Legal · Updated October 6, 2026

Privacy notice

This notice describes the data Circular needs to operate the service and the controls available to workspace owners and members.

Data we process

  • Account identity, authentication records, and workspace membership.
  • Projects, issues, comments, plans, documents, and activity created by your team.
  • Agent configuration, execution events, usage totals, and approval records.
  • Connections you approve for AI assistants and other apps.
  • Operational diagnostics needed to secure, debug, and improve the service.

Credentials and agent access

Provider credentials and connector secrets are encrypted before storage. Team API keys are shown once at creation and stored as non-reversible hashes. Workspace administrators control membership, agent assignments, and key revocation.

AI assistants and connected apps

You can connect Claude, ChatGPT, Claude Code, Codex or another MCP client to Circular. You sign in to Circular and approve it for one workspace. It works as you: it sees only what you can see in that workspace, and its changes are saved under your name.

What it can read and write

  • Read your workspace: Tasks, projects, comments, attachments and Focus. Always included.
  • Also create and edit: Tasks, projects, comments and Focus. It can't delete anything. Only if you tick it.
  • Also delete: Tasks, projects and comments. Only if you tick it. Never ticked for you.
  • Arrange teammates' Focus: Add to and reorder other people's Focus, not only yours. Workspace owners and admins, only if they tick it.

You can also limit a connection to some teams or projects.

What Circular receives and stores

  • The requests the assistant sends to Circular, such as a search or a new task's title. Circular does not receive your conversation with the assistant.
  • We do not store those requests or our answers. Changes the assistant makes are saved in your workspace like any other change. If a request fails, error details can reach Sentry.
  • A record of the connection: the app's name as it registered, its sign-in callback address, the workspace, the access you approved, and when it was created or disconnected.

Personal data involved

  • Your account: name, email and workspace role.
  • Workspace content the assistant can read: tasks, comments, projects, attachments and Focus, including the names of teammates in them.
  • The connection record described above.

Why

  • To answer the assistant's requests and make the changes you allowed.
  • To keep connections secure: checking access on every request, limiting request rates, and investigating misuse.

Who receives it

  • The assistant's provider: Anthropic for Claude and Claude Code, OpenAI for ChatGPT and Codex, or the maker of the client you connect. It receives what the assistant reads, under that provider's own terms.
  • Our service providers, listed below.

How long

  • A connection lasts until you disconnect it, or until it goes 90 days unused.
  • A disconnected connection stops working on its next request.
  • What the assistant created stays in your workspace until someone deletes it.

Your controls

Analytics

We use Little Friend for privacy-friendly analytics. It sets no cookies and does not store IP addresses. To connect the pages you view in one visit, it keeps a random id in your browser tab's session storage. The visit ends after 30 minutes of inactivity, and the id is gone when you close the tab. If your browser sends Global Privacy Control, your visit is only counted, never connected.

Some visits are recorded as a copy of the pages you view. We chose to show the text on our pages in these recordings. What you type or choose in forms is never recorded, email addresses and phone and card numbers stay masked, and recordings are deleted within 7 days.

When you are signed in, a visit is linked to your account's internal id, never your name or email, so we can find or delete your recordings if you ask. None of this runs in the desktop or mobile apps.

Service providers

These providers process data so Circular can run:

  • Vercel: Hosts the web app.
  • Neon: Hosts the database.
  • Backblaze B2: Stores attachments.
  • Sentry: Error reports and performance traces. Session replays mask all text and block media.
  • Resend: Sends sign-in codes, password resets, sign-in links and invitations.
  • AgentMail: Receives and sends email for Asks, including the message and its attachments.
  • Fly.io: Delivers live updates between open windows. These carry IDs, not content.
  • Upstash: Sign-in rate limits, keyed by a hash of your email and IP address.
  • Apple Push Notification service and Firebase Cloud Messaging: Push notifications to the mobile apps, which include a task title or a short comment excerpt.
  • Little Friend: Website analytics and session recordings on gocircular.dev in a browser, not in the desktop or mobile apps (see Analytics above). Counts of sign-ups and agent connections from our servers, which carry no personal data. Request logs, used to tell crawlers and AI agents from people. It sets no cookies and does not read what you type.
  • DiceBear: Default avatar images. The image address includes your name or email.
  • Integrations you turn on: GitHub, Slack, Linear or Jira import, and sign-in with Apple, Google, GitHub or single sign-on through WorkOS. Each receives what that integration needs.

Circular does not send your workspace content to any AI model provider itself.

How long we keep data

  • Workspace content: until you or a workspace owner deletes it. Deleting a workspace deletes its content and files.
  • Connections from AI assistants and other apps: until disconnected, or 90 days unused.
  • The record of each connection (the app, its callback address, the workspace, the access you approved and its dates): kept while your account exists, as a security record. Unused sign-in attempts and expired tokens are deleted within a day.
  • Sign-in codes: 10 minutes.
  • Session recordings at Little Friend: deleted within 7 days.
  • Sign-in rate-limit records at Upstash: up to 24 hours.
  • Loop and trigger run records: 30 days.
  • Slack messages waiting to be sent: 7 days after sending, or 30 days if sending failed.
  • Other records, backups and provider logs: while an account or workspace is active, and as needed for security, legal and backup obligations.

Your choices

Workspace owners can delete a workspace in Settings. To export your data or delete your account, email us from the address on your account.

Contact

Privacy questions and account requests can be sent to support@gocircular.dev.