Circa Privacy Policy

This Privacy Policy explains how Circa processes information when you use the Circa iOS app and its related marketing and support pages. Circa is operated by Ahmad Ali Tariq in Pakistan ("we", "us", or "our").

Circa is intended for adults aged 18 and older. Its calorie and macronutrient calculations are based on equations validated for adults, and the app asks for your age during setup and does not let you continue if you enter an age under 18. Age is self-reported; we do not verify it and we do not collect a date of birth.

You can create an account with an email address and password, with Sign in with Apple, or with Google Sign-In. Accounts are handled by Firebase Authentication, which processes your email address, a Firebase user ID, your authentication provider, a display name where one is supplied, and session and token information. Apple and Google process your sign-in under their own privacy policies.

If you use Sign in with Apple and choose Hide My Email, Apple gives us a private relay address instead of your own. Circa treats that address like any other email address and does not attempt to identify the address behind it. When you first authorize Sign in with Apple, the name Apple supplies is saved to your account's display name and used to fill in your name during setup.

Your email address is held by Firebase Authentication. It is not written into the app's database alongside your meals and profile, and it is not sent to the service that produces nutrition estimates.

Circa stores the profile and plan information you enter: your name, age, height, gender, goal, activity level, goal weight, current weight, when your plan started, and the calorie, protein, carbohydrate and fat targets calculated from them. Weigh-ins are stored individually with their date and whether they were entered by hand or imported from Apple Health.

This is health and fitness-related information in many places, and it is treated as such. Every record is stored under a path belonging to your account, and the database's security rules restrict access to the signed-in owner of that account.

When you log a meal, Circa stores what you typed, kept as you typed it, together with the meal's title, the time it was logged, the estimated calories and macronutrients, the breakdown of items and their quantities, the assumptions behind each item, where each figure came from, and any corrections you made. Saved meals store the same information so that a corrected version can be logged again.

For a photo entry, the description shown is Circa's reading of the image rather than words you typed, and the app identifies it as such.

Meal records, saved meals, weigh-ins and your profile are stored in Cloud Firestore under a path belonging to your account.

You can photograph a meal with the camera or choose an existing image from your photo library. A photo can incidentally contain people, places, documents or other information that happens to be visible, so please avoid submitting anything sensitive you would not want stored.

Before a photo leaves your device it is resized and re-encoded as a smaller JPEG. Because the image is rebuilt from its pixels rather than copied, metadata attached to the original file — including any location tag your camera recorded — is not carried into the copy that is uploaded or sent for analysis.

That copy is stored in Firebase Storage under a path belonging to your account, and a further copy is kept in the app's cache on your device so meals load quickly offline. Deleting a meal in the app deletes its stored photo as well as its record.

Circa sends the meal you describe, or the photo you take, to a backend service we operate on Google Cloud Run, which passes it to the OpenAI API to produce an estimate. For a photo, the image is first described, and that description is then analysed in the same way as typed text.

What reaches OpenAI is the meal itself: your typed sentence, or the image. Nothing identifying you is sent with it — not your name, age, height, weight, gender, targets, email address or account identifier. Your account identifier reaches our own backend only, inside the verified sign-in token that authorizes the request. The app also tells our backend which goal you are working toward, and that is used on our side rather than being passed to OpenAI.

Estimates are estimates. They can be inaccurate, incomplete, or unsuitable for your circumstances, and the app marks estimated figures as estimated. We do not claim that OpenAI never retains API data or never uses it for service improvement; what applies depends on OpenAI's current terms, our account settings, and the data controls available to us.

If you turn it on, Circa reads one thing from Apple Health: your body weight, over a rolling window of roughly the last 90 days, so your weigh-in history stays current without entering it twice.

Circa never writes anything back to Apple Health. It does not write calories, nutrition, meals, workouts or weight, and the app does not request permission to write to Health at all. It reads no other Health data type — no nutrition, no energy, no activity, no clinical records.

Weights imported this way are stored as weigh-ins in your account and marked as having come from Health. You can withdraw the permission at any time in the Health app or in iOS Settings. Because a later import would simply restore it, an imported weigh-in cannot be deleted individually in Circa; weigh-ins you entered by hand can be.

Apple processes payments, introductory offers, renewals, cancellations and refunds through the App Store. Circa does not receive or store your payment card details.

