Privacy notice for the iOS app
Last updated: 14 October 2026
The German version is legally binding. This notice supplements the website and web-app privacy notice and describes the native CircleRecs app for iOS.
1. Controller and privacy contact
The controller is Axel Springer Deutschland GmbH, Axel-Springer-Straße 65, 10888 Berlin, Germany. Contact the data protection officer at datenschutz@axelspringer.com using “CircleRecs – Betroffenenrechte” as the subject.
2. Installation, sign-in, and account
Apple independently processes App Store download data. Sign-in uses Sign in with Apple or Google Login, and CircleRecs manages the session. We process a technical user ID, provider, email where supplied, profile name, username, profile photo, language and, if you provide it voluntarily, birth year and age band. CircleRecs is for adults aged 18 or over; you confirm this independently of the optional age field. Other users do not receive your exact birth year. You can remove the age information from your profile at any time.
When email access is enabled, you can use a confirmed email address and password; self-registration requires a separate rollout. The sign-in forms send passwords and codes directly to Amazon Cognito, not to the CircleRecs product API or analytics. Amazon SES sends invitations, confirmation and recovery codes. A project-specific AWS Lambda function formats emails in the selected language without logging codes. The language of each action is used for delivery; during registration it is also saved as a language preference in the Cognito account. Passwords and codes are not stored in the product database. The email address is used for sign-in, security and recovery, not automatically for marketing. Existing account-deletion rules also apply to these accounts.
3. Circles, public profiles, subscriptions, chats, and content
Recommendations, lists, notes, tags, photos, videos, reactions, messages, and profile data follow the visibility you choose. Private circles and chats are restricted to their members. Content you release through a public profile can be publicly visible. Blocks, personal Want and Pass places, import previews, and unpublished drafts remain private. For a private profile, signed-in users may still see your display name, username, profile photo, and aggregate counts of recommendations, followers, and followed profiles. Recommendations, places, bio, taste tags, social links, and the follower/following lists remain hidden. Private profiles are excluded from ranked creator suggestions; a signed-in user must explicitly enable the separate private-profile view and may then filter it by name or username. Following a private profile does not unlock this content. You can remove followers or block accounts. CircleRecs does not create movement profiles and prohibits using place data to monitor or stalk people.
If you join an Exclusive Circle, Apple independently handles the purchase and payment; CircleRecs does not receive card or bank details. To verify, provide, and restore access, we process a random identifier linking the purchase to your app account, Apple product identifier, original and latest transaction identifiers, environment, purchase and expiry times, and subscription, renewal, grace-period, refund, and revocation status. The legal bases are Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR for misuse prevention and legal claims, and Art. 6(1)(c) GDPR for legally required accounting records.
For approved creators, we also process approval and account status, assigned product and Exclusive Circle, agreed revenue share, payout currency and threshold, and proceeds, refund, adjustment, and payout entries. Contract, invoice, tax, and bank details are handled only through authorised finance and contracting processes and are not displayed publicly.
4. Location, maps, and places
With iOS permission, the app uses your current location to centre the map, run Near Me, support a search you start, or determine the current city once for creator suggestions (see below). We do not create a persistent location history or use background location. The app uses Apple MapKit and Apple Maps for address suggestions. For place searches, OpenStreetMap/Nominatim and, where needed, Geoapify may receive the search term, language, and an optional country hint. OpenFreeMap supplies map styles and tiles, MapLibre GL runs locally, and Overture place data is also used without receiving your queries.
If you explicitly open directions in Google Maps, iOS passes the selected destination to Google Maps. Google then processes the data required for maps and navigation under its own terms. Google Maps is not the embedded map provider in the CircleRecs iOS app.
5. Ask, AI, embeddings, and voice
Ask and labelled AI-assisted place features send the current input and necessary recommendations to OpenAI under the Axel Springer enterprise agreement. Outputs are generated automatically and may be wrong. API content is not used to train general-purpose models. Pinecone processes embeddings with limited search metadata. CircleRecs considers only content you are allowed to access, and semantic search data is deleted with its content or account.
