This page is maintained by the Circulet team to answer common security and privacy questions about the app. It is editable app-owned content, not an independent certification.
Accounts are protected by email and password sign-in managed by our hosting platform (Lovable Cloud). Passwords are never stored or visible to the app.
We store your username, avatar color, in-game token balance, item inventory, and gameplay activity. We do not collect payment information or sensitive personal data.
Database access is restricted with row-level security so users can only read and modify their own profile fields. Game state (tokens, inventory) is mutated only through server-side game logic, not by the client directly.
The app runs on Lovable Cloud, which provides managed hosting, database, and authentication. Data is encrypted in transit (HTTPS) and at rest by the platform. This is a shared-responsibility model: platform capabilities are provided by Lovable, while app-level rules are maintained by us.
To delete your account or request a copy of your data, contact the app owner through the support channel listed on the home page.
If you believe you've found a security vulnerability, please contact the app owner directly rather than disclosing it publicly.
This page describes current app practices and is not a certification or legal guarantee. It may be updated as the app evolves.