Trust the client you use.
Messages are encrypted and decrypted by the app on your device. That is why it matters which app you use: the official one can be trusted, a random one cannot.
The client address is not the Circle address
The web client is the application interface loaded in your browser. A Circle is hosted by a separate Circlus server. There is no Circle “inside” the client domain.
For example, a link may start with web.circlus.org while carrying the address of a completely different Circle in its connection parameters. Changing the client does not move the Circle or its stored data.
Why the client must be trusted
End-to-end encryption protects messages in transit and on the server. But on your device the app sees them in plain form and holds the keys — otherwise you could not read anything. A modified or fake app could misuse that.
HTTPS proves which domain delivered the client; it does not prove that the client code is safe. The operator of that domain controls which version is served.
The official Android app
The Android app is another official way to use Circlus. A new installation uses web.circlus.org as its web client. If the app is configured to use another web client, the same trust requirements apply to that client.
The app is currently in closed Google Play testing. APK files are distributed only through the official Circlus Android Releases page on GitHub. After the public launch, Google Play is intended to become the primary installation and update channel.
Do not install Circlus APK files from mirrors, file-sharing sites, or links whose origin you cannot verify.
Custom clients are supported
Anyone with access to the web application code can modify it and deploy it on another HTTPS domain. Such a deployment may update at a different time or provide different functionality.
A Circle must explicitly allow a custom client’s address (its origin) before browsers can connect through it. This permission means that the Circle accepts requests from that origin; it is not a security review or endorsement of the client code.
A practical rule
- Use web.circlus.org. Install Android from Google Play when it is available to you, or download the APK only from the official GitHub releases page.
- Do not enter recovery packages, keys, invitations, or private information into an unfamiliar client.
- For a custom client, verify who operates the domain, how the code is built, and how updates are published.
- If you deploy your own client, add only that exact origin to the trusted settings of the Circles that should accept it.