← circin.org

Privacy Policy

Last updated: October 13, 2026

The short version: Circin now has accounts, and an account means we hold some of your things on our side, including a backup of what the app has saved. Without one, what the app saves stays on your device; what Circin keeps is a counted view, a short count per network address that limits abuse, and whatever you choose to send.

This policy replaces an earlier one that said the app collected nothing. That was true of the first preview and is no longer true: Circin has real accounts, real publishing and real conversation, and those need a server. Everything below is what this version of Circin’s code stores, the version the date above belongs to. Where a sentence says “since this version”, it means since this version reached circin.org; what was made on Circin before then was handled by the older code. Older copies of circin.org that Cloudflare keeps at addresses of their own run the code they were built with, against the same storage as circin.org, so a request sent to one of those addresses is handled, and what it leaves is kept, by older rules than this page describes. A copy built from another branch of the code runs against whatever storage Cloudflare’s preview settings give it. Circin’s owner can delete these copies, apart from the newest copy of each branch, which Cloudflare keeps. A copy made from this version on answers Circin’s API and media only at www.circin.org; its pages and creator pages still answer at its own address, and those only read.

	No account	Signed in
Your email address	Only if you submit the launch list or hold a username. Neither is an account.	Kept, with your username, display name and a salted hash of your password
A counted view	For twenty-four hours, the video’s id with a salted one-way hash of the network address the view came from and another of a random id your device made up, both keyed by a secret on Circin’s server and by the video	For twenty-four hours, the video’s id with a keyed hash of your account, made the same way
What the app has saved: settings, collections, drafts, likes, recent searches, video notes	Whatever there is stays in your browser or on your phone	Also in your backup, capped at one megabyte
Watch history, used for three days	None while you browse as a guest; on your device for a profile that lives only there	Also in your backup
Creators and topics you hid or blocked	On your device	Also in your backup. A block is kept on Circin so it holds on both sides.
Posts, comments, follows, ratings	Nothing to store	Kept on Circin, tied to your account
Daily time watched, parent PIN, birthday, a kid profile	Never sent	Never sent

Swipe the table →

If you never make an account

You can watch, search and browse without one. We set no tracking cookies and use no analytics, and what you do is kept in your browser or on your phone. Like any website, your browser or phone asks us for what it shows — the catalogue, the videos you play, and their comments and ratings — from your network address; we answer those requests without storing them, apart from a count for each network address that limits abuse and expires two hours after it last changed. Five things are kept, the last four only if you ask for them:

• Counting a view — once a video has been playing, or trying to play, for three seconds in the player or the lesson view, or has been the current video in the feed, not paused, for three seconds in all (played or not, and a pause holds the count: see Views), the app sends the video’s id and a one-way hash of a random id your device made up for itself, with the number three, the mark it has just passed; the server checks that number and keeps it nowhere. How long you went on watching, and which part, are not sent. Described in full below.
• The launch list — if you submit the “get notified” form we keep the email address you typed, with the page and the form it came from, the platform (the website or the iPhone app), your language setting, the country, when the entry was made and last changed, and whether its confirmation has gone out. Circin does not check that the address is yours. If you said you create, the topic you gave and whether you already create are kept too, and, while that step is switched on (it is by default; for about a minute after Circin’s owner switches it, a signup can still go by the old setting), the address also goes on a list of interested creators that Circin’s owner works from. There it keeps, with no expiry, the address, the topic, whether you already create, when it was added and last moved, and where the owner has got to with you (invited, joined and so on), with the owner’s notes on each move: the last thirty, each with the owner’s email address, its time, the move from one stage to the next and up to 300 characters of note. A tick in the box for other updates is kept only as a request, not as consent, and no updates are sent on it; sending the form again with the box unticked takes the request back. An entry made before this version may still carry an old tick in its consent field; nothing in the code sends mail on it. Once Circin’s email is set up, an address’s first submission gets a confirmation; one made before then, or whose sending failed, gets it only when Circin’s owner runs the catch-up in the Admin. Circin’s owner can switch the confirmation off (it is on by default). A signup made while it is off is sent none, at the time or by a catch-up later. A switch takes up to about a minute to reach every part of Cloudflare’s network, so a signup made in the minute after it is switched off can still be sent one, and one made in the minute after it goes back on may be sent none. The other exceptions the code knows of are two: a signup from an off spell whose switch off and switch back on are both missing from the Admin’s record, and a signup from an address taken off the list by hand, made within sixty days of the last signup from that address that the confirmation ran for. A catch-up mails the first as if it were still waiting. The second, made while the confirmation is on, gets it only from a catch-up; made while it is off, it is mailed by a catch-up that runs before those sixty days are up. In the same way, an address taken off by hand that signs up again as a creator within sixty days of the signup that put it on the list of interested creators does not go back on that list. The email telling the list about launch day is not built yet, and nothing else is sent to the list. Submitting the form does not create an account. To come off the list, you can write to circinofficial@gmail.com, and the address is taken off by hand. While those steps are switched on (they are by default, give or take a minute after the owner switches one), each signup also leaves a record of them, such as that confirmation, for sixty days, named by a short digest of the address made with no secret: anyone who can read Circin’s storage could test a guessed address against it, and it stays after the address is taken off the list.
• Holding a username — if you reserve a name before launch we keep that name, the email address you gave and when you made the hold, so the name opens only to you. Circin does not check that the address is yours. Also not an account. The hold ends when you make an account with that email address, under that name or another, or when you release it from the device that made it; one nobody uses has no expiry set yet.
• A report you file — what you reported, the reason and any words you added, so a person can act on it. Without an account it carries no name. No retention period is set for reports yet.
• A question you send through the website — its words, the page it was sent from, the country and the time, with no name and no email address, so Circin’s owner can read what people are curious about. No retention period is set for these yet, and they are removed by hand.

