Circle Unchained logoCIRCLE UNCHAINED
← Back to home

Privacy Policy

Last updated: July 8, 2026

Summary

Circle Unchained ("the Extension") and circleunchained.app ("the Site") are operated by Circle Unchained ("we", "us"). This policy explains — in one place — exactly what personal or sensitive user data we collect, how we handle it, where and how long it is stored, who we share it with, and how you can control it. The Extension is built local-first: media detection and downloading happen entirely inside your browser and are never transmitted to us.

1. Data the Extension Collects

The Extension itself does not collect, transmit, or sell any personal or sensitive user data. It only processes data locally, in your browser, for the single purpose of detecting and downloading media on pages you explicitly open. Specifically:

  • Web page content (local only): The Extension reads the DOM and observes network requests on the active tab to identify downloadable media (video/audio streams, PDFs, images, slides). This data never leaves your device.
  • Locally stored preferences: Settings, detected-media lists for the active tab, and your license key (if entered) are stored inchrome.storage.local on your own machine. This data is not synced to us.
  • Authentication token (only if you sign in): When you choose to sign in through the Extension, a session token issued by our backend is stored locally so the Extension can validate your license. You can sign out at any time to remove it.
  • Anonymous device ID: The Extension generates a random UUID the first time it runs and stores it inchrome.storage.local asdeviceId. It is not derived from your hardware, browser fingerprint, IP address, or any personal identifier — it is a random value that only identifies "this install of the Extension." You can reset it at any time by clearing the Extension's storage or reinstalling.
  • Download event records (when signed in or licensed): When a download succeeds, the Extension sends a small record to our backend containing: the anonymous device ID above, the license or account it was performed under, the media type (e.g. video, pdf), the source platform (e.g.circle.so), the source URL, and a timestamp. We use this only to (a) enforce free/trial download quotas and (b) show the license owner and site admins aggregate usage (downloads per license, distinct devices per license). It is not used for advertising, profiling, or resale.
  • What we do NOT collect from the Extension: browsing history, keystrokes, form inputs, passwords, financial data, health data, personal communications, location, hardware fingerprints, or any content of the communities you belong to.

We do not sell or transfer user data to third parties. We do not use user data for purposes unrelated to the Extension's single core function. We do not use user data to determine creditworthiness or for lending purposes.

2. Data the Site Collects (Accounts & Licensing)

When you create an account or purchase a license on circleunchained.app, we collect:

  • Email address — to create your account, deliver your license key, and send account-related notices (receipts, security alerts, policy updates).
  • Authentication credentials — password hash and session tokens managed by our authentication provider. We never see your plaintext password.
  • License activation data — license key, activation timestamps, plan tier, and the anonymous device ID described in Section 1 so we can show the license owner and admins how many distinct devices a license is being used on. The device ID is a random UUID, not a hardware or browser fingerprint.
  • Payment metadata — order ID, amount, country (for VAT/tax), and last-4 of card, returned by Stripe. Full card numbers are entered directly with Stripe and never touch our servers.
  • Support correspondence — if you email support, we keep the message and your address to respond and improve the product.
  • Minimal server logs — IP address, user-agent, and timestamps for security, abuse prevention, and debugging. Not used for advertising or profiling.

3. How We Use Data

  • Provide, maintain, and secure the Extension and Site.
  • Issue, validate, and enforce license keys.
  • Process payments, refunds, and tax reporting.
  • Send transactional emails (receipts, license delivery, password resets, policy changes). No marketing emails without opt-in.
  • Detect fraud, abuse, and violations of our Terms.
  • Comply with legal obligations.

We do not use your data for advertising, profiling, or automated decision-making with legal effects.

