Circoolo is a marketplace, social, and community app for digital nomads. We're a small team based in São Paulo, Brazil, currently running a private beta with our founding cohort. We take your privacy seriously — this policy explains, in plain language, what data we handle and the choices you have.

This policy covers both the Circoolo mobile app (iOS and Android) and this marketing website. By using either, you agree to the practices described here. It works alongside our Terms of Service and Community Rules.

The short version: We collect what we need to run a trustworthy marketplace and community — your phone number, profile, and the content you create. We never share your exact location with other users. We don't sell your personal data. And you can access, correct, or delete your data at any time.

What we collect

Account & authentication

You sign in through Firebase Auth using a phone number one-time SMS code (OTP), Google, or Apple. Circoolo does not store passwords. We collect your phone number and the basic identifier returned by your chosen sign-in method.

Profile

When you set up your profile, you may provide your name, a profile photo or avatar, nationality, languages spoken, skills, and home city. This is what makes you discoverable and credible to other nomads.

Content you create

We store the content you post inside the app — service listings, events, messages in Orbits (communities), reviews, and similar contributions. This content is part of how the product works and is often visible to other users by design.

Location — radius-aware, never exact

Circoolo uses approximate location to show you nearby people, events, and services. We show proximity by radius or city only — we never share your exact location or precise coordinates with other users.

Device & push token

To send you notifications (a new message, an event reminder, a booking update), we store a device push token via Firebase Cloud Messaging. You can turn off notifications in your device settings at any time.

Technical & usage data

Like most apps and websites, we collect basic technical information — device type, app version, and general usage patterns — to keep things running, fix bugs, and improve the experience.

Cookies & analytics (website)

This website uses Google Analytics 4 to understand how visitors use the site. This is gated behind a cookie-consent banner — see Cookies & analytics below for the full detail, including how consent works and how to change it.

How we use your data

To run the service — authenticate you, build your profile, power the marketplace, events, and communities.
To connect nomads by proximity — using radius-aware location, never exact coordinates.
To send relevant notifications — messages, RSVPs, bookings, and community activity you've opted into.
To power reputation & reviews — your orbit score (XP ladder: Explorer → Connector → Builder → Ambassador) is earned through real activity and stays portable across cities.
To keep the community safe — reviewing reports, and taking moderation action where needed.
To improve the product — through aggregate usage insights and bug diagnostics.
To meet legal obligations — where the law requires us to retain or disclose data.

Legal bases

Our primary jurisdiction is Brazil, so the Lei Geral de Proteção de Dados (LGPD) applies. For users and visitors in the EEA and the UK, the General Data Protection Regulation (GDPR) applies. We rely on these legal bases:

Performance of a contract — to provide the service you signed up for (LGPD: execution of a contract / GDPR Art. 6(1)(b)).
Consent — for optional analytics cookies and any marketing communications (LGPD: consent / GDPR Art. 6(1)(a)). You can withdraw consent at any time.
Legitimate interests — to keep the platform secure, prevent abuse, and improve the product, balanced against your rights (GDPR Art. 6(1)(f); LGPD: legitimate interest).
Legal obligation — where we must process data to comply with the law.

Cookies & analytics

This website uses Google Analytics 4 (GA4) with Google Consent Mode v2 and a cookie-consent banner. Here's exactly how it behaves:

In the EEA, UK, and Switzerland, analytics and ads storage are denied by default. Nothing non-essential is stored until you click Accept on the banner.
Elsewhere, analytics storage defaults to granted, and you can still decline via the banner.
Your choice is stored in your browser under the localStorage key circoolo_consent.

To change or withdraw your consent: clear this site's data (or the circoolo_consent value) in your browser, and the banner will appear again on your next visit so you can choose fresh.

Who we share data with

We do not sell your personal data. We share it only with the third-party processors we rely on to run Circoolo, and only as needed:

Processor	What it's used for
Google Firebase	Authentication and push notifications
Google Analytics 4	Website usage — gated behind cookie consent; denied by default in the EEA/UK until you accept
Supabase	Database hosting
Apple & Google	OAuth sign-in and app-store distribution
Vercel	Hosting for this website
Our third-party payment processor(s)	Handling payments for paid features

We may also disclose data where legally required, or to protect the rights, safety, and security of our users and the platform.

International data transfers

Circoolo is operated from Brazil and serves a global community of nomads, and some of our processors are based outside your country. This means your data may be transferred and processed internationally. Where we transfer data out of the EEA, UK, or Brazil, we rely on appropriate safeguards — such as standard contractual clauses and the protections our processors maintain — to keep it protected to the standard this policy describes.

How long we keep data

We keep your data for as long as your account is active and for as long as we need it to run the service. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we're required to retain certain records to meet legal, accounting, or safety obligations (for example, records tied to a completed transaction or a moderation action).

Your rights

Under the LGPD and GDPR, you have the right to:

Access the personal data we hold about you.
Correct data that's inaccurate or incomplete.
Delete your data (the "right to be forgotten").
Portability — receive your data in a portable format.
Object to or restrict certain processing.
Withdraw consent at any time, where processing is based on consent.
Complain to an authority — Brazil's ANPD (Autoridade Nacional de Proteção de Dados) or, in the EEA/UK, your local data protection authority.

To exercise any of these rights, email privacy@circoolo.com. We'll respond within the timeframes required by law.

Security

We use reputable infrastructure providers and industry-standard measures to protect your data — encrypted connections, access controls, and delegated authentication (we never handle your passwords). No system is perfectly secure, but we work to keep your data safe and will notify you and the relevant authorities if a breach ever affects your personal data as required by law.

Children — 18+

Circoolo is for adults only. You must be 18 or older (or the age of majority where you live) to use the app. We don't knowingly collect data from anyone under that age. If you believe a minor has created an account, please contact us and we'll remove it.

Changes to this policy

We're a young company and the product is evolving, so this policy may change. When we make a material change, we'll update the "Last updated" date above and, where appropriate, notify you in the app. Continuing to use Circoolo after a change means you accept the updated policy.

Contact

Questions about your privacy or a data request? Email privacy@circoolo.com. For anything else, reach us at hello@circoolo.com.

See also our Terms of Service and Community Rules.