Privacy policy

Your data stays under your control.

Effective and last updated: August 20, 2026

1. Scope and operator

This policy describes how the CircleSignal web application is operated by Nick Oddson (the “developer,” “CircleSignal,” “we,” “us,” or “our”). It applies to the application hosted at https://noddson.github.io/CircleSignal/. Third-party websites, browser features, operating systems, passkey providers, and services linked from the application have their own privacy practices.

2. Information processed on your device

Depending on how you use CircleSignal, the application may process the following information locally in your browser:

• channel names and optional contact photos you select;
• cryptographic secrets, hash-chain seeds or anchors, rotating codes, proof phrases, counters, setup codes, and related configuration;
• an optional context secret entered while creating or using a channel;
• your vault recovery password or device-generated recovery code and temporary cryptographic keys while the vault is being created, unlocked, changed, or used;
• camera frames used to scan a QR setup code; and
• the non-sensitive preference indicating whether Simple mode is enabled.

Camera frames are processed in page memory and are not intentionally saved or uploaded. Selected contact photos are resized locally. Context values, vault recovery secrets, unwrapped keys, and decrypted channel material may exist temporarily in browser memory while needed for the requested operation, but CircleSignal does not intentionally persist them in plaintext. Passkey-enabled vaults display a device-generated recovery code once and can download it as an unencrypted local text file at your request. The browser and operating system control the downloaded file after it is saved.

The encrypted vault contains a local audit history capped at 100 entries. Each entry contains only an ISO date and an allowlisted action describing a security-relevant choice or lifecycle event, such as accepting a warned recovery password, creating a below-Good code format, disabling automatic locking, changing vault recovery or device unlock, downloading a recovery code, completing a Google Drive backup or restore, or reaching five consecutive failed recovery-secret unlocks. It does not include the chosen password, code, channel name, contact, Google account or file identifier, or free-form text. Ordinary unlocks, passkey cancellations, and failed or cancelled cloud operations are not recorded. If the vault is unavailable for encryption, a validated date/action pair may wait temporarily in LocalStorage until the next successful vault creation or unlock save, after which the pending copy is removed. A separate capped LocalStorage counter tracks consecutive recovery-secret unlock failures and is cleared after a successful password, recovery-code, or device unlock. This history is not tamper-proof and follows the encrypted vault when it is backed up or restored.

3. Local browser storage

If you create and use the optional encrypted vault, saved channels, contact photos, counters, and proof state are encrypted with AES-256-GCM and stored in IndexedDB for the application’s browser origin. The persisted vault record also contains cryptographic metadata needed for decryption, such as version information, salts, initialization vectors, wrapped keys, and—if device unlock is configured—a passkey credential identifier and related non-secret parameters.

The Simple mode preference is stored separately in LocalStorage and is not encrypted because it contains no channel or identity information. Without an unlocked vault and an explicit save choice, channel information remains in page memory and is normally lost when the page is closed or reloaded.

You can remove the encrypted vault using the application’s two-step Purge vault control or by clearing site data in your browser. The purge confirmation can also revoke CircleSignal’s Google Drive access and can optionally delete its encrypted Drive backup before revocation. Clearing browser data, changing browsers, or changing devices may also remove the local vault. A passkey may remain listed by your operating system or passkey provider after the local vault is purged, but it cannot unlock a vault record that no longer exists.

4. Passkeys and device unlock

On supported devices, CircleSignal can use WebAuthn and its PRF extension to wrap the vault key after your browser or operating system performs user verification. CircleSignal does not receive or store your fingerprint, face scan, device passcode, or other biometric template. Your operating system, browser, authenticator, and passkey provider control their own processing and any passkey synchronization.

5. Information sent off your device

Application hosting. The application is delivered through GitHub Pages. When your browser requests the site, GitHub may process ordinary web-request information such as IP address, device or browser information, requested URLs, and timestamps under the GitHub Privacy Statement. The developer may receive limited aggregate traffic information made available by GitHub.

Information you deliberately share. A setup code or QR code is created locally. It leaves your device only when you choose to copy, display, transmit, or otherwise share it. The recipient and any communication service you use will process that information under their own practices.

