Privacy Policy

Effective 1 January 2026 · Last updated 21 May 2026

1. Who we are

Circus Corporation (“Circus”, “we”, “us”, “our”) operates the Circus mobile application and associated services. We are incorporated in Delaware, United States. Our registered address and data protection contact are available at privacy@circus.app.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it.

2. Data we collect

We collect data in three ways:

Data you provide directly:

Account registration: email address, display name, date of birth, and optionally a phone number
Profile information: biography, profile photo, and links you choose to add
Content you post: text, images, video, and audio published to communities
Messages: direct messages you send (stored end-to-end encrypted; we cannot read them)
Payment information: billing details processed by our payment provider; we do not store card numbers
Communications with us: support requests, feedback, and correspondence

Data collected automatically:

Device and connection data: IP address, device type, operating system version, and app version
Usage data: features used, pages viewed, and timestamps of activity
Log data: error logs and diagnostic data used to improve reliability
Cookies and local storage: session tokens and preference data stored on your device

Data from third parties:

Sign-in providers (Apple, Google): if you use single sign-on, we receive a token and basic profile data as permitted by your account settings with that provider
Payment processors: transaction status and fraud signals from our payment processor

3. How we use your data

We use personal data only for the following purposes:

Service delivery: providing and maintaining the Circus platform, processing payments, and communicating with you about your account
Safety and security: detecting and preventing fraud, abuse, and violations of our Community Guidelines
Product improvement: understanding how features are used so we can fix bugs and develop better experiences
Legal compliance: responding to valid legal process and meeting our obligations under applicable law
Communications: sending transactional notifications (account activity, payments) and, where you have opted in, product updates

We do not sell your personal data to third parties.

4. Legal basis for processing (UK & EU users)

Where the UK GDPR or EU GDPR applies, we process your data under the following legal bases:

Contract: processing necessary to deliver the service you have signed up for
Legitimate interests: security, fraud prevention, and product analytics — balanced against your rights
Legal obligation: compliance with applicable laws and responding to lawful requests
Consent: marketing communications and optional personalization features, which you can withdraw at any time

We share personal data only in these circumstances:

Service providers: cloud infrastructure (Hetzner, OVH, Cloudflare, AWS — data may be processed in Germany, France, and the United States), payment processing, analytics, and customer support tools — all bound by data processing agreements
Creators: when you join or interact with a community, the creator can see your display name and interaction history within their community
Law enforcement: in response to valid legal process — see our Law Enforcement page for details
Business transfers: in the event of a merger, acquisition, or sale of assets, subject to continuity of this Privacy Policy

Analytics

We use Cloudflare Web Analytics to understand how visitors use circus.app. Cloudflare Web Analytics is cookieless and does not track individuals across sites — it collects only aggregate page view data. No personal data is transmitted to Cloudflare beyond what is included in standard HTTP requests (IP address, user agent). Cloudflare’s privacy policy is available at cloudflare.com/privacypolicy.

If you accept optional cookies, we also load Google Tag Manager and the following advertising pixels: Google Analytics 4, Meta (Facebook) Pixel, TikTok Pixel, Snapchat Pixel, and LinkedIn Insight Tag. These help us measure the effectiveness of paid advertising campaigns. You can reject these via the cookie banner; rejecting prevents them from loading.

6. Data retention

We retain account data for as long as your account is active. When you delete your account, your data is removed from active systems within 30 days and purged from backups within 90 days. Content you have posted in communities may persist if other users have interacted with it, but it will be dissociated from your profile.

IP logs and session records are retained for 90 days. Payment records are retained for 7 years to meet financial reporting obligations. Moderation records — including reports, content removal decisions, appeals, and enforcement actions — are retained for a minimum of 2 years from the date of the action.

7. Your rights

Depending on your location, you may have the following rights over your personal data:

Access: request a copy of the data we hold about you
Correction: ask us to correct inaccurate or incomplete data
Deletion: request deletion of your data (“right to be forgotten”)
Portability: receive your data in a structured, machine-readable format
Objection: object to processing based on legitimate interests
Restriction: ask us to restrict processing while a dispute is resolved
Withdrawal of consent: withdraw any consent you have given at any time

To exercise any of these rights, contact us at privacy@circus.app or use the data settings in the Circus app. We will respond within 30 days. You also have the right to lodge a complaint with the ICO (UK) or your national supervisory authority.

8. International data transfers

Circus is incorporated in the United States (Delaware) and uses cloud infrastructure that may process data in multiple regions, including the United States and European Economic Area. Cross-border transfers are protected by standard contractual clauses or equivalent safeguards.

9. Children

Circus is not intended for users below the minimum age for their country (16 in most regions, 18 in some). We do not knowingly collect data from users who do not meet the minimum age requirement.

We do not knowingly collect personal data from anyone under 13 years of age (COPPA). If we learn that we have collected personal data from a child under 13, we will delete that account and all associated data immediately. If you believe a user under 13 has created an account, please contact safety@circus.app and we will act promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via in-app notification and update the effective date above. Continued use of Circus after changes take effect constitutes acceptance of the updated policy.