One more, if you turn on notifications: your browser hands us a push subscription — an address its own push service gave us, plus the keys needed to encrypt a message to it. It has no account attached and no expiry, and today the app gives you no way to withdraw it: the app’s own switch points you to your browser’s or phone’s settings, and turning notifications off there stops them showing, but the subscription stays on our side until a send from Circin finds that the push service has retired it, even after you clear site data or uninstall. (When Circin’s push key changes, the app, the next time it is opened with notifications on, withdraws its subscription and makes a new one under the new key. If making the new one fails, the app’s switch turns off. If Circin does not get the withdrawal, the old subscription stays on our side beside the new one until a send finds it retired.) Writing to us does not help yet: the subscription is filed under a hash of the push service’s address, with no account or email address, and the app does not show you that address, so we have no way to tell which one is yours.

If you make an account, we store

• The account itself: your email address, your username, your display name, and your password — never the password itself, only a salted PBKDF2 hash of it. Sign-up asks your birthday and sends nothing, not even your email address, until that birthday says 13 or older; it is used only to choose the path that fits your age (under 13 it offers Circin Kids instead). It is not saved on your device and not sent to us. It is the date a person types; Circin has no way to check it.
• A backup of your own app data, so signing in on another phone gives you your things back. It is not a chosen selection: it is everything the app has saved on that device — your collections, drafts, profile, who you follow, what you liked and rated, your watch history, your recent searches, the notes you write on videos, the reports you filed with your words, your settings, and the videos, creators and topics you have hidden or blocked. The public catalogue and video thumbnails are stripped out; the rest goes as it is. It is capped at one megabyte, it is written only when you are signed in, and we do not read it for any other purpose. It is held as plain text, not encrypted, so the people who run Circin’s Cloudflare account could read it; Circin’s code reads it only to hand it back to your own signed-in session.
• What you publish: the video or picture files themselves, and the record around them — title, description, subject, tags, length, and the edit list that tells a viewer's app how to play it. Each upload’s record also keeps its size and the name the file had on your device, which is not shown to anyone. A file is served openly only while a live post of yours uses it, and one file can be used by several of your posts. Making a post private, or archiving it, keeps its file on Circin, where you can play it as a preview. Circin’s owner can be handed a preview link to it too (the answer to a review decision on the post carries one), and a preview link plays for whoever holds it, for an hour. Apart from such a link, and unless another of your live posts uses the same file, it stops being served once Circin has the change, which elsewhere in Cloudflare’s network can take up to about a minute. The app sends the change straight away. If it does not go through (offline, refused, or a session that has ended), the app sends it again each time it starts, comes back online or signs in, while it is signed in to your account; until then the post stays public. A copy a browser or a cache fetched while the post was public can stay there for up to a year. Deleting the post deletes the file, so any other post of yours that uses it loses it too. One you never publish is kept until you delete it, or delete your account. Deleting an upload removes the file, and its record, with the size and the file’s name, stays, marked removed.
• Where a photo or video was taken is taken out of the file before it is stored, by the same step on Circin’s server and in the app when you pick the file. In JPEG, PNG and WebP pictures every metadata block goes except the few that keep the picture looking the same (its orientation and colour profile); in MP4, MOV and M4A files the location entries a phone writes are blanked. That step has limits: WebM and MP3 files are stored as they came, and so is a location carried in a form it does not read — a drone’s or action camera’s telemetry track, a camera maker’s own entry, a compressed header — or typed into a title or a file name, and so is the rest of a video past the point where the step stops walking it: after its first sixty-four top-level boxes, after 256 reads of 64 KB, or where its box sizes, or the file’s own length, do not add up. Files uploaded before this version keep any location they carried, and so do copies of them a browser or a cache has already fetched; no tool to process stored files again is built yet, so deleting a file and uploading it again is the way the code has today.
• What you write: comments and replies, with your username and display name, and which comments you liked.
• Who you follow, and who follows you.
