1. Scope and who we serve
This Privacy Policy applies to the Nearby Circle mobile application, nearbycircle.app, and the supporting Nearby Circle service. The service is intended only for people aged 18 or older.
2. Information we collect and use
Account and authentication
We create an internal account identifier and use device-installation and session identifiers to keep you signed in, protect sessions, prevent abuse, and operate the service.
Where phone authentication is available, we process your phone number and one-time-code delivery and verification records. One-time codes and recoverable delivery payloads are short-lived and protected; we do not use your phone number as public profile information.
Google Sign-In
If you choose Google Sign-In, the app receives a signed Google ID token. Nearby Circle verifies its signature, issuer, expiry, intended audience, and immutable Google account subject. We use a protected form of that subject to authenticate or link your Nearby Circle account.
The current implementation does not request Google API scopes and does not use the email address, name, or profile photo claims that may be present in a Google ID token. It does not request or access Gmail, Google Drive, Google Contacts, Google Calendar, or other Google services. Nearby Circle does not receive or store your Google password.
Profile and adult eligibility
We process the display name, gender option, and date of birth you provide. Date of birth is used to enforce the 18+ eligibility rule and is not shown on public Nearby profiles; a derived age may be displayed. We store profile photos you upload, after processing them into metadata-stripped image variants. Profile photos are separate from verification evidence.
Nearby location
With foreground location permission, the app sends your current location so the service can find eligible verified adults in a selected distance band. Precise discovery coordinates are kept only in the transient nearby-presence store with a five-minute expiry. Other users are shown a broad label such as “Within 5 km”—not your exact coordinates or exact distance. Location is not made public through the website.
Human verification
Human verification uses a current selfie and an interactive liveness session. Amazon Rekognition Face Liveness processes camera imagery and returns liveness, reference-image, and limited audit-image results; Nearby Circle also uses face comparison between the dedicated verification selfie and same-session reference image. AWS does not provide Nearby Circle with the raw liveness video, so the application does not store it.
We keep verification attempt status, timestamps, provider references, confidence or decision information, and security/audit records needed to operate and review the process. Normal-attempt evidence is discarded according to the verification workflow. If a third substantive failure requires manual review, only the minimum encrypted evidence—the verification selfie, same-session reference image, and at most one audit image—is retained for the bounded review period.
Greetings, friendships, and safety
We store Greetings, friend requests, friendship state, and block state so that people can choose who may contact them. Blocking is enforced in both directions and is used to stop discovery and social interaction between the affected accounts.
End-to-end encrypted Friend Chat
Friend Chat text is end-to-end encrypted on users’ devices using the app’s strict Vodozemac Olm V2 implementation. Nearby Circle servers do not receive the plaintext or hold a master key that can decrypt it.
To deliver and synchronize chat, the server stores encrypted message ciphertext plus limited metadata: conversation and friendship identifiers, sender and recipient account/device identifiers, a client message identifier, protocol and message type, ordering timestamps, and delivery/read state. The service also stores public device identity keys and public one-time or fallback key material. Private chat keys remain on the device in Android Keystore-backed protected storage.
Technical and security information
We process limited operational records such as request correlation identifiers, security events, error diagnostics, rate-limit state, and audit events. Sensitive payloads, exact location, verification media, passwords, one-time codes, and chat plaintext are not intended to appear in application logs.
3. Why we use information
- Provide authentication, profiles, nearby discovery, verification, Greetings, friendships, blocking, and encrypted Friend Chat.
- Enforce adult eligibility, user choices, authorization, and safety controls.
- Prevent fraud, spam, impersonation, abuse, and unauthorized access.
- Operate, troubleshoot, secure, and improve the early-access service.
- Comply with applicable legal obligations and respond to valid legal requests.
4. Google user data
Nearby Circle’s use of information received from Google is limited to authentication and identity linking as described above. Google user data is not used for advertising, profiling, or training models, and is not sold. We do not transfer Google user data to data brokers or sell it to any third party.
Nearby Circle uses the minimum Google identity value needed for the current sign-in flow: a verified immutable Google subject, stored only in protected form and linked to the internal Nearby Circle account.
5. Service providers and disclosures
We use carefully scoped providers to operate the service. Amazon Web Services hosts application workloads and provides PostgreSQL database, transient Valkey, private object storage, content delivery, logging, and Amazon Rekognition verification processing. Google provides the optional Sign-In authentication flow. Where phone authentication is enabled, Fast2SMS provides one-time-code delivery in supported regions.
These providers process information for the service functions described here and under their applicable terms. We may disclose information when required by law, to protect people or the service, or as part of a properly governed business transfer. We do not sell personal information.
6. Storage, security, and location of processing
The current cloud environment is hosted in AWS, primarily in the Mumbai region. We use private storage, encryption in transit, encryption at rest where applicable, restricted workload access, short-lived sessions, separation of profile and verification media, and client-side end-to-end encryption for Friend Chat.
No system can guarantee absolute security. Private-beta participants should use a protected device and should not share one-time codes or account access.
7. Retention and deletion
We retain account, profile, friendship, block, encrypted-chat, and necessary audit records while needed to provide and protect the service, subject to deletion obligations and future finalized legal retention schedules. Precise nearby-presence coordinates expire after five minutes. Authentication challenges and temporary security state have bounded expiries.
Verification evidence follows a separate minimum-necessary lifecycle. Evidence that is not needed for review is discarded through the normal terminal workflow. Manual-review evidence has a configured maximum of 14 days in the current environment and is scheduled for deletion earlier when a terminal review decision allows it.
You may ask for access, correction, or deletion through the privacy contact described below. Some records may be retained where necessary for security, fraud prevention, legal compliance, dispute resolution, or enforcement. The early access does not promise instantaneous deletion of provider backups or legally required records.
8. Your choices and rights
You can choose whether to use Google or an available phone sign-in method, whether to grant foreground location permission, which profile photos to upload, whom to greet or befriend, and whom to block. Denying location permission prevents nearby discovery but does not make location public.
Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to processing of your personal information. During the controlled early access, contact the Nearby Circle owner or test coordinator through the same verified channel that provided your build or early-access invitation. Do not send passwords, one-time codes, private keys, or identity documents in a privacy request.
9. Children
Nearby Circle is not intended for anyone under 18. The service uses the supplied date of birth to enforce adult eligibility. If we learn that an under-18 account was created, we will take appropriate steps to restrict or remove it.
10. Policy updates
We may update this policy as the product, providers, legal requirements, or public-release scope changes. The page will show a revised effective date. Material changes will be communicated through an appropriate product or early-access channel before they take effect where required.
11. Contact
For privacy questions or requests during the early access, contact the Nearby Circle owner or test coordinator through the verified invitation channel you already use. A dedicated public privacy contact will be published before broader public onboarding. Never include a password, one-time code, Google credential, or chat encryption key in your request.