When you explicitly start AI-assisted place search, the query, language, region, and the place or map context you selected may also be sent to OpenAI. OpenAI may search publicly available web sources to suggest a venue identity, address, and—where reliably found on the official website of that exact venue—opening hours. CircleRecs does not accept AI-suggested coordinates without verification against our place catalogue and geocoding services. Suggestions may be wrong or outdated and can be reviewed before saving.
If the detected language of a personal recommendation note visible to you differs from your app language, CircleRecs may use OpenAI to create a display-only translation. The original remains unchanged and can always be shown. The access-controlled translation is refreshed after edits and deleted with the recommendation or account; editing, Ask, search, and filters continue to use the original.
Voice first uses Apple Speech. Only after your explicit first-use consent do we send a short recording securely to OpenAI for improved transcription. You may withdraw consent for the future. Raw recordings are discarded after the request and are not retained; typing is always available.
Optional nearby search with Geoapify
When you consent and start nearby search, our backend sends the search position rounded to four decimal places, or your entered address, plus category and language to Geoapify / KEPTAGO LTD as processor. We exclusively use api-eu.geoapify.com. Geoapify finds up to 20 public places within 200 m and a street label for the search position. Manual addresses are first resolved into positions for you to choose. Your account identifier, profile and Circle content are not forwarded; the provider connection comes from our backend, not your device IP. The legal basis is consent under Art. 6(1)(a) GDPR. Device location is accessed only on your action and with device permission; alternatively, enter an address.
Geoapify normally retains detailed personal API request data for no more than 24 hours. In exceptional cases, including suspicious or fraudulent activity, individual request details may be retained for analysis for up to two months. This is not Zero Data Retention. The incorporated Geoapify standard DPA applies, including its subprocessors for the EU connection. Geoapify DPA
We hold the search position, address and results temporarily for the current flow only, not in search histories or technical logs. This feature creates no location history or profile and does not use location for advertising or background monitoring. Leaving or withdrawing clears the transient search state. Only a place you deliberately select and then save becomes part of your content, not your original search location. Authentication and usage limits internally use your account identifier under Art. 6(1)(b) GDPR, with no location in the counters.
Your consent is stored locally on this device with account identifier, version and time, without location. Withdraw anytime under ⓘ and optionally revoke device permission. The local record is removed or replaced on withdrawal, account deletion on the device or consent by another account. Withdrawal applies to future requests and does not affect prior lawful processing. Existing OpenAI search consent is not reused for Geoapify; the provider change requires a new choice. Regular place search remains independently available.
Explore nearby on the map
Map-based Explore nearby requires separate consent. Only when you tap do we send the chosen map centre, rounded to four decimal places, categories and language through our backend to the existing Geoapify EU service. We retrieve up to 20 public places within 500 m straight-line distance, not a guaranteed walking route. Moving the map makes no request. Your account identifier, profile and private content are not forwarded to Geoapify. The basis is your voluntary consent under Art. 6(1)(a) GDPR. The Geoapify retention periods and recipients described above apply.
If you then use Ask, the confirmed search is repeated with Geoapify to verify the selected place identifiers. Selected public venue facts may be processed with your question in the existing Ask AI flow; existing AI consent remains required. Public venue data is identified as such, not presented as personal recommendations. Discovery alone does not generate AI tags, save a place or share anything.
The search area and results stay only in memory and are discarded on ×, leaving the map or changing accounts. Separately, consent is saved on this device with only the account and version identifiers until reset, account deletion or replacement by another account consent. Reset it under Account or Settings in your profile; the next search will ask again. Searches never start automatically. No location history or search position is stored in logs or usage limits. Only explicit saving or recommending adds a venue to your content, where correction, deletion and export remain available. Withdrawal does not affect prior lawful processing. Add’s 200 m search remains independent.