External links. CircleSignal links to GitHub commit pages, Wikipedia, and PayPal. Those services receive information only when you choose to follow their links, subject to their own privacy policies. An optional contribution is handled by PayPal; CircleSignal does not receive your payment credentials.

CircleSignal does not currently use application analytics, advertising trackers, marketing pixels, or developer-set cookies. It does not sell personal information or share it for cross-context behavioral advertising.

6. Optional Google Drive backup

If you choose to connect Google Drive from Vault options, CircleSignal requests only the drive.appdata permission to create, read, and update its own hidden application-data file. It does not request access to your ordinary Google Drive files. Authorization and backup actions are initiated by you; backup is not automatic.

The backup contains the encrypted vault record and associated cryptographic metadata, such as its format version, salts, initialization vectors, wrapped keys, and ciphertext. CircleSignal does not intentionally upload the vault recovery secret, context values, unwrapped vault key, decrypted channel contents, or plaintext contact photos. Google may process account, authorization, file metadata, network, and service-usage information under Google’s own policies.

Google Drive access will be optional and initiated by you. CircleSignal will use Google API information only to provide the visible encrypted-backup and restore functions you request. CircleSignal’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google API information will not be sold, used for advertising, used to determine creditworthiness, or used to train a general-purpose artificial-intelligence model.

7. Retention and deletion

• In-memory information normally remains until it is cleared, the vault is locked, the page is reloaded or closed, or the browser runtime releases it.
• Local encrypted-vault information remains until you purge the vault or clear the application’s browser storage.
• Local preferences remain until you change them or clear site storage.
• The Google Drive backup remains in your Google account until you remove it through Google Drive account controls or select backup deletion while purging the vault. Securely locking CircleSignal discards its token from the current tab but does not revoke the account permission or delete the backup. The purge flow can revoke that permission after any selected backup deletion completes.
• Hosting and third-party records are retained by the relevant provider under its own policy.

8. Disclosure and service providers

The developer does not intentionally receive your vault contents, channel secrets, contexts, contact photos, codes, proof phrases, or vault recovery secret. Information may be processed by GitHub as the hosting provider, by Google only if you choose the optional Google Drive integration, by PayPal if you choose to contribute, or by another service you independently use to transmit a setup code. Information may also be disclosed if legally required, but the developer cannot disclose application data that the developer does not possess.

9. Security and important limitations

CircleSignal uses browser cryptography and encrypted local storage, but no system can guarantee absolute security. Encryption at rest does not protect an unlocked session. A compromised application update, webpage, browser extension, browser profile, operating system, device, authenticator, or cloud account could expose information. JavaScript cannot guarantee immediate erasure of values from memory because memory management is controlled by the browser runtime.

You are responsible for safeguarding setup codes, context secrets, vault recovery passwords or codes, downloaded recovery files, devices, browser profiles, passkeys, backups, and any communication method used to transfer information.

10. Your choices and privacy rights

You can choose not to create a vault, not to save a channel, not to provide a contact photo or context, not to enable camera access or device unlock, and not to connect Google Drive. Browser and operating-system settings let you revoke camera or passkey access and clear local storage. Google account controls let you revoke Drive access and remove hidden application data. Where applicable law grants access, correction, deletion, restriction, objection, portability, or appeal rights, you may exercise them with the party that holds the relevant information. Most application content is held only under your control on your device.

11. Children

CircleSignal is not directed to children under 13, and the developer does not knowingly collect personal information from children through an application backend. A parent or guardian who believes a child has provided information directly to the developer may use the contact method below.

12. International processing

GitHub, Google, PayPal, passkey providers, and other services you choose may process information in countries other than your own. Their privacy policies describe their processing locations and transfer safeguards.

13. Changes to this policy

This policy may be updated when CircleSignal changes or when legal or service-provider requirements change. The effective date at the top will be revised. Material changes affecting Google API information will be disclosed before that information is used in a new way, and additional consent will be requested where required.

14. Contact

Privacy questions may be directed to Nick Oddson through the CircleSignal GitHub repository. Do not include vault recovery secrets, context secrets, setup codes, contact photos, or other sensitive information in a public GitHub issue.