Members and roles
The owner invites participants, manages supported roles, and can close a participant’s access to the Circle.
Role and security
Understanding the Circle owner.
Which decisions the Circle owner makes, what the role does not give, and what happens when the owner changes.
What the owner controls
A Circle always has one owner. The owner can manage the Circle from any of their approved connections — a phone or a browser.
Entry points
The owner manages regular invitations, guest links, and other supported ways to enter the Circle.
Circle settings
The owner changes the name and available Circle policies within the limits imposed by the server.
Ownership transfer
The owner can voluntarily transfer the role to another active full member.
The product interface may add capabilities over time, but the role always applies to the whole Circle rather than to one chat or one connection.
What ownership does not reveal
Becoming the owner does not itself transfer chat keys or add that person to every existing conversation.
Direct and group chats
The new owner can read only messages whose keys they already have as a participant in that chat.
Data on devices
A role change does not extract data from participant devices or remotely reveal content they have stored.
What the owner sees
Membership, roles, invitations and participants’ connections: what is needed to manage the Circle, but not their conversations.
If the owner is in the chat
If the owner already belongs to a chat or receives its keys through normal membership rules, they see it as a chat participant—not because they are the owner.
Circle owner and server administrator
Two roles that are easy to confuse. One person may hold both, and on a self-hosted Circle usually does, but the powers do not overlap.
The owner decides who is inside
Members, roles, invitations, guest links and Circle settings. This authority belongs to one identity, not to a machine, and it follows the Circle even if the Circle changes servers. The owner signs the participant list, and every device keeps a verified copy: the server cannot quietly add a person or bring back a blocked one, including when the Circle moves.
The administrator runs the machine
Availability, updates, backups, the reverse proxy, technical logs. Infrastructure decisions affect whether the Circle works, not who belongs to it.
An administrator cannot take the Circle over
The owner changes only when the current owner signs the transfer. The server rejects every other way.
Where an administrator’s real power lies
They can stop the server, or delete the whole Circle from it. That is destructive and immediately obvious to everyone, which is a different thing from quietly taking control of a Circle that keeps working.
Neither role can read content
Messages, files and calls are encrypted with keys held on participants’ devices. Becoming the owner does not hand over chat keys, and administering the server never gave access to them.
The owner can leave
A Circle can be moved to another server on the owner’s initiative, without the current administrator’s consent. Trust placed in an administrator stays revocable.
What an administrator does see is listed item by item under what the server knows.
How ownership changes
One method exists, and the Circle records it in a system event that participants can see.
Voluntary transfer
The current owner signs the transfer of the role to a chosen member. There is no other way.
No administrative takeover
A server administrator cannot appoint an owner, create a replacement profile, or issue a recovery link.
The former owner remains a member
By default their identity becomes a regular member. If their access is compromised, it can be disabled separately.
Participants are notified
Every active owner and member, but not guests, receives an event naming the former and new owner and the time.
If an owner has lost access to their devices, ownership is not reassigned for them: they restore their profile from a Recovery Package. An owner change moves the administrative role but does not itself transfer chat keys — see “What the owner controls”.
Do you manage a Circle?
Practical tasks—creating a Circle, invitations, guest links, connections, and maintenance—live in a separate guide.