No names
A participant’s name is stored in an encrypted profile card that only Circle participants can open. The server does not see the name and cannot store it in readable form: the database itself forbids it.
Server data
What the server knows about you.
A Circle server needs enough to decide who may connect and where to deliver. It is not built to learn who you are or what you said. Below is concretely what it stores and what it cannot see.
To the server you are a public key
A Circlus identity is a key pair generated on your own device. The server receives the public half of it and nothing else about the person holding it.
No phone number, no email
Circlus asks for neither, and the schema has nowhere to put them. Nothing connects a Circle identity to a public directory or to an account anywhere else.
What a key does reveal
The same public key appears across everything that participant does, so an administrator can see that one member sent a message, joined a call and approved a new connection. It does not tell them who that member is.
Roles are visible
The server knows whether an identity is the owner, a member or a guest, because it enforces what each of them is allowed to do.
What the server does store
Every item here serves one of two jobs: deciding who may connect, and delivering to the right place.
- Public keys and identifiers of participants, and of the connections they approved — phones, tablets, browsers.
- Circle membership: which identities belong to it, who invited whom, and when.
- Access rules: owner, member or guest, invitation quotas, guest-link permissions.
- Delivery state: which identities exchange messages, at what time, how many, and how large the attachments are.
- Call metadata: who called whom, when, for how long, and connection-quality records.
- The IP address and browser signature of a request to add a new connection, so the owner can see where it came from before approving it.
- Ciphertext: messages, files, names, statuses, channel titles. Stored and delivered, never readable.
Who sees the stored part
Everything on the lists above is visible to whoever administers the server, along with the IP addresses participants connect from and when they connect, which any server sees. That is why choosing an administrator is a trust decision rather than a formality.
On your own VPS
You are the administrator, and Circlus has no access to your server. But the provider you rent the VPS from can technically see the same: the disk and the network are theirs.
On a friend’s, a company’s or our server
Whoever runs the server sees everything listed, including in their backups. If the server is ours, the administrator is the Circlus author, with exactly this visibility and no more.
On your own VPS set up by a specialist
While the specialist has access, they are the administrator, with the same abilities and no more. After setup, close their access: change the SSH password or key and the provider panel password, and check in the participant list that you are the Circle owner.
Metadata is not nothing
Who talks to whom, how often and when is information too, and we do not hide that. We claim only one thing: it contains neither content nor real names.
Owner and administrator are separate roles with powers that do not overlap. The difference is set out under Circle owner and server administrator.
What an administrator cannot do
This does not rely on the administrator being honest: the participants’ apps do the checking, not the server.
Read your conversations
The keys to messages, files and calls exist only on participants’ devices. The server receives them only inside an encrypted profile backup it cannot open.
Swap the app
The official app loads from web.circlus.org or an app store, not from the Circle’s server. So the server administrator cannot change the code that encrypts messages.
Add a person or take the Circle
Every membership change is signed, by the owner or by an invitation a participant issued, and devices check the signatures. The server cannot quietly add an outsider, bring back a blocked person or appoint another owner.
What they can still do
Stop the server or delete the Circle. Everyone notices at once, but it cannot be prevented. So keep another way to reach participants, and choose an administrator you trust at least that far.
One caveat: the first time you meet someone who is not yet in your contacts, the server could in theory slip in a different key. That is why the app asks you to compare profile details at such points; see profile verification.
A Circle is not locked to its server
Trust in an administrator stays revocable, because the Circle can leave.
The owner starts the move
A move is started by the Circle owner from Circle settings. The permission it needs comes from the administrator of the destination server. The administrator of the current server is not asked for consent.
What that does and does not guarantee
An administrator cannot keep a Circle by refusing permission. The current server does still have to be running in order to export the snapshot, so this protects you from an unwilling administrator, not from a machine that has been switched off.
The exact procedure, and the data that does not survive a move, are described in the Circle migration guide.
Do not take our word for it
Every claim on this page can be checked without trusting the people who wrote it.
The server is open source
The full server source is published. Anyone can read how a request is handled and what ends up written down.
The schema is in the repository
The ban on storing names and statuses in readable form is written into the database schema itself, not only into the code. The schema is published with the server.
Circle Inspector
The owner can grant temporary access to view the records that actually exist for their Circle — to themselves, to another member, or to a specialist helping them.
Server repository: github.com/circlus-org/circlus-server. Inspector: inspector.circlus.org.