Notice for older app versions with AI search
Optional AI area discovery
If you voluntarily consent to AI place search and start Discover places, we send your position rounded to three decimal places or the area you enter, optional category and language through our backend to OpenAI for web search for public cafés, restaurants, bars and bakeries. Location is requested only after Use my location and device permission. Alternatively, enter an area. The legal basis is your consent under Art. 6(1)(a) GDPR. Your account identifier, profile and private Circle content are not sent to the AI. CircleRecs internally processes your account identifier for authentication and usage limits under Art. 6(1)(b) GDPR.
Requests use the approved OpenAI EU connection with effective Zero Data Retention for request content. Web search may involve OpenAI search providers; further recipient information appears below. Search location and request content are not stored in our technical logs. Inputs and results remain in memory only for the current flow and are discarded when you leave. This feature creates no location history, background access, tracking or profiling. You can withdraw consent in the search panel and revoke device permission to prevent further location queries. This does not affect processing lawfully performed before withdrawal.
Only when you select a suggestion do we use its public venue name and address for the existing place lookup. You check the correct place, can edit the draft and choose whether to save it and who can see it. Regular place search remains independently available. If you open a source link, the external website's own privacy notice applies.
To avoid asking again for each search, we remember your consent locally on this device with your account identifier, notice version and timestamp. This record contains no location and is not sent to OpenAI. It remains until you withdraw through the nearby search info button, delete your account on this device, or replace it by consenting for another account. We ask again when the described data flow changes.
Licensed venue photographs
Where member photographs are absent, we may display a licensed venue photograph from Wikimedia Commons. Our server looks up public venue identifiers through Geoapify (EU), OpenStreetMap via overpass-api.de and, where needed, Wikidata/Wikimedia Commons. These services receive the server IP and requested public identifiers, not your account identifier, device IP, notes or GPS position. Wikimedia may process outside the EEA. Images are served from our AWS storage; your browser connects to an external source only when you open a source link. We keep no personal history of your image requests.
If no usable direct image reference is available, our server may also search Wikimedia Commons using the public venue name and city from Geoapify. On our server, we compare published image coordinates or unambiguous venue and address evidence with public provider data. A provider-linked venue category may also serve as a source when the exact address is established, or for artworks when the complete subject name and published image coordinates match. Your GPS position is not transmitted for this. Ambiguous matches are not used.
We store the optimized image, a small thumbnail and author, source and license credits separately from member uploads. Credits are accessible alongside the image. Stored images are scheduled for revalidation when requested again after 90 days. Incorrect or challenged images can be blocked and deleted from our storage; copies already loaded on devices cannot be recalled. Contact support@circlerecs.com with the venue or source link. An external image does not imply a member's visit or authorship.
We may also manually curate individually reviewed, openly licensed Flickr photographs. Only public photo and attribution information is checked; no member data is sent to Flickr. Flickr may process outside the EEA. These images are also served from our AWS storage, without contacting Flickr when a venue is opened. Manually curated images follow documented individual review and the same blocking and deletion process.
© OpenStreetMap contributors · ODbL · Powered by Geoapify · Wikimedia Commons
Google venue photos: limited iOS pilot
For individually enabled test accounts and public venues, the iOS app may load Google Places UI Kit when the detail view opens and owned media is absent. Google receives the public place identifier and connection and technical SDK data directly from the device, such as its IP address and a technical device identifier. We do not send your CircleRecs account identifier, notes, contacts, search questions or GPS position for this feature. Lists, map pins and app startup do not load this component.
If a verified Google place identifier is missing, our server may match the public venue name, address and venue coordinates with Google Places when such a detail view opens. These are catalogue facts, not your device location or private notes. Uncertain matches are not used. We retain the matched place identifier and our own comparison data; additional Google response fields are processed only during matching.
