CIRCA, by Tilpop, Inc. Last updated: 25 September 2026.
About this policy
CIRCA is a companion app for gatherings: a destination wedding, a birthday, a long weekend away. It is made and operated by Tilpop, Inc.
This policy describes, in plain English, what the app collects, why, and who can see it. It is written to match what the app actually does rather than to cover every thing an app of this kind might do. If something here does not match your experience of the app, that is a bug in one of the two and we want to hear about it.
This policy is not legal advice, and it is not a contract.
Information we collect
From signing in
Your name, as your sign-in provider passes it through. If you use Apple's Hide My Email, your provider may not pass a real name, and the app will ask you to type one.
Your email address, or your Apple relay address.
An identifier from your sign-in provider, which is how we know it is you next time.
What you put into a gathering
Your profile: your photo, the name you go by, and any contact details or social handles you choose to add. Each of those has its own visibility switch.
Photographs and videos you share, with their captions and any tags, and the capture time and location your device recorded in the file.
Messages you send, and posts, comments and reactions in the gathering's common room.
Your replies: whether you are going, what you can and cannot eat, and anything you note for a host.
Your travel: flights, stays and rides you record or upload, including the document you uploaded to have read.
Song requests and votes.
What a host puts in about you
A host builds a guest list. That list can hold your name, your email address and your phone number before you have ever opened the app, because that is how they invite you. If you are added from a host's phone contacts, only the people they pick are stored, and only on that guest list; their contact book is never uploaded.
From your device, with your permission
Location, while you are using the app, for three things: the weather where you are, telling you what you are looking at in a photo, and offering to let your gathering know you have arrived once you are in the country it is being held in. Where you are is never shown to anyone at your gathering.
Photos, camera and microphone, for the things you choose to capture or pick.
Contacts, only when a host picks people to add to a guest list.
Calendar, to write the gathering's events and your own travel into your calendar and keep them right when they change. The app does not read your other events.
Notifications, through a device token, so we can reach you about your gathering.
Basic crash and performance data, so we can fix what breaks.
We do not collect payment details, we do not track you across other apps or websites, and we do not use your information for advertising.
How we use your information
To run the gathering. Showing the plan, the people, the photographs and the messages to the people entitled to see them.
To match you to a guest list. When you sign in, we compare your email address and phone number against the guest lists you may have been added to.
To read what you upload. A flight confirmation, a booking, a guest list in a spreadsheet or a photograph of one: the app reads these so you do not have to type them out. Where your device can do this itself it does, on the phone, and nothing leaves it. Where it cannot, the file is sent to Anthropic's Claude model to be read and turned into rows you review before anything is saved.
To answer questions and translate. Asking the app something, or translating a phrase, is answered on your device where it can be and by Anthropic's Claude where it cannot.
To suggest places. Restaurants, bars and things to do near a gathering are drawn up once per destination and checked against Google Places. This is about the place, not about you: nothing of yours is sent.
To look up a flight. A flight number and a date go to AeroDataBox to fetch the times. Your name does not.
To keep the app working and safe. Finding bugs and stopping misuse.
Who can see what
A gathering is private to the people in it. Within one, other members can see your name and profile photo, whatever you have chosen to make visible on your profile, and what you post: your photographs, your messages in threads you are part of, your comments and your song requests.
Hosts and the planners they authorise can additionally see your reply, your dietary notes and the travel you have recorded, because that is what they need to plan around you.
Members of one gathering cannot see anything from another. When you leave a gathering or a host removes you, your access ends and your row comes off the guest list.
Who we share information with
We do not sell your information and we do not share it with anybody for their own purposes. We use these services to run the app:
Google Firebase (Google LLC) for sign-in, the database, file storage, server code and notifications. Data is held in Google's us-central1 region, in the United States. firebase.google.com/support/privacy
Anthropic (Anthropic PBC) for reading uploaded documents, translating, answering questions and writing the end-of-gathering narrative. Calls are transient and the input is not retained after the response under our usage tier, and it is not used to train models. anthropic.com/legal/privacy
Apple for sign-in, for on-device intelligence, and for Apple Music if you connect it. apple.com/legal/privacy
We may also disclose information if the law requires it of us.
Storage and retention
Your information is stored with Google Firebase in the United States, and is cached on your own device while you use the app.
A gathering's content is kept while the gathering is live and for as long afterwards as its members may want to look back at it. When a gathering is archived it becomes read-only for the people who were in it. If you delete your account, we delete the profile, the replies and the dietary notes attached to you, and remove you from the guest lists you were on, within 30 days. Photographs and messages you contributed to a shared gathering may remain, because they are part of other people's record of the same days; tell us if you want those removed too and we will.
Your choices and rights
See it. Most of what we hold is visible in the app. Ask us for the rest.
Correct it. Edit your profile in the app, or ask us.
Delete it. You can delete your account from the app, under You, and you can ask us instead.
Choose what is visible. Every contact detail and social handle on your profile has its own switch, under your privacy settings.
Turn permissions off. Location, contacts, photos, calendar, microphone and notifications are all revocable in the iOS Settings app at any time, and the app keeps working without them.
If you are in the UK, the European Economic Area, or a US state with its own privacy law, you may have further rights, including to object to a use, to ask for a portable copy, or to complain to your regulator. Write to us and we will honour them.
Children
CIRCA is not directed at children under 13 and we do not knowingly collect their information. A child may appear in a photograph another guest shares, as they might in any family album. If you believe we hold information about a child that should not be there, tell us and we will remove it.
Changes to this policy
If we change it we will change the date at the top, and if the change is material we will say so in the app.