Trust the client you use.
A Circlus client and a Circle are separate parts of the system. Understanding the difference helps you choose the official web or Android app and avoid giving untrusted software access to your private data.
The client address is not the Circle address
The web client is the application interface loaded in your browser. A Circle is hosted by a separate Circlus server. There is no Circle “inside” the client domain.
For example, a link may start with web.circlus.org while carrying the address of a completely different Circle in its connection parameters. Changing the client does not move the Circle or its stored data.
Why the client must be trusted
End-to-end encryption protects data while it travels and while it is stored, but the client at an endpoint must process readable content and cryptographic material so you can use the app. A malicious or modified client could misuse that access.
HTTPS proves which domain delivered the client; it does not prove that the client code is safe. The operator of that domain controls which version is served.
The official Android app
The Android app is another official way to use Circlus. A new installation uses web.circlus.org as its web client. If the app is configured to use another web client, the same trust requirements apply to that client.
The app is currently in closed Google Play testing. APK files are distributed only through the official Circlus Android Releases page on GitHub. After the public launch, Google Play is intended to become the primary installation and update channel.
Do not install Circlus APK files from mirrors, file-sharing sites, or links whose origin you cannot verify.
Custom clients are supported
Anyone with access to the web application code can modify it and deploy it on another HTTPS domain. Such a deployment may update at a different time or provide different functionality.
A Circle must explicitly allow a custom client origin before browsers can connect through it. This permission means that the Circle accepts requests from that origin; it is not a security review or endorsement of the client code.
A practical rule
- Use web.circlus.org. Install Android from Google Play when it is available to you, or download the APK only from the official GitHub releases page.
- Do not enter recovery packages, keys, invitations, or private information into an unfamiliar client.
- For a custom client, verify who operates the domain, how the code is built, and how updates are published.
- If you deploy your own client, add only that exact origin to the trusted settings of the Circles that should accept it.