Google photos and attribution remain in a separate Google component. CircleRecs does not store these photos on its servers or add them to member galleries or semantic search. We store the verified place-ID mapping and account-free quota counters, not a personal history of your photo requests. Pilot access can be revoked and expires automatically. Contact support@circlerecs.com to leave the pilot or report an incorrect place match. Google may process data outside the EEA; its privacy policy provides further information.
Trends: matching public venues
For Trends, we research public venues using OpenAI web search based on a city and, where relevant, a category. Free text filters existing results and is not sent to research in this workflow. To match a venue, our server may send its independently researched public name, city, country and, if available, address to Google Places. We do not send account identifiers, private recommendations, notes or device locations for this matching.
Public research results are reused for up to 30 days. We store the Google place identifier separately from a temporary coordinate copy. That copy becomes invalid in the active system within 21 days and is regularly deleted; retention including time-limited backups is less than 30 days. Coordinates may be refreshed when the venue is used again. Your saved venue relationship remains separate. Other Google response fields are processed only during matching; durable catalogue names, addresses and descriptions come from independent sources. Google may process data outside the EEA. Report incorrect matches or deletion requests to support@circlerecs.com.
6. Photos and videos
Media is uploaded only after you select or capture it and follows your chosen audience. Do not upload unnecessary sensitive data, confidential documents, or content about others without permission. You can delete your media; previews and optimized copies follow the same visibility and deletion lifecycle.
7. Google Login and public-list import
Google Login is only for authentication. Separately, you can paste a public Google Maps list link. CircleRecs uses the public list data to show you editable place suggestions and may use the providers described in sections 5 and 11 for this purpose. Nothing is saved or shared until you confirm. There is no access to your private Google account and no Google Data Portability/OAuth import. Unselected candidates are not semantically indexed and are deleted within 30 days.
8. Import from public social-media links
Through the iOS share sheet, you can send CircleRecs a public Instagram, TikTok, or YouTube post. We may process the public link, platform, text or caption supplied by the share sheet, and publicly available preview data (title, creator name, cover) to suggest a place. CircleRecs does not sign in to your social-media account or access private content.
We reduce link parameters to the required public post address. Shared text may be sent to OpenAI to prepare editable place suggestions. A caption does not automatically become your personal recommendation. Temporary share-extension files are removed after handoff or discard. Only places and media you confirm are stored as CircleRecs content with the visibility you choose. If you confirm the post is yours and choose to show it on the recommendation, we store the public link and the creator name you confirmed; the cover may then be stored as your recommendation photo. We do not store another creator's name or image as yours. Share only content you are entitled to use.
9. Push notifications
If enabled, an APNs device token is processed through Apple for selected circle, chat, and account notices. You can control notifications in iOS and, where offered, per circle. The token is removed on logout, account deletion, or technical invalidation.
10. Affiliate links, analytics, and diagnostics
Marked partner links may use a pseudonymous attribution ID, destination, time, and status, deleted within 90 days. Minimal product events used to improve CircleRecs are deleted within 30 days. Dash0 processes technical telemetry and errors. CircleRecs does not perform cross-app advertising tracking.
First-party product analytics covers no more than one active-day record per platform, the app version, and categorised actions such as opening a place detail, push notification, or Ask source, or sharing an invitation. It contains no search text, message content, location coordinates, or place, recommendation, or Circle identifiers. The legal basis is our legitimate interest in developing a useful and stable service under Art. 6(1)(f) GDPR. We use neither third-party analytics SDKs nor cross-app advertising tracking for this purpose. You may object on grounds relating to your particular situation.
Invitation openings additionally use a random handoff identifier on the device for at most 24 hours. The server retains the time, platform, invitation type and associated account and Circle identifiers for at most 30 days to associate a possible signup and join or follow. We store no access tokens for this purpose and do not fingerprint devices. Account-free totals remain; access and objection requests can be sent to our privacy contact.