Circa uses RevenueCat to manage offerings, entitlements, purchase and renewal state, and restoring a purchase. The identifier Circa gives RevenueCat is your Firebase user ID, and it is the only identifier the app sends; it does not send your name or email address. RevenueCat's own SDK collects device and store information under its own policy.

Our backend reads your subscription state from RevenueCat and writes it to a private record under your account, covering your plan, whether an entitlement is active, the product purchased, the current period, and when it was last synchronized. It also keeps records needed to apply the AI usage allowance, such as your account identifier, the current usage cycle, the allowance, and how much of it has been used. Records of subscription events received from RevenueCat are retained for operational purposes.

Circa uses Firebase Analytics, Crashlytics and Performance Monitoring. These services may process app version, device and operating-system information, Firebase installation or app-instance identifiers, session and feature-use information, crash and non-fatal error reports, network and performance timing, and IP address or similar technical information. Your Firebase user ID is set on Analytics and Crashlytics, so this information is linked to your account rather than anonymous.

The app's own events record what happened, not what you ate. They cover sign-in and sign-out, whether a meal estimate was submitted, retried, succeeded or failed and whether it came from text or a photo, whether a weigh-in was saved, deleted or imported, saved-meal actions, onboarding progress, and whether a meal card was shared. Your meal text, meal photos, weight values, name and email address are never sent as event parameters. Diagnostic records attached to errors carry identifiers and status codes rather than content.

Our backend writes a log line for each request containing your account identifier, the route, the outcome and timings, and, where a request fails authentication, the IP address it came from. These logs do not contain your meal text or your photos, though diagnostic details from a failed request may be recorded.

Circa asks for camera access to photograph a meal, photo-library access to choose an existing image, and notification permission if you turn reminders on. You can change any of these in iOS Settings, and declining one limits only the related feature.

Reminders are scheduled locally on your device. Circa does not use remote push notifications, does not register a push token, and your reminder preference is stored on the device rather than in your account.

Circa does not request location, contacts, calendars, microphone or motion access. It does not use the advertising identifier, does not track you across other companies' apps and websites, and contains no advertising SDK.

We share information with the providers that operate Circa: Apple, for distribution, App Store purchases, subscriptions and Sign in with Apple; Google and Firebase, for authentication, database and file storage, backend functions, app attestation, analytics, diagnostics, performance monitoring and Google Sign-In; Google Cloud Run, for our backend; OpenAI, for producing estimates; and RevenueCat, for subscriptions and entitlements.

We may also disclose information where required by law, to enforce our terms, to address fraud, abuse or security incidents, or as part of a merger, acquisition, financing or asset transfer with appropriate safeguards. We do not sell personal information in the ordinary sense, and Circa is not used for third-party advertising.

Your account, profile, meals, saved meals, weigh-ins and photos are kept while your account exists, or until you delete the relevant content or the account, subject to legitimate legal, security, operational and backup requirements.

You can delete your account inside the app, under your profile. You are asked to sign in again to confirm, and the deletion then removes your meal photos from Firebase Storage, your usage-allowance records, your entire data tree — profile, logged meals, saved meals, weigh-ins and private subscription state — and finally your sign-in account itself. Deletion is permanent and the data cannot be recovered afterwards.

Some things deletion does not do, stated plainly. It does not cancel an Apple subscription; cancel that separately through Apple if you have one. It does not delete the customer record held by RevenueCat, or records of subscription events our backend received. It does not remove backend log entries, which contain your account identifier. Photos cached on your own device are removed when you delete the app. Apple, RevenueCat, backups and security records may retain information where needed for billing, fraud prevention, entitlement reconciliation, legal obligations or provider operations, so this policy does not promise a fixed deletion period for them.

We use reasonable technical and organizational safeguards, including authenticated access controls, database security rules that restrict each record to the account that owns it, per-account paths for stored meal photos, Firebase App Check with Apple's App Attest so that requests to our backend come from a genuine copy of the app, authorization checks on the backend, and HTTPS or TLS in transit. No system is completely secure.

Circa relies on providers that may process information in countries other than your own, including the United States. Firebase Authentication is operated from United States data centers, and other Google, OpenAI and RevenueCat services may process information on global infrastructure according to their own terms and settings.

We may update this policy as Circa changes. The latest version will be published at this URL.

For privacy questions, support, or help deleting your account, contact support-circa@ahmadtariq.co.