4. Permissions the Extension Requests

Each Chrome permission we request is used narrowly and only for the Extension's core function:

  • activeTab / tabs / scripting — scan the tab you invoke the Extension on for downloadable media.
  • storage — save your settings, detected-media list, and (optionally) your license key locally.
  • downloads — write the file you asked to download to your device's Downloads folder.
  • webRequest — observe media network requests locally to detect streams (e.g. HLS manifests). Requests are not logged or sent to us.
  • offscreen — run video/HLS assembly in an offscreen document because the Chrome popup closes on click-away.
  • host_permissions (Circle.so and supported LMS/video hosts) — required to read media on those specific pages and to fetch media segments from their CDNs. We do not access any other sites.

5. How & Where Data Is Stored

  • On your device: Extension preferences, detected-media metadata for the current tab, and (optionally) your license key/session token live in chrome.storage.local. Downloaded files land in your local Downloads folder — we never see them.
  • On our servers: Account, license, and payment-metadata records are stored in an encrypted PostgreSQL database hosted on Supabase (EU region) behind Cloudflare. Data is encrypted in transit (TLS 1.2+) and at rest.
  • Access controls: Access to production data is limited to the operator on a need-to-know basis and requires multi-factor authentication.

6. Data Sharing & Third-Party Processors

We do not sell your data and we do not share it with third parties for advertising. We share the minimum necessary data with the following sub-processors so we can operate the Site and licensing system:

  • Stripe, Inc. — payment processing, tax, and fraud prevention. Receives email, billing address, and card details you enter into Stripe's checkout.
  • Supabase — managed PostgreSQL database and authentication for account and license records.
  • Cloudflare — CDN, DNS, and DDoS protection for the Site.
  • Email delivery provider — sends transactional emails (receipts, license keys, password resets). Receives your email address and message contents.

We may also disclose data if required by law, valid legal process, or to protect the rights, property, or safety of users, third parties, or ourselves.

7. Data Retention

  • Account and license records: kept while your account is active, then up to 24 months for tax, accounting, and fraud prevention.
  • Payment records: retained by Stripe and by us for the period required by applicable tax law (typically 7 years).
  • Support emails: up to 24 months after the ticket is closed.
  • Server logs: rotated within 90 days.
  • Local Extension data: kept on your device until you clear it or uninstall the Extension.

8. Your Rights (GDPR, UK GDPR, CCPA/CPRA)

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your account and associated data ("right to be forgotten").
  • Export your data in a portable format.
  • Object to or restrict certain processing.
  • Opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information as those terms are defined under CCPA/CPRA.
  • Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email privacy@circleunchained.app. We respond within 30 days. Deleting your account revokes all associated licenses.

9. Security

We use industry-standard safeguards: TLS 1.2+ for all traffic, encrypted-at-rest storage, hashed passwords, scoped API keys, least-privilege access, and regular dependency updates. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the relevant authorities as required by law.

10. Cookies & Local Storage

The Site uses only strictly-necessary cookies and local storage for authentication and session management. We do not use advertising, cross-site tracking, or third-party analytics cookies. The Extension itself does not set cookies.

11. International Transfers

Our sub-processors may process data in the EU, UK, and United States. Where data leaves your region, transfers rely on Standard Contractual Clauses or an equivalent lawful mechanism.

12. Children

The Extension and Site are not directed to children under 16. We do not knowingly collect data from minors; if we learn we have, we will delete it.

13. Chrome Web Store — Limited Use Disclosure

Circle Unchained's use of information received from Chrome APIs and any user data collected by the Extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically, we do not:

  • Use or transfer user data for purposes unrelated to the Extension's single, narrowly-scoped feature (detecting and downloading media on pages you open).
  • Use or transfer user data to serve ads, including personalized, retargeted, or interest-based advertising.
  • Use or transfer user data to determine creditworthiness or for lending purposes.
  • Sell user data.
  • Allow humans to read user data, except: (a) with your affirmative consent for a specific instance; (b) as necessary for security or to comply with law; or (c) where the data has been aggregated and anonymized.

14. Changes to This Policy

If we materially change this policy we will update the "Last updated" date at the top and, where required, notify account holders by email before the change takes effect.

15. Contact

Privacy questions or requests: privacy@circleunchained.app.