Privacy Policy

Draft revision: 2026-11-10. Effective date: pending operator and counsel approval. This draft describes Cyrviva's current product behavior. The operator identity, final contact, retention periods, and jurisdiction-specific notices still need approval.

Cyrviva in plain language

• Circle content is intended for authorized members, not a public feed.
• Cyrviva uses account and Circle data to provide the service.
• AI processes text only when an eligible user requests a suggestion and the feature is configured.
• Settings provides Circle export and account or Circle deletion controls, with the limits described below.

Information Cyrviva processes

Account and Circle: email address, authentication identifiers, display name, settings, membership and Admin roles, invitations, and the active Circle preference. Signup checks date of birth before asking for account details. Adult eligibility retains an age category, not the full submitted date; teenage eligibility retains a private adulthood-transition date from which birth date can be inferred. This evidence is separate from optional birthdays on Circle Person profiles.

Shared experiences: Tradition and Occurrence details, plans, tasks, activities, memories, recipes, stories and interviews, reflections, lessons, votes, notes, and content you and other members choose to add. Private Storage holds uploaded photos and documents. Authorized Circle members may see content shared in their Circle. The service does not put that content in a public discovery feed.

Technical and service records: authentication/session cookies, an active Circle preference cookie, operational logs, and provider request data such as IP address and browser information processed to run and secure the service. Cyrviva does not currently use a marketing analytics cookie. The need for any jurisdiction-specific cookie notice remains for counsel to assess.

Product signals and beta feedback

First-party product events record action names and timestamps, with internal user or Circle IDs for signed-in actions. Public marketing actions are counted by day. Event records do not include Circle names, memory or recipe text, photos, search terms, email addresses, or invitation tokens. This helps understand use and diagnose product problems. Feedback you choose to submit includes your message and category plus limited context such as environment, build version, Settings route, timestamp, and your account/Circle identifiers. Do not include passwords, invitation tokens, or private Circle content in feedback.

Messages, payments, and AI

Supabase Auth handles account confirmation, email change, and recovery messages through Resend SMTP in Production. Resend also handles Circle invitations and optional occurrence or preparation reminders. Settings lets you turn off optional reminders; account and security messages are separate. Cyrviva does not currently operate a marketing email campaign.

Import Center

If you choose to import, Cyrviva temporarily stores your uploaded calendar, CSV, JSON, or media archive source in private Storage, or fetches the public HTTPS calendar feed URL you provide. It parses source files and reads photo date metadata to prepare a review. Uploaded originals may contain other embedded information such as location; calendar and structured source records may also contain place text. You choose what to confirm before Cyrviva creates permanent Circle records or copies selected media. Import source files and sessions are scheduled to expire after seven days; the operational cleanup job may run later if it fails and retries. Cyrviva does not claim a partnership with the source service. Optional AI analysis is disabled in Production; if introduced later, its use and provider disclosures require separate review.

Stripe would process payment details if paid billing is enabled. Cyrviva stores subscription and Stripe customer or subscription identifiers and status, not full card numbers. Cyrviva Plus is billed per Circle, monthly or annually until canceled. Live purchases remain gated pending the outstanding legal/account setup. A billing contact is separate from Circle administration. Cyrviva records the selected interval, price, period dates and recurring payment authorization and policy version; restricted webhook records contain event identifiers/types and review state, not raw payment-method or family-content payloads.

If optional AI is configured and an eligible user requests it, Cyrviva sends the text entered for planning or reflection, with instructions, to OpenAI for a proposed response. It does not automatically send a Circle's full history, photos, or recipes. The user reviews suggestions before saving; manual workflows remain available. Provider retention or training terms need separate review before enabling the feature for external users.

Service email

Required account, security, membership, billing and export messages are separate from optional reminders and marketing. No marketing permission follows from signup or guardian approval. The contact workflow keeps limited plain-text correspondence, sender, subject, category, status and restricted operator actions to investigate and respond. Incoming email is untrusted: attachments are not automatically executed or rendered, and a privacy request never automatically triggers disclosure or deletion. Provider delivery events record operational delivery state without open or click tracking. Exact contact and email-record retention still requires approval.

Providers and access

Supabase supplies authentication, database, and private Storage; Vercel hosts the app; Resend is used for app mail and, when enabled, inbound support/privacy/legal correspondence; Stripe processes payments when billing is enabled; OpenAI processes optional AI requests when configured. These providers may process the information needed for their functions. Provider locations, agreements, and international transfers require operator and counsel review.

