Privacy Policy

This policy explains what data MyCircal collects, how we use it, and the choices you have. We try to keep this plain. If anything is unclear, email us at privacy@mycircal.app.

1. Who we are

MyCircal is operated by Eirtec Ltd, registered in New Zealand. References to "we", "us", or "MyCircal" mean Eirtec Ltd.

2. What we collect

We collect only what we need to run the app.

Account information

• Name and email address, used to identify you to other group members and to send essential notifications.
• Password, stored as a one-way hash. We cannot see it.
• Profile photo, optional; uploaded by you.

Content you create

• Events, groups, purchases, settlements, and the messages you send within those.
• Files and images you attach (for example, receipts).
• Calendar and location data you choose to share with an event.

Technical information

• Device identifiers, used to send push notifications you've opted in to.
• Crash and diagnostic logs, to help us fix bugs. Stripped of personal content.
• IP address, kept in server logs for security and abuse prevention; rotated out after 30 days.

3. What we don't collect

• We don't use third-party advertising or marketing trackers.
• We don't sell your data. Ever.
• We don't read your group messages or events to train models.
• We don't access your phone's contacts, photos, or calendar unless you explicitly grant permission for a specific feature.

4. How we use your data

We use the information above to:

• Provide the service, show your events, sync across devices, deliver notifications.
• Keep the service safe, detect abuse, spam, and security threats.
• Improve the product, understand which features are used (in aggregate, never per-person).
• Communicate with you, service emails, security alerts, and (only if you opt in) product updates.

5. Who can see your content

Content you create in a group is visible only to other members of that group. We do not surface it to outsiders, and our team does not browse it. Access is limited to a small number of engineers who may need to debug an issue you've reported, with your consent.

6. Third-party services

We use a small set of vendors to run the service:

• Microsoft Azure, hosting and database.
• Apple Push Notification service / Firebase Cloud Messaging, to deliver push notifications.
• SendGrid, to deliver transactional emails.

These vendors process data on our behalf under data-processing agreements. We do not share your information with anyone else.

7. Optional integrations

If you choose to connect Google Calendar, iCloud Calendar, or Splitwise, we only request the minimum scopes needed and we never store your account password. You can disconnect at any time from Profile → Integrations.

8. Your choices

• Access & export, request a copy of your data by emailing privacy@mycircal.app.
• Correction, edit your profile and content from inside the app.
• Deletion, delete your account from Profile → Sign out → Delete account. Your personal data is removed within 30 days; content you posted to shared groups may remain as anonymous "former member" until the group owner removes it.
• Notifications, toggle per-channel in Profile → Notifications.

9. Children

MyCircal is not intended for users under 13. We do not knowingly collect data from children under 13. If you believe a child has signed up, please email us and we will remove the account.

10. International transfers

Our servers are located in Australia. If you use MyCircal from outside that region, your data will be transferred there.

11. Retention

We keep your data while your account is active. After deletion, residual backups are purged within 90 days.

12. Changes to this policy

If we change this policy in a way that materially affects you, we'll notify you in-app and by email before it takes effect.

13. Contact

Questions, requests, or complaints: privacy@mycircal.app.