Privacy Policy

Last updated: June 2026

Inner Circle ("we", "our", or "us") is a private social app for staying close with the people who matter most. This policy explains what information we collect, why we collect it, and how it is protected.

1. What we collect

• Email address — used only to send your one-time sign-in code. We do not send marketing email.
• Name and profile photo — set by you during onboarding, visible only to people in your circles.
• Home city — a single text field you enter. Never derived from your device's GPS. Visible only to your circle members.
• Presence (coarse location) — if you choose to share where you are, you pick a city from a list. We store the city name and country, never a precise coordinate. Presence is scoped to the circles you choose, expires on the date you set, and can be cleared at any time.
• Posts, comments, and reactions — content you create within a circle. Visible only to members of that circle.
• Trip information — trip plans, dates, itineraries, and expenses you create with your circle. Visible only to trip members.
• Memories — photos you choose to upload to a circle's memory album. Stored privately; visible only to that circle's members.
• Push notification token — a device token used to send you notifications about activity in your circles. Stored against your account and used for no other purpose.

2. What we do not collect

• Precise GPS coordinates at any point.
• Contacts, call logs, or any data outside the app.
• Browsing history or cross-app tracking identifiers.
• Payment information (Inner Circle is free; there are no in-app purchases).

3. How your data is stored and protected

All data is stored in a PostgreSQL database managed by Supabase, hosted on AWS infrastructure in the US (eu-west-1 region). Every table has Row Level Security (RLS) enforced at the database level: your data is only readable by you and the circle members you share it with — no server-side code can bypass this policy. Your media files (photos, avatars) are stored in a private object store and served only through authenticated, scoped URLs.

4. Third-party services

• Supabase (supabase.com) — database, authentication, and file storage. Privacy policy.
• Expo / Expo Push Notification Service (expo.dev) — used to deliver push notifications to your device. Only your push token and the notification payload are passed through. Privacy policy.

5. Data sharing

We do not sell, rent, or share your personal information with advertisers or data brokers. We do not share your data with any third party except the infrastructure providers listed in section 4, where strictly necessary to operate the app.

6. Data retention and deletion

Your data is retained for as long as your account exists. You can delete your account at any time from Settings → Delete account, which permanently removes your profile, posts, presence records, and messages from our database within 30 days. Certain aggregate, anonymised records (e.g. notification delivery logs) may be retained for up to 90 days for operational purposes.

7. Children

Inner Circle is not directed at children under 13. We do not knowingly collect information from anyone under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Changes to this policy

We may update this policy from time to time. We will notify you via the app if we make material changes. Continued use of the app after changes are posted constitutes acceptance of the updated policy.

9. Contact

Questions or requests? Email us at get.inner.circle.app@gmail.com.

Inner Circle — A private home for the friends life scattered apart.