Privacy policy

Utah Circles is a community platform for finding local events and joining interest groups (“circles”) across Utah, available at utahcircles.com and as an Android app. Questions about this policy or your data: hello@utahcircles.com.

Account. Email address, a handle, a display name, your date of birth, and a password. Your date of birth confirms you’re 18 or older and checks event age limits (some events are 21+); it stays on your account and is never shown to other users. If you sign in with Google we receive your name and email from Google instead of a password, and we store your Google account’s identifier so we can link that sign-in to your account.

Profile. Whatever you choose to add: an avatar, a bio, pronouns, links, interests, and a home city picked from a list. Your profile city is a place you select — never your device’s GPS position.

Things you share. Events you create (including venue and address), circles you join or run, RSVPs, saved events, chat messages and photos, join-request messages, invitations (which can include a friend’s email address), blocks, reports you file, and anything you write in a verified-organizer application (which our team reviews).

Device location, only when you ask. The “near me” filter uses your approximate location to sort events by distance. It’s off until you turn it on, the Android app requests coarse location only, and your coordinates are used to answer that request — they are not saved to your account on our servers. Your browser remembers your last map position locally.

Technical. Standard server logs and IP addresses, used for security and rate limiting (for example, limiting signup attempts).

• We don’t sell your data, and we show no ads.
• No advertising or cross-site tracking SDKs, no ad identifiers, and no data brokers.
• No precise (GPS-level) location permission in the Android app, and no background location — ever.
• No access to your contacts, camera roll, or microphone.
• No payment collection — event cost fields are informational only.

Event listings, circle discovery pages, and public profiles are visible to anyone, including people without an account. You control your profile’s visibility in settings: public, members only, or private — and you can hide your city and your circle or RSVP lists.

Worth knowing: when you RSVP to a publicly viewable event, your handle, display name, avatar, and RSVP status appear on that event’s guest list, which anyone who can view the event can see. Chat messages are visible to the members of the room they were sent in — never to non-members. Circle organizers see join requests (including your message), and our moderators see the content of reports.

A few processors handle data on our behalf; we don’t use them for advertising:

• Google Sign-In — optional sign-in. Google’s own privacy policy applies to your Google account.
• Google Maps — renders event maps and address search on both platforms.
• Mailgun — delivers our email (verification and notifications).
• Vercel — hosts the website, including Vercel’s cookieless, aggregate page-view analytics. This is the only analytics we run; the Android app contains no analytics or crash-reporting SDKs at all.
• Google Cloud — hosts our servers and stores uploaded images. Avatars and cover photos are public; chat photos live in private storage and are served through short-lived signed links.

Realtime chat runs on our own servers — no third-party chat provider sees your messages.

We don’t set tracking cookies. Your sign-in session is kept in your browser’s local storage (and in the Android app’s private storage, which is excluded from device backups). Google’s sign-in and maps scripts may set their own cookies, governed by Google’s policies.

We send account email (verification, security notices) and notification email (invites, reminders). You can turn notification email off entirely, mute individual circles or rooms, and set quiet hours in settings; account and security messages can’t be turned off, because they protect you.

All traffic is encrypted in transit (HTTPS/WSS). Uploaded photos are re-encoded and stripped of metadata like camera location (EXIF) before storage. Sign-in uses short-lived tokens with rotating refresh tokens, and a stolen-token reuse attempt revokes the session.

You can delete your account at any time — see how to delete your account. Deletion is immediate and permanent: your email, handle, display name, bio, avatar, pronouns, links, date of birth, chosen home city, interests, and any Google sign-in link are removed, your password is erased, and every session is signed out. Only an anonymous placeholder remains, so shared history (like rooms you posted in) keeps working without identifying you. Circles you own are handed to another member (or archived if empty). Chat messages you sent in shared rooms are retained under our retention policy but are anonymized — they show as “Deleted user.” Events you host are not automatically canceled, so cancel them first if you don’t want them to continue.

Under the Utah Consumer Privacy Act you can also export a copy of your data: in the Android app, Settings → “Download my data.”

Utah Circles is for adults 18 and over. We verify age with your date of birth at signup and do not knowingly collect data from anyone under 18; if we learn we have, we’ll delete the account.

If our data practices change, we’ll update this page and its date, and for meaningful changes we’ll notify you by email or in-app before they take effect.

hello@utahcircles.com — we’re a small team, but privacy mail gets read.