Privacy Policy

Effective date: 28 August 2026

English is the controlling version of this Privacy Policy. Translations are provided for convenience only.

1. Who we are

This Privacy Policy describes how YiCircle LLC ("YiCircle", "we", "us", "our") collects, uses, discloses, and protects personal information when you use the YiCircle mobile or web application or any related services (collectively, the "Service"). YiCircle LLC is the controller of that information.

If you have questions, contact privacy@yicircle.com.

2. Information we collect

We collect personal information in three ways: (a) information you give us, (b) information collected automatically, and (c) information from third parties.

2.1 Information you give us

• Account & profile — name or handle, email, phone (if added), date of birth (if added), profile photo, bio, languages, city/region, interests.
• Identity / payment — for sellers using paid features, identity and payout information is collected directly by Stripe through Stripe Connect onboarding. We receive a connected-account identifier and high-level status; for that flow, full government-ID data is held by Stripe, not by us. This does not cover the identity check described next, where the files are held by us.
• Identity verification — if you ask to have your identity verified, a photo of a government-issued ID and a selfie taken at that moment. Both are stored privately and compared by a person. No automated face comparison is performed and no biometric template is created or stored (see §6.1).
• Content — posts, comments, photos, videos, voice notes, messages, event details, listings, reviews, endorsements.
• Business verification — if you list a business (for example a restaurant), the business name and address, contact phone, and the qualification documents required to verify it, such as a business licence or food-service permit.
• Communications — support emails, in-app reports, feedback.
• Verification — email or phone one-time codes, held briefly in cache with a short expiry and discarded on use or expiry.

2.2 Information collected automatically

• Device & app — device model, OS version, app version, language, time zone, IP address, crash logs.
• Usage — features used, screens viewed, and navigation events, for product analytics.
• Approximate or precise location — only when you grant the operating system permission, and only for features that need it: nearby matching in "Buddy", event check-in distance verification, location-based discovery, and location-sharing features you explicitly start. You can revoke location access in your device settings; the features that depend on it will then be unavailable.
• Push tokens — a device push token issued by Apple or Google, so we can deliver notifications you have enabled.
• Cookies / local storage (web) — minimal cookies for session authentication and your language preference. We do not use advertising or cross-site tracking cookies.

Device permissions

Every permission below is optional, is requested by your operating system at the moment the feature needs it, and can be revoked at any time in your device settings. Declining one disables only the feature that depends on it.

2.3 Information from third parties

• Stripe — payment-status updates, payout status, dispute events, and verification status for connected accounts.
• Apple / Google sign-in — if you choose social sign-in, the identity provider returns an authenticated identifier and, with your consent, your name and email.
• Content-moderation providers — labels returned for content you upload; see §4.

3. How we use information

We use personal information to:

• Provide the Service — create your account, deliver messages, display feeds, match buddies, run events, process payments.
• Personalize — show content, suggestions, and discovery results relevant to you and to where you are.
• Safety & integrity — detect, prevent, and respond to fraud, abuse, spam, harmful content, security incidents, and violations of our Terms. This includes manual and automated review (see §4).
• Communicate — service notifications, security alerts, support responses, and product updates. You control these in your notification settings.
• Comply with law — respond to legal process, enforce our Terms, and protect the rights, property, and safety of YiCircle, our users, and the public.
• Research & improvement — aggregated, de-identified analytics to improve features.

4. Automated processing and AI

YiCircle uses automated systems for some features. Specifically:

• Image moderation — when you upload an image, it is sent to AWS Rekognition to detect prohibited content such as explicit material or violence. The resulting moderation labels are stored; the image itself is processed under AWS's terms.
• On-device pre-check (iOS) — before upload, iOS runs an on-device classification. No image data leaves the device during this check.
• Text moderation — text you submit to public surfaces (posts, comments, replies) is checked against OpenAI's moderation endpoint. This endpoint returns category scores only; it is not a generative feature.
• Translation — chat translation runs on the device (the Apple Translation framework on iOS, Google ML Kit on Android). No message content is sent to YiCircle servers or to any third party for translation.
• Assistive AI features (where enabled) — for features such as summarization or suggestions, your input to that feature may be sent to Anthropic for processing under its API terms, which contractually exclude using API data to train general models. You are told at the point of use when a feature does this.

Automated systems make mistakes. You can appeal any moderation decision at support@yicircle.com.

5. How we share information

We share personal information only as described below.

5.1 With other users

• Profile information you make visible is shown to other users by design.
• Posts, comments, listings, and events you create are shown to the audience you select — public, community members, friends, attendees, and so on.
• Messages are shown to their recipients.
• After account deletion, content you shared into community spaces may remain with an anonymized author label (for example, "Deleted User"); see §10.

5.2 Service providers

We share data with service providers strictly to operate the Service:

Service providers are bound by contract to use data only on our instructions and to maintain appropriate safeguards.

5.3 Legal, safety, and enforcement

We may disclose personal information when we believe in good faith that disclosure is necessary to (a) comply with applicable law or valid legal process, (b) enforce our Terms, (c) detect or prevent fraud, security, or technical problems, or (d) protect against harm to the rights, property, or safety of YiCircle, our users, or the public.

5.4 Corporate transactions

If YiCircle is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will notify affected users through the Service or by email.

5.5 With your consent

We share personal information for purposes not listed above only with your consent.

5.6 We do not sell personal information

YiCircle does not sell personal information, and does not "share" personal information for cross-context behavioral advertising as those terms are defined under California law. We do not embed advertising or cross-app-tracking SDKs in our apps.