Circle access is checked against membership using database rules. Private media uses restricted Storage access and signed links. No security control guarantees absolute protection. Circle Admins choose whom to invite and manage members; an invited person who joins can see content shared in that Circle.

Export, account deletion, and Circle deletion

An authorized adult Circle Admin can request a private export job in Settings. The server snapshots related records together when processing begins and streams supported originals into bounded archive parts, with structured JSON, a README and checksums. The browser can close while it runs. Status remains available in-app, and a service email is queued when ready or failed. Ready packages expire after 72 hours; access is checked at request, processing and download, and download links are short-lived. Cleanup removes temporary snapshots and packages; failures can delay physical removal. Operational job metadata has a separate retention period. An authenticated user can request account deletion in Settings. Active billing or being the final Admin of a Circle must be resolved first. The current flow removes sign-in and memberships and changes the retained profile display name to “Former member”; content previously contributed to shared Circles may remain available to those Circles.

An Admin can request deletion of a Family or Group Circle. The request can be canceled during a seven-day waiting period while pending. After that, an operational job removes Circle Storage objects and the Circle data. Processing can fail and be retried, so seven days is a waiting period, not a guaranteed completion time. Copies in backups and provider logs may persist for periods that have not yet been approved.

Retention and requests

Live Circle data remains while the Circle exists unless removed through a supported flow. Exact retention periods for logs, analytics, feedback and backups still require approval. App email bodies and direct recipient addresses are scheduled for removal after seven days, with minimal delivery metadata kept for 90 days. Temporary export packages expire after 72 hours; failures may delay physical cleanup. We do not claim immediate deletion from every backup.

Children and family privacy

Account policy selected by the owner; legal notice remains a review draft. Independent Cyrviva accounts require age 13 or older. A person can be part of family history without having an account. Under-13 people use adult-managed Person profiles: no password, direct authentication, independent account email, invitations, product notifications, marketing, billing, administration or independent privacy settings.

An adult may add a child's name, optional birthday, relationships and lawful family-history material, including photographs and memories, under the Circle's ordinary private access controls. Management records identify the adult, their stated parent/guardian or other lawful authority, attestation time and policy version. This does not independently verify custody, grant ownership of another person's content or settle family disputes. Adults should add only information they have authority to share and consider the child's privacy and wishes.

Teenagers ages 13–17 need an invitation and recorded authority attestation from a current eligible adult Family Circle Admin. The approval records the adult, minor account, Circle, timestamp and policy version. Teenagers participate as Members, with optional reminders and AI preferences off by default; they cannot control billing, administer or delete Circles, or replace adult administration. Guardian approval does not authorize marketing. An adult Admin can revoke membership or guardian approval, ending access without automatically erasing shared family history.

Age screening precedes registration and does not ask a prospective under-13 user for an email or password. An adult's submitted account birth date is not retained as Auth metadata. A teenager's private adulthood-transition date is DOB-derivable personal information and is removed or minimized at adulthood. A Circle Person's optional family birthday is a separate shared-history field, not a public account-age record.

If a previously independent account is reliably identified as under 13, Cyrviva blocks its access and retires independent email/password, pending tokens and sessions while retaining its historical identifier and lawful Circle history. A restricted normalized-email hash and age-13/18 dates prevent early re-registration and enforce guardian participation later; they are removed at adult eligibility. A hash is not anonymous. Ambiguous cases require review. At 13 or later, an adult may invite an eligible Person to claim the existing profile and history; no account is automatically created and the old login is not automatically restored.

Parents, guardians, teenagers and other people concerned about family information may request review, correction, removal or access through the verified privacy contact when available below. Cyrviva must verify identity and authority proportionately and consider other contributors' rights; receiving an email does not automatically disclose or delete a Circle. Until monitored email intake is activated, external invitations remain held and signed-in reviewers can use private feedback. Jurisdiction-specific child and teen obligations and earlier processing still require professional review; this notice does not claim COPPA compliance or offer an independent under-13 account service.

You can change profile and reminder settings and use the export or deletion controls described above. The final process for access, correction, deletion, and other applicable privacy requests, including response times and identity checks, needs approval. A monitored privacy contact is still required. See Help for current guidance.

We should communicate material changes to this policy before they take effect. The notice method, effective date, and any renewed acceptance process remain under review.