11. Recipients, transfers, and security
Depending on your choices, recipients include circle members, followers, or public visitors, and our providers AWS, Apple for App Store purchases and subscription status, Google for sign-in, public-list retrieval and the enabled venue-photo component, OpenAI, Pinecone, Dash0, OpenStreetMap/Nominatim, Geoapify, OpenFreeMap, and Hostinger. Transfers outside the EEA rely on adequacy decisions including the EU-US Data Privacy Framework or Art. 46 GDPR safeguards. Transfers are encrypted and access is restricted according to your permissions.
For creator payouts, only authorised product, legal, tax, and finance teams within the Axel Springer organisation receive the necessary data. Banks and, where legally required, tax authorities may be further recipients. Apple independently processes App Store purchases under its own privacy terms.
12. Retention and deletion
Product data is normally retained until you delete the content or account. Technical logs, product events, and unselected import candidates are deleted within 30 days. To count unique monthly users, only the activity month is kept per account and platform until month end plus at most two days (33 days maximum); account deletion removes this membership. Cohort statistics derived from them contain no user or content identifier and remain only as aggregate metrics. Affiliate attribution is deleted within 90 days and database backups within seven days unless law requires longer. Account deletion removes active product data, media, import data, and semantic search data, while remaining backups expire on schedule.
Account deletion does not cancel an Apple subscription. We delete or detach the active account association, while minimised transaction and payout records may be retained for Apple notifications, refunds, misuse prevention, legal claims, and statutory accounting and retention duties. They are deleted or anonymised when those purposes end. You manage and cancel the subscription separately in your Apple Account.
13. App Store data summary
Depending on use, CircleRecs processes contact and account data, user content, approximate or actively requested precise location, searches, public social-media links and content supplied through the share sheet, purchase history and subscription status, usage and diagnostics, and technical identifiers for app functionality, personalization, security, and analytics—not third-party advertising or cross-app tracking. The Apple App Store declarations and this full notice provide the authoritative details.
14. Your rights
Subject to legal requirements, you have rights to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent for the future. Contact datenschutz@axelspringer.com with “CircleRecs – Betroffenenrechte” as the subject. You may also complain to a data protection authority.
Network-based account suggestions
We use public follow connections within CircleRecs to suggest relevant public accounts. If you follow X and X follows Y, Y may be suggested. Public recommendations and search cities you select help establish relevance. We do not use private or inaccessible relationships, private Circle content, GPS, address books or external social networks for this purpose. Reasons such as ‘Followed by X’ use only public relationships visible at the time of retrieval.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is improving relevant account suggestions within the existing service; a balancing assessment has been completed. Processing takes place only in our existing backend infrastructure with AWS as processor. We do not send these connections to AI or advertising services, use them for advertising, or make decisions with legal or similarly significant effects. Network copies, ranking scores and suggestion reasons are not stored permanently.
Turn off network suggestions under Discover → From your network → Settings. Your follow connections will then no longer be used for your personalised suggestions; regular search remains available. For hidden network suggestions, we store only your account ID and the hidden account ID for as long as necessary to honour your choice. This suppression data is deleted when you reset hidden suggestions, either relevant account is deleted, or the purpose no longer applies. Your right to object under Art. 21 GDPR remains unaffected. Contact the privacy contact above for access, export or further objections.
Private cities for creator suggestions
Under “Tips for …”, choose up to five cities or “Everywhere”. We store this setting with your account ID in our existing AWS database, not in your public profile. It is used only to order creator suggestions by your preferred cities. You can change it anytime; “Everywhere” removes saved city names and disables automatic location context. The setting is deleted with your account. Contact the privacy contact above for access or export.
