identifier | United States — Standard Contractual Clauses |
| Apple and Google | Sign-in, payment and the delivery of push notifications to your device | Per their own terms |
| Expo (650 Industries, Inc.) | Relaying push notifications to Apple and Google | United States — Standard Contractual Clauses |
We do not sell your personal data and we do not share it for advertising.
Under the GDPR you can:
Write to privacy@joincirca.app. We answer within one month.
Traffic between the app and our servers is encrypted in transit. Access to production data is restricted to the people who need it to run the service. Sessions are token-based and can be revoked; deleting your account revokes all of them.
Circa is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, write to privacy@joincirca.app and we will erase it.
If we change how we process your data, we update this page and the version at the top. Where the change requires it, we ask for your consent again in the app before the new processing starts.