• Who you have blocked, and who has blocked you. A block is kept on Circin so it can be enforced on both sides. Your list is returned only to you. The other person finds that following you, commenting on your videos, or replying to or liking your comments is refused. The app does not say why, but the answer behind it reads “blocked”, so someone who has blocked nobody can work out that they were; nothing says which of you made the block. While signed in, each of you stops seeing the other’s comments. A block is used to keep the two accounts apart and for nothing else.
• Ratings you give, one per video, filed under your email address. How many people rated a video is public. Its average is shown once five people have rated, in half stars; below five, no average is shown. Which star you gave is returned only to you, not to the creator or anyone else. That does not hide it completely: someone who checks after every new rating can sometimes work out one person’s star. In Circin’s own test, with twelve ratings on each video, that was 2.5% of single ratings when stars were spread evenly and 6.4% when about half were fives; a model run outside that test, at twelve and at thirty ratings, put it at 1–3% and 6–10% for those two spreads, and narrowed 11–22% of ratings to one of two stars. Changing your rating can show as a shift in the average.
• Requests you post to the knowledge-demand board, and your upvotes, both filed under your email address. Asking anonymously hides your name from everybody else; the request still keeps your email address, so you can take your own request down.
• Notices waiting to be shown to you, such as a reply or a review decision. Each is kept for ninety days, and a copy stays in your list of them, which has no expiry, until two hundred newer ones push it out. A notice copies who sent it and some of what they did: the sender’s username, unless it is a request asked anonymously; the video’s title, for a comment, a reply, a like or an answer; for a comment or a reply, their display name and the first 90 characters of their words; for an answer to your request, the creator’s display name and the first 120 characters of your request; for a request made of you, its first 120 characters; for a like, the first 90 characters of your comment that was liked. When a comment or reply is removed, its notice is taken back, and when it is edited, the notice takes the new words — for comments made since this version. Other notices are not taken back. A few can linger: one whose removal crossed another write at the same moment, until a later check of the inbox takes it out; one whose comment was edited at the same moment it was removed, which can come back with the edited words; and one on a day Circin’s storage has used up its daily writes.
• Reports you file, so a person can act on them and tell you what was decided. A report keeps your username and your words, Circin’s owner reads it, and no retention period is set for reports yet.
• Sessions: a random token for each device you are signed in on, valid for ninety days; Circin keeps a hash of the token, with your email address and when it was issued. Changing or resetting your password signs out every other device — each is refused the next time it is used (elsewhere in Cloudflare’s network that can take up to about a minute) — and, when Circin’s email is set up and the day’s mail allowance has room, mails your address a notice that it happened. While you sign up or reset a password, the code mailed to you is kept for fifteen minutes, and a mark that it was sent for ten minutes, so a second message is not mailed in the meantime; once a sign-up code is used, a hash of the proof it hands your device is kept for thirty minutes. Each is filed under your email address. Failed sign-ins on an account are counted under its email address for about an hour.

Views

We count that a video was watched, once per watcher per day, after three seconds with it (those can be three seconds in which it did not play: below). The count goes to the creator of that video and to nobody else. To count once rather than every replay we store short one-way hashes for twenty-four hours: of your account if you are signed in, and otherwise of a random identifier your device made up for itself and of the network address the view came from. Signed out, a view counts only when neither has been counted for that video today, so a classroom on one network counts once. In the player and the lesson view, the app sends the view once the video has been playing, or trying to play, for three seconds in all: a pause holds the count, and a file that is still loading, or that failed to load, still counts. In the feed, it sends it once a video has been the current one, not paused, for three seconds in all (pausing, going to another of the app’s tabs or opening the full-screen player holds the count; moving to another video starts it again), even if it did not start playing: when your autoplay setting kept it from starting, or while something is open over the feed — a profile, a subject page, settings, a report, a lesson view opened from the feed, the screens for signing up, logging in and getting started, or the launch screen the app shows for under three seconds as it opens, so a video can be counted under a second after the feed first shows. That video also goes into your watch history, where the app keeps one (not while you browse as a guest, or while history is paused). The view carries the number three, the mark it has just passed; the server checks that number (under three it counts nothing) and keeps it nowhere. How long you went on watching, and which part, are not sent, and the daily time watched stays on your device.