Without an explicit city selection, or with “Current city”, previously granted location access can determine your current city once. iOS uses Apple geocoding; Web uses the existing place lookup through our backend. Without permission or if lookup fails, discovery remains worldwide. Automatically inferred cities stay in the session; we store neither GPS coordinates nor location history. A city you explicitly confirm can be saved as a preference. There is no background tracking or transfer of the setting to AI or advertising services. Saved preferences serve the function you request; location access requires your revocable system permission.
Optional news and offers via push
Separately from messages and Circle updates, you can explicitly opt in to push notifications about CircleRecs product news and offers. This preference is off by default. Processing is based on your consent (Art. 6(1)(a) GDPR). Consent is not required to use the app or enter a raffle. iOS system permission alone does not constitute consent to these notifications.
In our existing AWS infrastructure we store only your account ID, current decision, change timestamp and, when enabled, the consent text version. We do not build a behavioral profile or share this preference with AI or advertising networks. The decision is retained until you change it or delete your account. On withdrawal we remove the active consent version and retain only the off preference and timestamp so you are not prompted again automatically. Account deletion also deletes this preference. You can request access through our existing privacy contact channels.
Withdraw consent at any time under Profile → News & offers for future processing; this does not affect processing that was lawful before withdrawal. ‘Not now’ stops automatic prompts. The general push switch and iOS settings also continue to apply. This version prepares consent management; it does not activate custom campaign delivery. Any later delivery through Apple Push Notification Service must check the current consent again.
Optional prize draw
Entry is free, voluntary, age 18+ and requires explicit registration. Before joining, you separately accept that round's rules. Signing in alone does not enter you. No purchase or subscription is required. A private profile is made public only after separate confirmation.
For one entry, all three goals must be met at the deadline: 10 different positive public place recommendations in the same city, following 5 different accounts, and membership in a free Circle with at least 4 active members including you. Your profile and recommendations must be public. Existing activity counts. You need not have created the Circle; other accounts need not enter. Blocked contacts and people who object to processing are excluded. Private places and messages are not evaluated.
One entry per person; no multiple accounts. More activity adds no entries and there is no points leaderboard. Regular community points are unchanged. The first DE/VN cash round is only for people ordinarily resident in Germany or Vietnam. At least 100 valid entrants across both countries combined are required. Below that, no draw or prizes. At 100 or more, three different winners are selected randomly, each receiving the economic value of EUR 100. An explicitly labelled test round remains without payout. The specific rules and dates show whether and when a round is open; this general description does not activate a round.
The rules and dates displayed before registration for the specific round apply. Before a cash round opens, the organizer, eligible territory, any exclusions, and contact, response and payout deadlines must be specified. Available languages do not imply worldwide eligibility. Apple does not sponsor or administer the draw.
Accepting the rules is not consent to advertising. The basis for limited eligibility checks is described in the privacy notice below. There is no public participant leaderboard. You can leave without removing your content, contacts or regular points. An authenticated export of your participation data is available.
Eligibility checks
To verify eligibility, we may process, to a limited extent, account data visible publicly or within the platform about people who do not enter the giveaway, particularly relevant followed accounts or Circle members.
Processing is solely for eligibility verification and proper operation of the giveaway, based on our legitimate interest under Article 6(1)(f) GDPR. The data is not used for advertising or published in connection with the giveaway, and is processed only as long as necessary to verify eligibility.
Our privacy policy includes further information about the controller, data subject rights and how to object: Privacy policy.
We store registration, rules version and limited progress counts, not contact or member lists. The DE/VN round also records the rules content hash, declared country of ordinary residence and necessary winner, contact and processing status. Leaving and account deletion remove participation. Earlier v1 rounds are still deleted within six hours of their published expiry. For the DE/VN round, necessary operational data is retained until winner checks, any replacement draws and payment are completed; data no longer needed is then deleted by the cleanup process. Legally required financial, tax and legal records are retained separately and only for those purposes. No advertising use. Objections, access and other privacy rights: support@circlerecs.com or datenschutz@axelspringer.com.
Archive: earlier points challenge, not the rules of this draw