11. Contact

For privacy inquiries: privacy@circus.app Circus Corporation, 251 Little Falls Drive, Wilmington, Delaware 19808, United States

If you are located in the United Kingdom or European Economic Area, the following additional rights and information apply.

Data controller: Circus Corporation, 251 Little Falls Drive, Wilmington, Delaware 19808, United States.

Legal bases for processing:

Contract performance (Article 6(1)(b)): processing your account data, delivering the service, processing payments
Legitimate interests (Article 6(1)(f)): security, fraud prevention, abuse detection, and product analytics — balanced against your rights and freedoms
Legal obligation (Article 6(1)(c)): responding to valid legal requests, retaining financial records
Consent (Article 6(1)(a)): optional personalization features and marketing communications — you may withdraw consent at any time without affecting prior processing

Your rights under the UK GDPR / EU GDPR:

Right of access (Article 15): request a copy of the personal data we hold about you
Right to rectification (Article 16): request correction of inaccurate or incomplete data
Right to erasure (Article 17): request deletion of your personal data — the “right to be forgotten”
Right to restriction of processing (Article 18): request that we restrict processing while a dispute is resolved
Right to data portability (Article 20): receive your data in a structured, machine-readable format for transfer to another controller
Right to object (Article 21): object to processing based on legitimate interests or for direct marketing purposes
Right to withdraw consent (Article 7(3)): withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@circus.app or use the data settings in the Circus app. We will respond within 30 days (extendable to 3 months for complex requests with notice). You may also submit a request at circus.app/data-request.

If you are dissatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with your national supervisory authority within the EEA.

International data transfers: Where we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place — including UK International Data Transfer Agreements (IDTAs), EU Standard Contractual Clauses (SCCs), or adequacy decisions.

13. California users (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with additional rights.

Categories of personal information collected in the preceding 12 months: identifiers (name, email address, display name, device ID, IP address); commercial information (transaction history, subscription records); internet or network activity (usage data, features accessed, log data); inferences drawn from usage data (preferences, interests).

Your rights under CCPA/CPRA:

Right to know: request disclosure of the categories and specific pieces of personal information we have collected about you, as well as the purposes and third parties involved
Right to delete: request deletion of your personal information, subject to certain exceptions (e.g. legal obligations, security)
Right to correct: request correction of inaccurate personal information we maintain about you
Right to opt out of sale or sharing: Circus does not sell or share personal information for cross-context behavioral advertising as defined by the CCPA/CPRA
Right to limit use of sensitive personal information: we do not use sensitive personal information beyond what is necessary to provide the service
Right to non-discrimination: we will not discriminate against you — including by denying services or changing prices — for exercising any CCPA/CPRA rights

How to exercise your rights: Contact privacy@circus.app with “California Privacy Request” in the subject line, or submit a request at circus.app/data-request. We will verify your identity and respond within 45 days. We may extend this period by a further 45 days where reasonably necessary, with notice.

No sale of personal information: Circus does not sell personal information as defined by the CCPA/CPRA and has not done so in the preceding 12 months. We do not share personal information for cross-context behavioral advertising.

Shine the Light (California Civil Code § 1798.83): Circus does not disclose personal information to third parties for their direct marketing purposes.

14. New Zealand users (Privacy Act 2020)

If you are located in New Zealand, the Privacy Act 2020 provides you with rights regarding your personal information, including the right to access and request correction of personal information we hold about you.

Indirect collection (IPP 3A): Where we collect personal information about you indirectly — for example, when you use Sign in with Apple or Sign in with Google and we receive your name and email address from that provider — we take reasonable steps to ensure you are aware of this. By using single sign-on, you direct those providers to share profile data with Circus in accordance with their own terms. The categories of data we receive this way are described in Section 2 (“Data from third parties”).

How to exercise your rights: Contact us at privacy@circus.app. We will respond within 20 working days as required under the Privacy Act 2020.

If you are not satisfied with our response, you may make a complaint to the Office of the Privacy Commissioner (privacy.org.nz).

15. Australian users (Privacy Act 1988)

If you are located in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) govern how we collect, hold, use, and disclose your personal information.

Your rights under the APPs:

Access (APP 12): you may request access to the personal information we hold about you by contacting privacy@circus.app
Correction (APP 13): if you believe the personal information we hold about you is inaccurate, out of date, incomplete, or misleading, you may ask us to correct it
Anonymity (APP 2): where lawful and practicable, you may interact with us without identifying yourself; however, most Circus features require an account

Cross-border transfers (APP 8): Your personal information may be held or processed on infrastructure located in Germany (Hetzner), France (OVH), and the United States (Cloudflare, AWS). Before transferring personal information outside Australia, we take reasonable steps to ensure the overseas recipient handles it consistently with the APPs.

How to exercise your rights: Contact us at privacy@circus.app. We will respond within 30 days.

If you are not satisfied with our handling of a complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.