8.1 Access Your Data

All your personal data is accessible within the Cirano app on your device. You can view your RelationShape and insights at any time. To access your account data (email, platform preferences), contact support@cirano.us.

8.2 Delete Your Data

Delete the App (see Section 5.2) to permanently remove all personal data from your device. To delete your account and associated email and preference data, contact support@cirano.us. 

8.3 Correct Your Data

Your relationship data is derived from your actual activity. To update it, simply continue using your connected platforms normally — your RelationShape updates in real-time. To update your email address or platform preferences, contact support@cirano.us.

8.4 Export Your Data

Your personal data remains on your device. You can take screenshots of your insights for personal records. We do not provide formal data export because your data never leaves your device.

8.5 Opt-Out of Data Collection

To opt out of all data processing:

• Revoke App permissions in device settings

• Disconnect platforms within the App

• Delete the App

8.6 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act (collectively, the CCPA). This section describes those rights and explains how to exercise them:

Categories of Personal Information We Collect.  In the preceding 12 months, we have collected the following categories of personal information, as those terms are defined in the CCPA: 

• Identifiers (such as email address and unique user ID).

• Platform Interest Preferences: When you tell us which platforms you would like added to Cirano, we collect that preference. 

• Internet or other electronic network activity information and device information (such as device type, operating system version, app version, crash logs, and limited usage metrics), collected through PostHog (analytics) and Sentry (crash reporting). This data is completely anonymous and aggregated and cannot be linked to you or your device.

• Commercial information, such as your subscription status and App Store receipt data, is processed by RevenueCat solely for subscription management purposes.

We do not collect personal information from your connected platforms or the content of your communications, as described in Section 2.

Sources and Purposes. We collect these categories of personal information directly from you (when you create an account or contact us) and automatically from your device (through the App and our analytics and crash‑reporting tools). Account data is stored and managed through Supabase. We use this information to provide the Service, maintain security, debug and improve the App, and comply with legal obligations.

Disclosures of Personal Information.  We do not “sell” or “share” your personal information as those terms are defined under the CCPA. We may disclose personal information to service providers (such as our account management (Supabase), subscription management, analytics, and crash‑reporting providers) that process it on our behalf for the limited purposes described in this Privacy Policy, under contracts that restrict their use of the information. Your CCPA Rights. Subject to certain exceptions, California residents have the following rights:

• Right to Know: You can request information about the categories of personal information we collect about you, the purpose for collecting it, categories of third parties to whom we disclose it, and the specific pieces of personal information we hold about you. As detailed in Section 2, we collect your email address, unique user ID, and platform preferences, minimal anonymous technical data, and no personal information from connected platforms.

• Right to Correct. You can request that we correct inaccurate personal information that we maintain about you.

• Right to Delete: You can request that we delete personal information we collected from you, subject to certain exceptions (for example, where we need the information to comply with a legal obligation or detect security incidents). Request deletion of personal information by deleting the App (see Section 5.2) or contacting support@cirano.us to delete your account data.

• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information. If that ever changes, we will update this Privacy Policy and provide you with any required notices and opt‑out mechanisms.

• Right to Limit Use of Sensitive Personal Information. At this time, we do not collect sensitive personal information as defined under the CCPA.

• Right to Non-Discrimination: We do not discriminate based on privacy rights exercised.

• How to Exercise Rights: Contact support@cirano.us. We will verify your identity prior to fulfilling your request, which may include confirming your email address or other information associated with your account. We will respond within the applicable law, generally within 45 days.
  
  

Appeals. If we deny your request in whole or in part, you may appeal our decision by contacting us at support@cirano.us with the subject line "CCPA Appeal." We will review your appeal and respond within 45 days. If your appeal is denied, you may contact the California Attorney General at https://oag.ca.gov for further assistance.

8.7 European Users (GDPR)

If you are located in the European Union, you may have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, or erase your personal data, and the right to data portability. Under the GDPR, “personal data” means any information relating to an identified or identifiable natural person. Our App is designed so that your messaging data is processed locally on your device and is not intentionally transmitted to or stored externally. However, we do collect and store limited personal data necessary to operate the Service through third-party providers, as described below. In particular:

• We do not intentionally collect or store the content of your communications or other personal data from the third‑party platforms you connect to.

• For account management and support, we may process limited contact information that you choose to provide to us (such as your email address), and minimal technical information (such as app version or error logs) where this is strictly necessary to operate and improve the App.

Personal Data We Hold. Notwithstanding our on-device architecture, we do process the following categories of personal data: (i) your email address and unique user ID, collected at account creation and stored via Supabase; (ii) your optional display name, stored via Supabase; (iii) your platform interest preferences, stored via Supabase; (iv) subscription status and App Store receipt data, processed by RevenueCat; and (v) anonymous technical data including device type, OS version, app version, crash logs, and usage statistics, collected via PostHog and Sentry.

To the extent we act as a “controller” of any personal data under the GDPR (for example, your account email address or support correspondence), you have the rights to:

• Request access to, and a copy of, the personal data we hold about you.

• Request correction of inaccurate personal data.

• Request deletion of your personal data, in whole or in part, where applicable.

• Object to or request restriction of our processing in certain circumstances.

• Request that we provide your personal data to you or to another organization in a structured, commonly used, and machine-readable format (data portability), where technically feasible.

• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

• Object to processing based on legitimate interests.

We rely on one or more of the following legal bases to process personal data for these limited purposes: (i) performance of a contract with you (providing the App and managing your account), (ii) our legitimate interests (for example, maintaining and improving the App, preventing abuse), and/or (iii) your consent where required.

You can exercise your GDPR rights or ask questions regarding your rights under GDPR by contacting us at support@cirano.us. We may need to request certain information from you in order to verify your identity before acting on your request. If you are not satisfied with our response, you may lodge a complaint with your local data protection authority.

Appeals. If we deny your request in whole or in part, we will explain our reasons. You may appeal our decision by contacting us at support@cirano.us with the subject line "GDPR Appeal." We will review your appeal and respond within 30 days. If you remain unsatisfied, you have the right to lodge a complaint with your local data protection authority. A list of EEA supervisory authorities is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office at ico.org.uk.