Each hash is keyed: it is made with a secret held on Circin’s server and mixed with the video’s id (HMAC-SHA-256). Without that secret, a stored hash does not lead back to an email, an address or a device, and one watcher’s hashes on two videos do not match. That is not the same as unreadable: whoever holds the secret could test a guessed email or address against one video’s hash, and because one watcher’s hash on one video comes out the same each day, two lists taken on different days show that someone came back to that video, though not who. If the server has no secret of at least thirty-two characters, it counts no views at all rather than keep a weaker hash. The hashes are used for that count and nothing else. A view is still counted while your watch history is paused. Kid profiles are excluded entirely.

What stays on your device

Recordings and clips until you choose to publish, the birthday sign-up asks for (read to choose the path, then not saved), your parent PIN, how long you have watched each day and where that time went (which feed or page and which subject, and, while your watch history is on and you are not browsing as a guest, which creator and video; the app trims it to the last eight days each time it adds a second), and everything belonging to a kid profile — none of which is sent to us, apart from a kid profile’s parent email when a parent asks for a PIN reset by email (the summary above says what is kept). Where you are up to in a video is held only while Circin is open, and saved nowhere, on your device or ours. Which slide you reached in a post made of slides, such as a photo post, in the feed or the player is saved on your device, and is in the backup once you sign in; one opened in the lesson view starts at its first slide each time, and the slide it reaches there is not saved.

Some things are on your device and are also in the backup above once you sign in: your watch history, your recent searches, the notes you write on videos, your own copy of the reports you filed, and the list of videos, creators and topics you have hidden or blocked. Signed out, the app's copies stay on the device (a report itself is sent either way, so a person can act on it); browsing as a guest, the app keeps no watch history at all. Signed in, they travel with everything else the app has saved, because the backup is the whole store rather than a chosen part of it.

The watch history holds, up to the newest hundred, each video you open in the player, apart from your own opened from Your videos, and each one that has been the current video in the feed, not paused, for three seconds in all, played or not; past a hundred, the oldest leave early. One you reach by swiping or moving on inside the player, or a post opened in the lesson view, is not added. The app uses the history for three days so the feed stops repeating itself. Entries older than that leave the device, and then the backup, the next time a video is added or you remove an entry or clear the history; while history is paused nothing is added, so they stay until you remove an entry or clear it. You can clear your history in the app, and pause it entirely; pausing it does not stop a view being counted (Views, above).

Children

A kid profile lives on a parent's phone behind their PIN. It is not an account, it does not sync, and Circin keeps nothing about what a kid watches, searches or does on it: the app asks Circin for the catalogue and the videos it plays, as any website would, and sends no name, no history and no counted view. Circin Kids can also be on with no kid profile open, a state the app’s code allows for (a parent handing the phone over while still signed in as themselves). What the child does then is not saved into the account that was open: a search the child taps through, the subjects and topics picked under Categories and the slide reached in a post made of slides are not written to that account’s store, so they do not reach its backup either, and a video the child watches is not added to its watch history, because the app treats a Kids session with no kid profile open as a guest. The one piece of a kid profile that leaves the phone is its parent email, when a parent asks for a PIN reset by email; the summary at the top says what is kept of it. Our server refuses to store a kid profile. A kid cannot comment, message, follow or be followed.

What we do not do

We do not sell your data, we do not share it with advertisers, we run no third-party analytics or tracking, and we do not build an advertising profile of you. Circin has no subscriptions and never will. Your IP address is used for abuse-prevention rate limiting, as counts kept under the address that expire within two days, and, as a keyed hash mixed with the video’s id, to count a signed-out view once a day; it is not stored against your account.

Deleting your account

Deletion happens straight away, with no undo and no recovery window, so download your data first if you want a copy — the app gives you the file immediately rather than emailing a link. The file is what your device has saved; the copies Circin keeps on its side are not read into it. The account stops signing in at once (elsewhere in Cloudflare’s network that can take up to about a minute). Your posts, comments and uploaded files come down in the minutes after, while the app carries the take-down on; if it stops before the end, for example because the app was closed, the rest stays up until Circin’s owner finishes it.

