Trust
Private to the people you choose.
A Circle is shared by design, so “private” here means something precise. Only the people invited to a Circle can reach what is inside it, and what each of them can do is decided by its owner.
Not everyone in a Circle can do everything.
A Circle has one owner: the person who created it. They decide who can enter and whether each member is a viewer or a contributor. Permission is granted deliberately, not inherited by joining.
- Permission 1
Viewer
- Browse everything the Circle holds
- View albums and timelines
- Read written stories
- Listen to voice recordings
- Compare originals and created versions
- Comment on a photo, where the album allows comments
- Permission 2
Contributor
- Everything a viewer can do
- Upload photos
- Capture physical prints
- Add documents and related material
- Write memories and record voice stories
- Suggest names, dates and places
- Contribute to albums and timelines
- Restore, reframe and prepare print-ready versions
- Permission 3
Owner
- Everything a contributor can do
- Invite and remove members
- Change what an existing member can do
- Turn comments off for an album
- Remove anyone’s comment
- Decide what may leave the Circle
A member holds one of these roles at a time. Someone might look and listen for a year, then be moved to contributor so they can record a story. A role can be changed or withdrawn at any time by the Circle’s owner.
What happens to the photo you upload.
The original is never overwritten
Restoring, reframing or reformatting a photo produces a separate created version. The source file you uploaded stays exactly as it arrived.
Created versions are labelled
Anything Cirluma produced is identified as a created version and stays linked to the original it came from, so nobody later mistakes one for the other.
Deleting one does not delete the other
Removing a created version leaves the original untouched. Removing an original is a separate, deliberate action.
Other people’s stories are not yours to publish.
Consent where a person is recognisable
Preserving someone’s likeness across created versions requires explicit consent. It is not something a Circle can switch on for a person who has not agreed.
Nothing becomes public by default
A Circle is private to its members. Nothing is published outside it without an explicit decision by someone with permission to make it.
Contributions stay attributed
Each name, date, story and correction is credited to the member who added it. That record is part of the memory, not metadata hidden behind it.
Likeness: consent, authority and limits.
A reviewed Likeness is the most consequential thing in the product, so it carries the most explicit boundaries. If any of these cannot be satisfied, the answer is no rather than a smaller yes.
- What a Likeness is
- A reviewed set of reference images of one person at one period of their life. It exists so that when a damaged photo is mended, the person who comes back is the person who was there, not a stranger with roughly the right hair.
- Who can authorise one
- The person themselves, wherever they are able to. Where they are not, because they have died or cannot give consent, it takes someone with the standing to speak for them, and the Circle records who that was. “Everyone in the Circle agreed” is not authority.
- It is bounded to a period
- A Likeness covers an age and an era, not a whole life. A reference built from photos of someone at twenty-six is not authority to generate them at sixty. That would need its own, reviewed separately.
- It can be withdrawn
- Consent given is not consent forever. A Likeness can be revoked, and revoking it stops it being used again.
What a created version is, and what it is not.
Cirluma can produce things a photo never contained. The distinction between mending what was there and inferring what was lost is the one that has to hold, so it is stated rather than implied.
- A created version is an interpretation, not a discovery
- Mending a crease is repair. Filling in what a crease destroyed is inference: a plausible reconstruction, not recovered fact. Cirluma does not present the second as though it were the first.
- Widening a frame invents what was outside it
- A reframed photo extends the scene using the rest of the Circle’s material and the light in the original. It is a reasonable continuation of the room. It is not evidence of what was actually standing there.
- Where a 360 scene comes from
- A scene is assembled from several photos of the same place, contributed by members of that Circle. It is built from what the Circle holds rather than imagined around a single frame, and the source views stay visible so anyone can see what it was made from.
- The source and the output never merge
- Every created output carries a link back to the material it came from. That link is the point: a record where the interpretation and the evidence are indistinguishable is worse than no record.
What the platform itself can and cannot do.
Permissions inside a Circle are only half the question. The other half is what we can reach, and what being a member does not entitle anyone to.
- What we can reach
- Running the service means our systems store and serve your files. We do not browse Circles for interest, and access for support or investigation is limited, logged, and used only where there is a reason.
- What membership does not grant
- Being in a Circle is not ownership of what other members contributed. A member who leaves does not take other people’s stories with them, and an owner’s authority over the Circle is not authority over a contributor’s consent.
- What we do not do with your material
- Your photos and stories are not used to train general-purpose models, and they are not sold or shared for advertising. Where a created version needs processing outside our own systems, that is described in the privacy notice rather than buried.
Deletion, and where it has limits.
You can delete your own content, and a Circle’s owner can delete the Circle. When you ask for something to be deleted, it is removed from the Circle and from the people who could see it.
We will not claim deletion is instant and absolute everywhere, because that would not be true of any service. Consent decisions, security events and payment records are kept for the periods the law requires, separately from your photos and stories. Backups age out on their own schedule rather than the moment you press delete.
The full detail, including retention periods and how to make a request, belongs in the privacy notice rather than a marketing page.