Profile
These are your keys in all your Circles and your active temporary access records. The app uses them to prove who you are and connect you to your Circles.
Backup and recovery
What Circlus stores, where, and why.
Your profile, its encrypted backup, the recovery package, and chat archives are separate parts of the system. Together they help you recover after losing a device, but each has a different job.
Four parts of recovery
The key distinction is simple: the profile restores access to Circles, while chat archives restore saved message history.
Profile Encryption Key
This is a random secret the app uses to encrypt the profile backup. It is created and used on your devices; servers do not receive it in plaintext.
Encrypted profile backup
This contains profile data encrypted with the encryption key. A new device uses it to recover your Circle profiles and access.
Recovery package
This is a small file containing the password-protected Profile Encryption Key and information about where to find encrypted backups. It does not contain the backups themselves or message history.
Where the data lives
Circlus does not place everything in one file or on one central server. Each part is stored according to its purpose.
On the device
The working profile and Profile Encryption Key live in the app’s protected storage. The device also keeps local data needed for everyday use.
In selected Circles
An encrypted profile backup is uploaded to each Circle selected as a storage location. Selecting several Circles duplicates that role, so recovery does not depend on one server being available.
Where you save the package
The recovery package is an ordinary file, such as in protected cloud storage, a document provider, or another storage medium. On Android, Circlus remembers the date, file name, and available description of the most recent save location.
On Circle servers
Servers see operational data needed to provide the service and store encrypted backups. They do not receive the Profile Encryption Key in plaintext and cannot decrypt the profile backup.
Messages and attachments are not part of the profile backup. Chat history uses the separate mechanism described below.
How recovery works
The package tells the app where to look and provides the key needed to decrypt what it finds. Circlus then downloads only the encrypted backups that are available.
Open the package on a new device
On an empty device this is a primary setup path. Enter the password used when the package was saved.
The app obtains the Profile Encryption Key
The correct password decrypts the key inside the package. The password is not sent to a server.
Circlus looks in the listed Circles
The package contains addresses and separate lookup secrets. They can locate matching encrypted backups, but cannot decrypt them by themselves.
The profile is assembled on the device
The app decrypts the backups it finds, merges your Circle profiles and valid temporary access, and adds the new trusted connection.
A configured device only adds missing Circles
If a device already has profile data, full recovery is not the primary action. You can inspect a package and add Circles that are not present on that device.
A deleted Circle, revoked access, unavailable server, or expired temporary access can limit the result. A recovery package does not override the Circle’s own access rules.
Chat history is saved separately
A restored profile returns keys and access, but does not guarantee that old messages return. Enable a message archive in each Circle whose history you want to preserve.
Archives are enabled per Circle
You can archive some Circles and not others. A Circle policy can disallow archives or limit their retention and size.
Messages are stored encrypted
One of your active devices writes history in segments. The server stores encrypted segments and does not receive the keys needed to read their content.
What is included
The archive contains message text and the minimum metadata needed to restore chronology. File data and other attachment binaries are not archived by default.
Regular sync is not a backup
After reconnecting, a Circle may return messages it still retains under its normal rules. Only an enabled archive is intended for longer-term recovery of preserved history.
Disabling an archive stops new messages from being added. Deleting an archive that already exists is a separate action.
The package must remain available to you and unavailable to others
“Keep it separate from the device” is about two independent goals: surviving device loss and preventing someone else from obtaining the file.
Availability
Do not keep the only copy on the phone it is meant to recover. Protected cloud storage, an encrypted drive, or another place reachable from a new device can work.
Confidentiality
Do not place the package in a shared folder or send it through an open chat. Anyone who obtains the file can try password guesses without contacting Circlus.
The password really encrypts the key
The package uses strong encryption and password-guessing slowdown. A short or common password is still weak, and the file format should not be treated as secret.
A practical choice
Use a long, unique password or passphrase and keep it separately from the file, such as in a password manager. Periodically confirm that the package is still reachable.
A minimum readiness check
These four checks answer the practical question: “Could I recover after losing this device?”
- This device has the Profile Encryption Key.
- At least one available, trusted Circle stores encrypted profile backups, and its latest update succeeded.
- A current recovery package is stored somewhere protected and reachable, and its password has not been lost.
- Message archives are enabled separately in the Circles whose history you want to recover.