Privacy Policy

Last updated: 19 June 2026

This Privacy Policy explains how Squircle Limited ("Squircle", "we", "us") collects, uses, and protects your personal data when you use the Squircle mobile app and related services. We are committed to the principles of the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

1. Who we are

Data Controller: Squircle Limited
Registered in Ireland — Companies Registration Office (CRO) number 819052
Registered address: Holly Lodge, Ballycrane, Castlebridge, Co. Wexford, Y35 PP26, Ireland
Contact email: privacy@squircle.app
Support email: support@squircle.app

2. What we collect and why

We collect only the data needed to operate Squircle. You can browse the discovery feed and view offer details without an account — we collect personal data only when you choose to sign up.

Data	When collected	Why	Legal basis (GDPR)
Name	Sign up	Display in your profile and on claimed-offer QR codes	Contract performance (Art. 6(1)(b))
Email address	Sign up	Account login, password reset, account-related notifications	Contract performance (Art. 6(1)(b))
Phone number	Sign up (optional)	Account recovery; venue contact if needed	Contract performance (Art. 6(1)(b))
Approximate location	When you grant location permission	Show offers near you in the discovery feed	Consent (Art. 6(1)(a))
Device push token (FCM)	When you grant notifications permission	Send you push notifications about new offers	Consent (Art. 6(1)(a))
App usage events	Throughout app use	Improve product, fix bugs, measure feature usage	Legitimate interest (Art. 6(1)(f))
Claim history	When you claim an offer	Show your QR code at the venue; prevent duplicate claims	Contract performance (Art. 6(1)(b))
Audit log of admin/organizer actions	If you are an admin or organizer	Security, fraud prevention, compliance	Legitimate interest (Art. 6(1)(f))

We do not collect: precise GPS coordinates, contacts, photos (other than profile pictures you choose to upload), browsing history outside the app, advertising identifiers, biometric data, or financial information (Squircle is free; no payments occur in the app).

3. Who we share data with

We use the following third-party service providers as "processors" under GDPR. Each is bound by a Data Processing Agreement and may only act on our instructions.

Firebase Cloud Messaging (Google Ireland Limited) — delivers push notifications. Receives your device push token only.
Brevo (Sendinblue SAS, France) — sends transactional emails (account verification, password reset). Receives your email address and the relevant message content.
Render (Render Services, Inc., USA) — hosts our backend servers. Stores all account and offer data. EU customer data is hosted in Frankfurt where available.
Cloudflare R2 (Cloudflare, Inc., USA) — stores uploaded images (profile photos, offer posters). Files are accessed by URL only.

International transfers: Render and Cloudflare may transfer data to the United States. We rely on EU Standard Contractual Clauses (SCCs) for these transfers, as approved by the European Commission.

We do not sell, rent, or trade your personal data to anyone. We do not share data with advertisers or analytics networks beyond what is listed above.

4. How long we keep your data

Account data (name, email, phone, profile picture) — kept until you delete your account.
Claim history — past claimed offers remain with the offering venue's records for accounting purposes (per Irish tax law, typically up to 6 years), but identifying details about you are anonymized when you delete your account.
Device push tokens — kept until the device unsubscribes, uninstalls the app, or your account is deleted.
Audit logs — automatically deleted after 14 days.
Server logs (IP, request URLs, status codes) — retained for up to 30 days for security and debugging.

5. Your rights under GDPR

You have the following rights under EU data protection law:

Access — request a copy of the personal data we hold about you.
Rectification — correct inaccurate or incomplete data. You can edit your name, email, and phone in the app's Profile screen.
Erasure ("Right to be forgotten") — request deletion of your account and personal data. You can do this directly in the app: Profile → Delete my account. Past offer-claim records remain with the venue, anonymized.
Restriction — request that we limit how we process your data.
Portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interest.
Withdraw consent — for location and notifications, revoke at any time in your device's system settings.
Lodge a complaint — with the Irish Data Protection Commission at dataprotection.ie.

To exercise any of these rights, contact us at privacy@squircle.app. We respond within 30 days.

6. Children

Squircle is intended for users 13 years and older. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us at privacy@squircle.app and we will delete it.

7. Security

All data is transmitted over HTTPS (TLS 1.2+). Passwords are hashed with bcrypt. Bearer tokens for the mobile API are scoped per device and revocable. We restrict access to production systems to authorized personnel.

No method of internet transmission or storage is 100% secure. If we discover a breach involving your personal data, we will notify the Irish Data Protection Commission within 72 hours and notify affected users without undue delay.

8. Changes to this policy

We may update this Privacy Policy as the app evolves. We will revise the "Last updated" date at the top and, for material changes, notify you via email or an in-app message before the changes take effect.

9. Contact

Questions about this policy or our data practices?
Email: privacy@squircle.app
Postal: Squircle Limited, Holly Lodge, Ballycrane, Castlebridge, Co. Wexford, Y35 PP26, Ireland