Erased: your synced backup; the video and picture files you uploaded, which are deleted from storage (the record of each upload stays, marked removed, with its size and the name the file had on your device, and a browser, or any cache between it and Circin, that already fetched a file may keep its copy for up to a year); the session on the device you deleted from; the take-down’s own working record, which holds your email address until it finishes; and the notices your comments and replies sent, for comments made since this version.

Taken down but not erased: your posts and your comments. Each is marked removed and leaves every feed, list and page, but the row itself stays, with its text, the username that wrote it and its times, so that replies to it keep their shape and a moderation decision keeps its record. The display name is blanked on each removed comment; a removed post’s record keeps it. Nothing in Circin brings a removed post or comment back on purpose; a write that crossed the take-down at the same moment can list one again for a short while, and the take-down’s second check takes it down again. The app makes that check about two and a half minutes (the default wait) after the take-down’s last change, if it is still open; if it was closed, the check waits for Circin’s owner to finish the take-down, and a post listed again stays up until then. We would rather tell you that than claim an erasure we do not perform.

Kept on purpose: your username, retired rather than released, so nobody else can take it and inherit what was addressed to it. Your account row is replaced by a marker holding that retired username and the date — your email address, your password hash and your display name are gone from it — but the marker is still filed under your email address, with no expiry.

Not reached by deletion today. These stay after an account is deleted, and we would rather list them than leave them out:

• Sessions on your other devices. Each is refused the next time it is used and removed then. One that is never used again keeps its record — when it began, and your email address — until it expires at ninety days.
• The launch list, if you joined it, and the list of interested creators, if you said you create. Your address, any topic you gave and the owner’s notes on you have no expiry there; they are taken off by hand if you write to circinofficial@gmail.com.
• Likes, follows and ratings. Your likes on comments still count in the public like totals. Your follows still count for those creators and appear in their follower lists under the retired username. Your ratings stay in each video’s average, filed under your email address.
• Requests on the knowledge-demand board, which stay public under the retired username (or with no name, if you asked anonymously) and keep your email address in the record, and your upvotes on others’ requests, each filed under your email address.
• Blocks and reports. Blocks you made, blocks others made of you, the reports you filed, which keep your username and your words, and reports other people filed about you, which can hold your username and, for a comment of yours, its words. None of these has an expiry yet.
• Notices you sent other people, apart from those of comments and replies made since this version. A follow or a like names your username (a like’s notice also carries the video’s title and the first 90 characters of the comment you liked, which are the recipient’s own words); a request carries its first 120 characters, and names you unless you asked anonymously; an answer you gave to someone’s request names your username, your display name and your post’s title, with the first 120 characters of their request, and a post you sent for review (that notice goes to Circin’s owner) names your username, your display name and the post’s title. Each lasts ninety days, and its copy in the recipient’s list stays until two hundred newer notices push it out.
• Copies a recipient’s app already fetched. When a comment’s notice is taken back, the app lets go of its copy at its next check for notices while it is signed in; a copy older than the two hundred newest notices that check lists stays. A device that never checks again keeps its copy, and so does that device’s backup.
• Your own inbox: the list of notices sent to you, which has no expiry, and each notice in it for ninety days. They hold other people’s usernames, display names and words.

Where it is held

On Cloudflare, our hosting provider. Launch-list emails, and the questions you submit through the website (which carry no name or email address), are stored the same way, with the page and the country the request came from; a launch-list entry also keeps your request for updates, if you made one. No retention period is set for these yet, and they are removed by hand.

Email Circin sends — sign-up and reset codes, the notice that a password changed, the launch-list confirmation and a parent’s PIN reset code — goes out through an email delivery service (Amazon SES, Postmark, Resend or MailChannels, whichever this deployment is set up with). That service receives the address and the message, and keeps them in its own logs for as long as its own settings say.

Circin’s code keeps no log of the requests it answers; the Admin keeps a list of the owner’s own actions, its newest three hundred, which can name the record acted on. That list can name a person’s email address, with the owner’s note on them (a move on the list of interested creators), or username (an account take-down), and it keeps the network address behind a change to the owner’s own password and behind a push broadcast or announcement sent with the admin key. A launch-list signup also leaves a record of the steps it set off for sixty days (the launch list, above). Cloudflare can keep request logs for it (Workers Logs, Logpush) if Circin’s owner turns them on; this code does not turn them on, and if they are turned on, how long they are kept has not been decided yet. One setting made for testing would write the names of storage keys to such a log, and some of those names hold an email address; Circin’s deployment notes keep it off in production.

See also our Terms of Service and Community Guidelines.

Questions? circinofficial@gmail.com