Privacy

Updated September 29, 2026

Threecle is a social network built around three circles. This page explains what data we process when you use the Threecle app and the threecle.com website, why, who can access it, how long we keep it and how to exercise your rights.

The essentials

We don’t sell your data. Not to advertisers, not to anyone.
No targeted ads, no tracking. No advertising trackers or analytics tools, in the app or on the website.
Your posts stay in the circle you pick. Only Community is visible to everyone.
You stay in control. You can delete your account from the app in a few taps.

Who is responsible

Threecle is published by Théodore Paliani, as an individual. He is the controller of your data under the GDPR and, in Québec, the person in charge of the protection of personal information.

For any question about your data: the contact form, subject “Personal data”.

The data we process

We only collect what Threecle needs to work. Features marked “optional” process nothing until you use them.

Your account: Email address, password (stored in an unreadable form, never in plain text), username, display name, profile photo, what you add to your profile and your language.
Your phone number optional: If you confirm it by SMS, so that people who have it in their contacts can find you. You can turn this off at any time from the app.
Your circles: The people you place in your circles, the requests you send or receive and the people you block. The circle you put someone in is never shown to them. The number of people who add you without you adding them back is used to compute your Resonance: only you see the number; from 1,000, visitors to your profile see a halo and a phrase.
What you post: Pings, Pingrams, Pulses, fragments and comments, your likes, repings and bookmarks, with their date and the circle you picked. The numbers on your posts are shown to you alone.
Your private messages: Texts, photos, videos, voice messages and GIFs exchanged in your conversations, stored so they can be delivered. Media sent “view once” are encrypted, and their key is destroyed when opened: they become unreadable, including to us. We don’t read your messages; if one is reported to us, we may look at that message to handle the report.
Contact import optional: Your phone turns each number in your contacts into an irreversible fingerprint before anything is sent: no name or number leaves your device. Our server transforms that fingerprint a second time with a secret key, then compares it with the numbers confirmed on Threecle. Fingerprints are kept for 180 days, and you can erase them at any time from the app.
Places optional: When you add a place to a post, your location is used, at that moment, to suggest nearby places. Only the place you pick is saved with the post.
Work verification optional: The work email address you verify (we send a code to it), the matching company and its public logo.
Reports: When you report content or an account: what is reported and the reason you chose. Your report stays confidential.
Technical data: IP address, device type, app version and connection logs, to keep the service secure and fix errors.

On threecle.com

Waitlist: Your email address, the phone you picked (iPhone or Android), the site language and your country, inferred from your connection.
Contact form: Your first name, last name, email address and message, the site language and your country, inferred from your connection.
Bot check: When you start filling in a form, Cloudflare Turnstile checks that it is being sent by a person, not an automated program. To do so, it receives your IP address, your browser type and version, and a technical fingerprint of your connection. Nothing is loaded if you only read the pages. Details in the Turnstile Privacy Addendum.
Cookies: The site sets just one, only if you switch languages: it remembers that choice for a year. If you pause the animations, your browser remembers that too, on your device. Cloudflare’s bot check, loaded only when you fill in a form, may use cookies strictly necessary for that check. No advertising or analytics cookies.

Why, and on what basis

Running Threecle: Creating your account, showing your posts to the right circle, delivering your messages, suggesting Community posts and people to discover based on your activity on Threecle, sending service emails (codes, password reset). Legal basis: performance of the contract formed by the terms of use.
Optional features: Contact import, places, work verification, translation, GIFs. Legal basis: your consent, given when you turn the feature on and withdrawable at any time.
Safety and moderation: Preventing abuse (including spam sent through the site’s forms, with the bot check), handling reports, protecting people. Legal basis: our legitimate interest in keeping Threecle safe, and our legal obligations.
Waitlist: Telling you when we open and giving you access to the beta. Legal basis: your consent.
Contact form: Replying to you. Legal basis: our legitimate interest in answering the messages we receive.
Legal obligations: Answering requests from authorities and keeping what the law requires. Legal basis: our legal obligations.

We don’t use your data for advertising, and no decision with legal effects on you is made by automated means.

We don’t sell, rent or trade any data.

Other members

What you post is visible to the circle you pick. Your profile (display name, username, photo) is visible to Threecle members.

Our service providers

Each for its own task only:

Supabase: app hosting (database, accounts and files) in the European Union;
Cloudflare: hosting of the website, the waitlist and the contact form, protection against attacks, and the bot check on the forms (Turnstile);
Resend: service emails, plus waitlist sign-ups and contact form messages forwarded to our mailbox, sent from Ireland;
an SMS provider, used through Supabase, to send the confirmation code for your number;
Google Workspace: our mailbox, which receives waitlist sign-ups and contact form messages;
Apple (TestFlight) and Google (Google Play): your email address, to invite you to the beta.

Services your phone calls directly

When you use some features, your phone contacts an external service directly, which receives your IP address and what the feature needs:

GIPHY: your GIF searches;
Google Translate: the text you ask to translate;
OpenStreetMap (Nominatim, Overpass) and Photon (komoot): the location or search used to suggest places;
the websites whose links you share: your phone reads the start of the page to show a preview.

Authorities

Only when legally required, for example by a court order.

Transfers outside the European Union

App data and the waitlist are hosted in the European Union, as is the copy of contact form messages kept by the website. Some providers are based outside the EU: in the United States (Cloudflare, Resend, Google, Apple, GIPHY) and in Singapore (Supabase, whose app servers stay in the EU). Resend keeps the content and logs of the emails it sends in the United States for 30 days, including waitlist sign-ups and contact form messages, which we then receive in our Google Workspace mailbox. These transfers rely on the EU-U.S. Data Privacy Framework or on the European Commission’s standard contractual clauses.

How long we keep it

Your account and content: As long as your account exists. If you delete it, it disappears for others right away; you have 30 days to change your mind, then everything is permanently erased, except what the law requires us to keep. Messages you already sent remain readable by their recipients until then.
Content you delete: It is no longer visible as soon as you delete it.
Contact fingerprints: 180 days, erasable at any time.
Reports: As long as needed to handle them, then as long as needed to prevent repeated abuse.
Technical logs: A few weeks at most, unless there is a security incident.
Waitlist: Until Threecle opens to everyone, and no more than two years after you sign up.
Contact form messages: As long as needed to reply, and no more than a year.

Security

Encrypted connections (HTTPS), data access restricted by rules enforced by the database itself, passwords never stored in plain text, contact fingerprints protected by a secret key, “view once” media encrypted. No system is flawless: if a data breach puts you at risk, we notify the competent authority within 72 hours and, where needed, the people affected.

Your rights

At any time, you can:

access your data and get a copy;
have it corrected;
have it erased, account deletion being available directly in the app;
receive it in a structured, machine-readable format (portability);
object to processing based on our legitimate interest, or ask for it to be restricted;
withdraw your consent to an optional feature;
in France, set instructions for what happens to your data after your death.

To exercise them: the contact form, subject “Personal data”. We reply within one month. We only ask for proof of identity when there is reasonable doubt.

If you believe your rights aren’t being respected, you can complain to your country’s data protection authority: the CNIL in France, the Data Protection Authority in Belgium, the FDPIC in Switzerland or the Commission d’accès à l’information in Québec.

Minors

Threecle is for people aged 13 and over. Between 13 and 15, the consent of a parent or guardian is required. If you believe a child under 13 is using Threecle, write to us and we will delete their account.

Changes

If this policy changes significantly, we will let you know in the app before the new version applies. The date of the last update is shown at the top of this page.