Version 1.4, October 2026
The short version
Your account. Username, email address, and a hashed password we can't read back.
Your profile. Display name, the line about yourself, and your public address at /~/ if you've chosen one.
Your work. Writing, audio files, titles, the filename the file arrived with, and its length.
Your opens. One row every time you open something: what it was, who made it, whether it was the words or the audio, which billing period it fell in, and when. This is the record the money is computed from, so it is the most consequential thing here.
Your billing. Stripe's customer and subscription identifiers, the state of your subscription, and the dates your period runs between. Not your card.
You can record, upload and write on Circate before you have an account. All of that stays in your browser, in its own storage on that device. None of it is sent to us. We can't see it, and a different browser or device doesn't have it.
Your browser decides how long it keeps it. Some keep it until you clear your browsing data; Safari clears a site's storage after seven days without a visit. We ask your browser to keep it, and it may say no.
The microphone is asked for only when you press Record, and what it records stays in your browser like everything else.
When you join, the next time you open MINE in that browser we ask whether to bring it in. If you say yes, it's uploaded then, into your account, private. Once it has all arrived it is cleared from the browser. If you say no, it stays in the browser until you bring it in, choose to forget it, or the browser clears it.
Read this part twice. It is unusual, and it is the point of the design.
Money here is verifiable, which means a creator has to be able to check the arithmetic behind what they were paid. So when you open somebody's work, their ledger shows them the name you go by here, which of their works you opened, how many times you opened their work altogether, and what it earned them.
That name is your display name, or your username if you haven't set one. It is whatever you chose, and a pseudonym works perfectly well. We never ask for your legal name and don't have one to show anybody. Your email is never shown to another subscriber.
Your username is the fallback, so pick one you're content to be seen under. It is also the same name that sits on your own public work, so somebody who sees it in their ledger can find your catalogue.
It also shows how many things you opened in total that period, because their share of your $10.50 is meaningless without the number it was divided by. That figure gives a rough sense of how much you used Circate that period to every person you opened.
What it does not show them is what else you opened, or whose. Each creator sees only their own line: your opens of them, out of your total. Nobody sees your activity across the site, and nobody but you sees the list of what you opened.
Nor does it show when. We keep the time of every open, because that is what places it in the right billing period, but nobody else ever sees it. Nor does it show how many times you opened any one piece, only which pieces, and your total across them. If you opened just one of their works, that total is its count.
Opening anything is not anonymous, and it can't be. It can be pseudonymous, and that is up to you. But if you'd rather a particular person didn't know you read or listened to them, the only reliable answer is not to open it.
Closing your account doesn't undo any of it. The name comes off, but the entries stay and the money stays moved. Somebody was paid for those opens, and their ledger still has to add up.
Work you mark public is reachable by anyone with a subscription, under your display name. Work you leave private is visible only to you.
If you've taken a public address at /~/ then your display name, your description and your public work sit behind it and are meant to be shared. Nothing about your ledger, your billing, or what you've opened is ever on it.
While your subscription is lapsed, your address at /~/ stops working altogether for everyone but you, and your work stops resolving with it. You can still sign in and see your own. Both come back when the payment clears.
Stripe processes every payment. Your card details go to them directly and never touch our servers. We hold their identifiers for you and the status they report back.
Stripe's own policy covers what they do with it: stripe.com/privacy
If you ask for a cash payout we may have to collect identity and tax details, and to report what we paid you.
Audio lives in a private Cloudflare R2 bucket, not on our server. The bucket has no public address, so nothing in it can be reached by guessing.
Playing something signs a temporary URL for that one file, for you, after we've checked you're allowed it. The link expires.
Two, both necessary: one that keeps you signed in, which lasts 120 days, and one that protects forms against being submitted from somewhere else. Signed out, the first is set only if you switch between Map and List on somebody's page, to remember which you chose.
Your browser's own storage also keeps a few small choices on this device, like Map or List and the timelapse's speed, and, before you join, what you make (above). None of it is sent to us.
No analytics cookies, no advertising cookies, no third-party tracking of any kind. Nothing follows you off the site.
We email you about your account, meaning password resets, address changes, and problems with a payment. There's no marketing list to be on.
We don't use your work or your activity to train models, and we don't let anyone else.
If that were ever to change we'd tell you first, and it would be something you opt into rather than out of.
Your account and your work stay as long as your account does. Deleted work goes to the trash rather than out of the database, so it can be restored and so past opens still have something to point at.
Ledger entries are different, and we never delete them. Every one of them is the record of money moving from one member to another, and we can't remove a row without changing what somebody else was paid. Nobody can delete them either. Not the person who opened, not the person who earned, not us on request. That is the point of them.
What we do remove is what makes a row about you. Once an account's details are gone, its entries say only that some account opened some thing on some date. There is no name in them, no email, and nothing to trace back. We keep those indefinitely, because a payment record that expires would leave a creator unable to check an old period and us unable to stand behind what we paid them.
Only two things stay attached to you after you leave, and the next section sets out both. Everything else goes when you ask.
Write to us and we'll close it. It isn't instant, and the sequence is the reason rather than an excuse for it. Your subscription stops at the end of the period you've already paid for, and your work comes off then. Anything you're owed can't be worked out until every period holding an open of your work has settled, and those run on other people's billing days, so that can take up to a month more. We'll tell you what you're owed and ask what you want done with it before anything is removed — we won't scrub an account and then have no way to work out whose balance it was.
Then everything that identifies you is cleared: your email address, your username, your display name, your address at /~/, and anything you wrote about yourself. Your work comes down, and the files go with it. What's left is an account with no person attached to it.
Only two things outlast it:
Your ledger entries stay, stripped of you, for the reasons above. Somebody whose work you opened was paid for it, their own ledger still shows what they earned, and the arithmetic behind it has to stay true.
Wherever you are, you can:
Most of it is already on your own screens, since your ledger is the complete record of your opens and what they cost. For anything else, email us and we'll answer within a month.
If you're in California, the CCPA gives you the right to know what we collect and to have it deleted. We do not sell or share personal information, so there is nothing to opt out of.
Circate is for adults. You have to be 18 to hold an account, and we don't knowingly keep anything about anyone younger. If we find out we have, we delete it.
Everything travels over HTTPS, passwords are hashed rather than stored, the media bucket is private, and sessions expire. No system is perfect, and we'll tell you promptly if something happens that affects you.
If we change this in a way that matters, we'll say so by email or on the site before it takes effect.
Anything at all: info@circate.com