circa.
Privacy Policy
Effective date: 2026-10-11
What Circa is
Circa is an iOS app that pairs your own lifestyle log (supplements, caffeine, nicotine) with physiological data that your tracker has already delivered into your Google account. Circa reads that data from your Google account through the Google Health API. It does not pair with a tracker itself, it does not call the Fitbit Web API, and it does not read Apple Health. It produces personal trend statistics and a nightly sleep forecast. Everything it computes, it computes on your iPhone.
Data Circa accesses
With your explicit consent, Circa requests these read-only Google Health API scopes:
- googlehealth.activity_and_fitness.readonly
- googlehealth.health_metrics_and_measurements.readonly
- googlehealth.sleep.readonly
- googlehealth.profile.readonly, used once to greet you by first name
Circa never writes to your Google account and never requests broader access.
Where your data lives
On your iPhone, and only there. Health data is processed and stored in a local database on your device. Circa offers no account and does not upload your health data to a server of ours. Optional app recommendations use a separate service that never receives health data. There is no cloud copy.
One thing is worth naming explicitly: if you have switched on encrypted device backups through Apple, whether iCloud Backup or a local backup, the app's data container may be included in that backup. That backup is a service of Apple, configured by you in iOS, and is governed by Apple's privacy policy rather than this one. If you export your data from the app, the resulting file goes wherever you send it. That destination is your choice and outside our control.
What we never do
- No sale or sharing of your health data, with anyone, ever.
- No personal activity analytics, no attribution library and no crash reporting SDK in the app. Recommendations use aggregate view and open counts as described below.
- Your intake log and your physiological data are never handed to the advertising kit and are never used to target an advert.
- No accounts on our side. There is no "our side."
The app is free and carries advertising, which is the one third-party component it contains. Who receives what, and how you withdraw your consent, is set out in Advertising below.
Advertising
Circa is free and has no in-app purchase, no subscription and no paid version. It is funded by advertising. Nothing inside the app removes the advertising, because there is nothing to buy. What you can decide is your consent, described further down.
Advertising appears in two places. A banner sits above the tab bar on the today, body and signals tabs; the log tab carries none. A full screen advert can follow once you have actually saved an intake, and never while you are entering one. That full screen advert is capped four ways at once: none during your first three saved intakes, at most one per session, never within three saved intakes of the previous one, and never within three minutes of the previous one. If a single one of those conditions fails, no advert is shown.
The adverts are delivered by the Google Mobile Ads SDK. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for users in the European Economic Area, the United Kingdom and Switzerland, and Google LLC elsewhere. To fill an advert slot, Google receives technical data from the device such as an IP address, device and operating system characteristics and, if you allow it, an advertising identifier.
| Data type | Processed by the app | Reaches a third party |
|---|---|---|
| Sleep, HRV, activity and your intake log | Read from your Google account and written to your device only | No. It is never passed to the advertising kit or to anyone else |
| Advertising identifier (IDFA) | Only if you allow it in the App Tracking Transparency prompt | Google, for advertising, and only with your permission |
| Technical request data for an advert | Sent by Google's kit when an advert is loaded | Google, on the basis of your consent |
| Contact details, location, purchase history | No | No |
Your consent comes first. Before the advertising kit is started at all, the app shows Google's User Messaging Platform consent form, and iOS then asks its own App Tracking Transparency question. Only after both have been answered does the advertising SDK start, and only then does an advert load. The legal basis is your consent, Art. 6(1)(a) GDPR, and you may withdraw it at any time with effect for the future: open the profile from the corona mark at the top left, scroll to About and choose Ad privacy settings, which reopens Google's consent form. That entry is present whenever Google's consent framework requires a privacy option, which is the case wherever you were asked for consent in the first place.
Google's own processing is described at policies.google.com/privacy and, for advertising specifically, at business.safety.google/privacy. Beyond Google's advertising kit and the aggregate recommendation counts described below, the app contains no analytics service, no attribution SDK and no crash reporting service of ours.
Your supplement & stimulant log
Everything you log, meaning substances, doses and times, is entered by you and stays on your device. The bundled supplement library is reference content shipped inside the app; your selections never leave your iPhone.
Data deletion
Disconnect & erase (Profile → Disconnect Google Health & erase) revokes Circa's Google token and wipes the local database immediately and permanently. This is the account-deletion path. Because no server-side account exists, deletion is complete the moment it runs. Deleting the app from your iPhone likewise deletes all of its data.
Google API Services User Data Policy
Circa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google Health API is used only to provide the app's user-facing features, on device.
This website
These pages are static. They set no cookies, and they embed no fonts, images or scripts from third party domains.
The pages do use Vercel Web Analytics, a measurement service of the hosting provider. It is cookieless, sets no identifier, stores nothing on your device and builds no profile. It counts page views and records when a visitor follows a link to the App Store, together with the place of that button on the page and the path of the page. The purpose is to see which pages actually help someone find the app. Nothing from it is evaluated per person and nothing from it is passed on to third parties. The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, whose privacy policy is at vercel.com/legal/privacy-policy.
Contact
levin.schwab@gmx.de
Changes to this policy
If this policy changes, the new version is published at this URL with an updated effective date. Material changes are called out in the app's release notes.
Recommendations for our other apps
In your profile, the app can fetch up to three recommendations for our other apps. The choices depend on the app you are using, App Store availability and iOS compatibility, not on your personal data or activity inside the app. App icons load from Apple’s image servers. Opening a recommendation takes you to the App Store with a campaign label identifying the source app and placement, never a person.
We count qualified views and successful opens in aggregate. Our service stores daily counts with the source app, recommended app, placement, configuration revision and optional presentation variant. It does not store an account, advertising identifier, device identifier, persistent visitor identifier or personal profile, and it does not receive the app’s private content. These counts cannot tell us who installed an app.
The recommendation service is hosted by Supabase. Network requests necessarily expose an IP address to the hosting provider for delivery and security; our aggregate counter does not store it. See Supabase’s privacy policy. Apple processes icon requests and App Store visits under Apple’s privacy policy.