What we protect, and how we say it plainly.

CircleNest is paid for by families, not advertisers. There is nothing to gain from profiling your household, so the product isn't built to.

• No advertising and no data selling. We do not sell or rent your data, and we do not build advertising profiles from it. If that ever changes, we will tell you in advance.
• First-party measurement only. We use our own analytics and crash reporting to see which screens are used and what breaks — not third-party ad or cross-site trackers.
• No live map or location history. If you turn on Peace of Mind, you learn whether a child reached a place you named. No coordinates leave the child's device, no trail is stored, and silence is never presented as an alarm.

The reasoning behind these boundaries — no public feed, no ranking of other families — is on why CircleNest exists. Retention periods and how to make a data request are in the Privacy Policy.

Children are part of family life, so they are part of CircleNest — but on a narrower footing than adults. A child's presence here is something a parent grants and can withdraw.

• Children are not publicly discoverable. A kid appears only to people a parent explicitly connected them to. There is no search, no suggested-friends surface, no profile for outsiders to find.
• Requests route to a parent first. When a child asks for a playdate or wants to join something, the request goes to their own parent — never straight to another family.
• Capability has an age ceiling, and you can only tighten it. What a child may do is decided on our servers from their age band, their region and your settings — in that order, each one narrowing the last. Reaching an older band can raise the ceiling, and it never overrides a limit you set: your choices carry forward, and turning something on can never lift a child above their age ceiling. Because we only know a child's birth month, a band changes only after that month has fully passed.
• A child's check-in is an action your child took, not a verification. We report what your child tapped and when we received it. It is not verification of where they are, who they are with, or whether they are okay, and we do not confirm any condition on their behalf. There is no button that lets a child declare themselves safe.
• “Get my grown-up” reaches parents and co-parents — and nothing beyond that. This urgent request goes to every adult who currently holds parent or co-parent authority for that child, resolved fresh each time it is sent. It never reaches caregivers, trusted families, circle adults, plan participants or guests. If no such adult can be reached, we tell the child plainly and ask them to find a grown-up nearby — we never widen the audience to compensate.
• For the youngest children (under about 4), “Get my grown-up” is off until you turn it on. At that age the button is not shown at all unless a parent or co-parent switches it on for that child, in the child's controls. Turning it on never widens anything else, and you can turn it off again at any time — it disappears on the child's next tap without re-pairing the device. From about age 4 it is available by default and can be switched off.
• We can't promise a message was seen. We confirm to a child that CircleNest received their message. Receipt, reading and a response are not guaranteed, there is no timer or escalation chain, and this is not a monitoring or emergency service.
• Calm by default. Kid notifications are content-free on the lockscreen and pause during a nightly quiet window in the child's own local time. No streaks, no nudges, no reward loops.
• Group schedule: participation without exposure. Where a parent grants it, a child can read the plans they're included in in a circle — a read, granted by a parent, that creates no new contact path in either direction.
• Designated circle conversation: parent-granted, never private. A parent can let an approved teen read — or read and write plain text in — one designated circle conversation. It defaults to off, shows only messages written from the moment it starts, sends the teen no notification, opens no files, creates no direct-message or trusted-adult path, and decides no plan, ride or consent. A qualifying parent can read that same conversation; anyone in it can report a message. When a parent turns it off, access stops immediately.
• Teen notes-to-self stay private in the app. Parents cannot read them. We may still have to disclose content if legally compelled, which is why we say 'private in the app' rather than 'private from everyone'.
• "My Goals" (10+) is self-owned, and stays inside the app. A young person aged 10 or over can write a goal, a few steps and an optional date. Only they can see it: there is no parent view, no notification, no reminder, no score or progress measurement, and nothing is copied into timelines, yearbooks or memories. Asking for help uses the existing 'Ask a grown-up' request, which the young person starts. The text is screened by the same controls as any other text a child or teen writes here. As with notes-to-self, we may still have to disclose content if legally compelled.

How we handle kids' privacy covers consent, age handling and deletion in full.

Access follows the real relationship rather than one flat member role. This is the reference version: every capability, every kind of person, including what we deliberately don't allow.

Not every tool appears everywhere. Each capability shows up in the family context where it belongs, so Scoped means available only in the people, roles or situations where it applies — not a half-finished feature.

Invite links are scoped to the invitation they were sent for. They let someone reply to that one plan or window without an account, and they don't open the rest of your account or your family information. Because a link can be forwarded, treat it as shareable by whoever holds it — you can turn any invite link off at any time.

Most disputes about family software are about authority — who can decide, who can leave, and what happens to years of material afterwards. We answer those before they're urgent.

• Co-parents are equal, with brakes. Two parents share one household as equal seats. Sensitive actions one starts can be paused so the other has a chance to weigh in.
• Adults who help don't gain authority. A step-parent, grandparent or caregiver can see the schedules and threads they are part of without being able to change settings or approve requests.
• You can take it with you. Export what your household has kept. Delete your account and it stays recoverable for 30 days before removal.
• Stopping payment does not lock your memories. If a subscription ends, what you already kept stays viewable and exportable; new uploads pause until there is room again.
• Someone can step in. You can nominate a legacy contact so people you trust can act for your household if you no longer can.

We keep this description behavioural rather than architectural. Naming specific internals publicly helps attackers more than it helps families.

• Data is encrypted in transit and at rest. Traffic uses HTTPS, and stored data and files are encrypted by the infrastructure we run on. CircleNest is not end-to-end encrypted — support and legal obligations require that we be able to operate the service.
• Access is scoped per household. Every read and write is checked against who you are and what your household is allowed to see, at the database layer rather than in the interface.
• Sign-in protection is yours to tighten. You can require a device unlock before CircleNest opens, review the devices signed in, and end any session you don't recognise.
• Vendors are few and contracted. We use a small number of infrastructure providers under data-processing terms, listed in the Privacy Policy, and add them deliberately rather than casually.
• Problems get reported, not buried. If you find something that looks wrong, tell us through Support. We investigate, and we notify affected families as our policies and the law require.

A trust page that promises everything is worth nothing, so here is the other half.

• We do not verify people. CircleNest does not run background checks or confirm that anyone is who they say they are. Trust here reflects your judgement, not our vetting.
• We are not a monitoring or emergency service. CircleNest is not a security system, a supervision tool, or a substitute for contacting someone directly or calling emergency services.
• No software is risk-free. We work to protect your data, and we don’t promise that nothing will ever go wrong.