Privacy Policy

Who we are

CircleNest is a private family scheduling app. Parents and guardians use CircleNest to coordinate playdates, plans, and trusted family circles. This Privacy Policy explains what information we collect and how we use it.

Children's privacy (COPPA, GDPR-K & India DPDP)

CircleNest is intended for adults (16+) and parents/guardians acting on behalf of their children. Children under 13 cannot create or log into their own account. Information about a child (name, age, photo, allergies, availability) is only added by a parent or guardian who has agreed to this policy on the child's behalf.

Kids aged 13+ may receive their own login only if a parent invites them. We never knowingly collect personal information directly from a child under 13.

India DPDP Act 2023 compliance: Under India's Digital Personal Data Protection Act, 2023 (and the DPDP Rules, 2025), we are required to obtain verifiable consent from a parent or lawful guardian before processing any personal data of a child (defined as anyone below 18). By creating a CircleNest account and adding kid profiles, the parent or lawful guardian gives that consent on behalf of their child. We do not track, profile, or target advertisements at children. Our processing is designed to be "verifiably safe" for children: all child data is parent-managed, circle membership is parent-approved, and no behavioural monitoring or targeted advertising is directed at children.

Parents can review, edit, export, or delete their child's information at any time from Household or by contacting us.

What we collect

• Account: name, email, avatar.
• Kid profiles you create: name, age, photo, allergies, availability.
• Plans, circles, messages, and RSVPs you create or receive. Plan locations are optional and visible to invited families.
• Photos and files you share in circle or household chats (stored securely; only members of that chat can access them).
• Household lists: your default shopping list and any custom lists you create, including item names, quantities, notes, and check-off status. Shared with all members of your household.
• Kid requests: titles, notes, suggested dates, and request types your kids send to adults in the household.
• Future letters: time-locked letters you write to a child, stored until the unlock date you set.
• Timeline favorites: which timeline entries you have starred.
• Optional Google Calendar tokens (only if you connect calendar sync).
• Push notification subscriptions: if you opt in, your browser's push endpoint and encryption keys are stored so we can deliver plan reminders and invites.
• Browser storage: small items in localStorage (theme, last-seen flags, your accepted terms version) and standard session cookies for sign-in.
• Basic technical data (device, browser, error stack traces, page URL, IP address) to keep the app running and to debug crashes.
• Product analytics (feature usage, page views, button clicks, conversion funnels) to understand how people use the app and improve it.

Third-party services we use

• Lovable Cloud — hosts the app, database, file storage, and authentication.
• Sentry — receives crash and error reports (stack traces, browser info, page URL, IP address) so we can fix bugs. No plan content or kid profile data is sent.
• PostHog — receives product analytics (page views, feature usage, conversion events) to help us understand and improve the app. No plan content, messages, or kid profile data is sent.
• Lovable AI Gateway (Google, OpenAI) — processes AI Assistant prompts; see section below.
• Google Calendar — only if you connect calendar sync.
• Web Push — your browser's push service (e.g. Apple, Google, Mozilla) delivers notifications you opted in to.

How we use it

To run the service: showing your circles, syncing plans, delivering notifications, and keeping accounts secure. We do notsell your data, and we do not show third-party ads.

Who can see your family's data

Your kid profiles are visible only to you, your co-parents, and other adults who are approved members of the same circles you include those kids in. When you add a kid to a circle or invite a kid to a plan, other approved adults in that circle can see the kid's name, age, photo, and availability.

Circle chats and plan conversations are visible only to members of that circle or plan. Photos and files shared in chats are accessible only to members of that specific chat.

Plan locations are visible to all invited families.

Household lists and kid requests are visible to all adults in your household. Kids can see and create their own requests; accepted requests may be added to your default shopping list.

Future letters are visible to you (the author) before the unlock date. After the unlock date, they become visible to the child they were written for and to adults in your household.

Shared timeline collections and yearbook PDFs use public, link-based sharing. When you tap "Share" on a kid's timeline or generate a yearbook, we create a link that anyone with the link can open without signing in. Treat these links like a public URL: only share them with people you trust, and revoke them from the share screen when you no longer want the link to work. Yearbook PDFs are stored in our file storage with time-limited signed URLs.

AI Assistant

When you use the in-app AI Assistant, your prompt and minimal app context are sent to third-party model providers (currently Google and OpenAI) via the Lovable AI Gateway to generate a response. Providers process requests to return a result and, per their agreements with the gateway, do not use this content to train their models. Avoid putting sensitive personal information in prompts.

Data retention

We keep your account data while your account is active. When you delete your account, your profile, the kid profiles you parent, plans you hosted, circles you created, and messages you sent are removed within 30 days. Backups and crash logs may persist for up to 90 days before being overwritten. Push subscriptions are deleted immediately when you turn notifications off or sign out.

Your rights

• Export your data — Profile → Account → Export my data.
• Delete your account and your kids' profiles — Profile → Account → Delete account.
• Disconnect Google Calendar at any time from Settings.
• Turn off push notifications at any time from Settings → Notifications or in your browser settings.
• India DPDP rights: If you are in India, you have the right to access, correct, update, and erase your personal data; the right to grievance redressal; and the right to nominate another individual to exercise your rights in case of death or incapacity. Contact us to exercise any of these rights.

Grievance officer (India)

Under the Digital Personal Data Protection Act, 2023, users in India may raise concerns about personal data processing through our grievance mechanism. Please reach out via Send feedback and mark the subject as "Data Grievance — India". We will acknowledge your complaint within 48 hours and aim to resolve it within 30 days. You may also escalate unresolved grievances to the Data Protection Board of India.

Changes to this policy

When we make material changes we update the date above and ask you to re-accept on next app load. Continued use after that means you agree to the updated policy.

Contact

Questions or requests? Send us a note from Send feedback.