6. Retention

We retain personal information only as long as needed to provide the Service, comply with law, and resolve disputes. Current defaults:

• Account & profile — retained while the account is active.
• Messages — server-side retention of 180 days by default. The cache on your own device may hold messages longer until you clear it.
• Uploaded media — unreferenced uploads are cleaned up after 30 days.
• Identity verification documents — the ID photo and the selfie are destroyed 90 days after your request is decided, whether it was approved, rejected, or withdrawn by you. If it was approved, the selfie is kept as your verified photo — visible only to you — until you remove it or delete your account. After the image is destroyed we keep a one-way hash of the document, which cannot reproduce it and exists so that one document cannot verify several accounts.
• Verification codes — short expiry; deleted on use or expiry.
• Payment and dispute records — retained as required by Stripe and by applicable financial-records and tax law.
• Moderation actions — retained for safety integrity and to allow appeals.
• Deleted accounts — see §10.

6.1 Biometric information (face verification)

Not currently active. Face-based identity verification is disabled and is gated behind an internal switch that is off by default. While it is disabled we collect no biometric information, and identity is verified only through one-time codes and manual document review. The section below describes how the feature would operate if and when we enable it.

If enabled, YiCircle may offer optional face liveness verification to confirm you are a real, live person and, for identity verification, that you match your submitted ID. This would use AWS Rekognition as our processor.

• What would be collected — a short live face capture (video frames) and, where applicable, a numeric face template: a mathematical representation, not a stored photograph, used only to match against your own submission. Under the Illinois Biometric Information Privacy Act and similar laws this is biometric information.
• Consent first — we would not capture any face data until you had been shown a written notice and had affirmatively opted in. We record the fact, version, and timestamp of that consent. Declining only means you cannot use face verification; other verification methods remain available.
• Purpose limit — biometric data would be used solely for the verification you requested. We would not sell it, and would not use it for advertising, profiling, or model training.
• Retention & destruction — biometric identifiers would be destroyed no later than the earliest of: the purpose being satisfied, one year from your last interaction with YiCircle, or your withdrawal of consent.
• Withdrawal — you could withdraw at any time in the app by removing your verified photo, which revokes consent and deletes the associated data.

7. Security

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest, access controls, and logging. Payment card data is processed by Stripe and is never stored on YiCircle servers. No security control is perfect; in the event of a breach affecting personal information we will notify affected users and regulators as required by applicable law.

If you believe your account has been compromised, contact security@yicircle.com.

8. Your privacy rights

Your rights vary by jurisdiction; we honor the most protective that applies to you.

8.1 Access, correction, deletion, portability

You may:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and associated personal information — in the app under Settings → Account & Security → Delete Account, or by emailing privacy@yicircle.com. See Account Deletion;
• Export a portable copy of your account data, in the app under Settings → Account & Security → Export My Data.

8.2 California residents (CCPA / CPRA)

You additionally have the right to:

• know the categories and specific pieces of personal information we collect, the sources, the business purpose, and the categories of third parties we share with;
• request deletion, subject to legal exceptions;
• correct inaccurate information;
• opt out of "sale" or "sharing" — as stated in §5.6, we do neither;
• limit the use of sensitive personal information;
• not be discriminated against for exercising these rights.

Submit requests to privacy@yicircle.com. We verify your identity, normally by confirming control of your account, before acting. You may designate an authorized agent.

8.3 EEA / UK / Swiss residents (GDPR / UK GDPR)

Where the GDPR applies, our lawful bases for processing are:

• performance of a contract — operating your account, fulfilling paid transactions;
• legitimate interests — security, fraud prevention, product improvement;
• consent — where required, such as for location or marketing;
• legal obligation — tax records, lawful process.

You may exercise rights of access, rectification, erasure, restriction, portability, and objection by contacting privacy@yicircle.com. You may also lodge a complaint with your local supervisory authority.

8.4 Other jurisdictions

We honor applicable privacy rights in other jurisdictions where the Service is available.

9. Children's privacy

The Service is for adults aged 18 and over. It is not directed to minors, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information to us, contact privacy@yicircle.com and we will delete it.

10. Account deletion

You may delete your account at any time in the app under Settings → Account & Security → Delete Account, or by emailing privacy@yicircle.com. Full instructions are on our Account Deletion page.

Deletion requires you to re-confirm your identity, and then runs on a 30-day grace period: your account is deactivated and hidden immediately, and if you sign in again within those 30 days it is fully restored. After 30 days the deletion is permanent and cannot be undone.

Once the deletion is permanent:

• Personal profile information is anonymized — name, email, phone, avatar, bio, and date of birth are removed.
• Personal moments and private data are deleted.
• Community content you authored — public posts, hub posts, chat messages, reviews, endorsements — is retained with your author label replaced by a generic identifier such as "Deleted User", so that conversations and community history stay coherent for the other people in them.
• Payment and tax records held by Stripe are retained by Stripe under its own terms and applicable financial-records law.
• Backups are purged in the ordinary course of our backup retention cycle.

11. International transfers

YiCircle is based in the United States. If you use the Service from outside the United States, your personal information will be transferred to and processed in the United States. Where required, we rely on appropriate transfer mechanisms such as standard contractual clauses.

12. Third-party links

The Service may link to third-party websites or services. This Privacy Policy does not apply to them; review their privacy policies before sharing personal information.

13. Changes to this Privacy Policy

We may update this Privacy Policy. If we make material changes we will give reasonable notice, in the app or by email. The effective date at the top reflects the latest revision.

14. Contact

• Privacy: privacy@yicircle.com
• General support: support@yicircle.com
• Legal: legal@yicircle.com
• Security: security@yicircle.com