Privacy notice
Circles by Ohana
Last updated: 8 October 2026
This page explains what we do with your photographs, your phone number, and — only if you choose it — your face. It is meant to be read, not skipped. If a sentence here is unclear, write to us and we will rewrite it.
Who we are
Circles is run by Ayush Goyal, sole proprietor, 47 Vimal Vatika, Kamla Nagar, Agra, Uttar Pradesh, India.
Under India's Digital Personal Data Protection Act, 2023, that makes us the data fiduciary — the people answerable for your data. There is a named human being at the bottom of this page whom you can write to.
What we collect
| What | Why |
|---|---|
| Your phone number | It is how you sign in, and how the host knows who is in the event. |
| Photographs and videos you upload | They are the point of the product. Other guests in the same event can see them. |
| A face signature — only if you ask for it | So we can find you in other people's photographs from that one event. |
| Basic app activity | To know whether things are working. Kept 12 months, then only as counts. |
We do not sell any of it. We do not run advertising. We do not build a profile of you.
The three things we ask you to agree to — separately
We never bundle these together. Agreeing to one does not agree you to another.
| # | What you agree to | Can you say no? |
|---|---|---|
| 1 | Joining the event. Your phone number and your uploads, visible to the other guests. | No — this is the service itself. If you do not want it, do not join. |
| 2 | Face matching. One selfie, kept privately, turned into a face record and used to find you in the photographs of events you join. See Face data. | Yes. Say no and you still see every photograph and can still upload your own. |
| 3 | Using specific photographs publicly, for example to show other couples what Circles does. | Yes. We never ask for this at the event. We ask the host separately, in writing, afterwards. |
You can take back any consent as easily as you gave it — see Deleting things.
Face data: what we collect, where it goes, how long we keep it
This is the most sensitive thing we handle, so it gets its own section. Face matching is optional. If you never turn it on, nothing in the first half of this section applies to you.
If you turn face matching on
You take one selfie. We keep that photograph, privately. It is never shown to other guests, to hosts, or to anyone else — it exists only so we can match you, and so we can re-match you if you join another event.
From that selfie we create a face record using Amazon Rekognition, a service operated by Amazon Web Services. The processing happens in AWS's Mumbai region (ap-south-1). The face record is a set of numbers. It is not a picture, and it cannot be turned back into one.
A separate face record is created inside each event you join. There is no single, global index of your face. Each record is linked to your account — deliberately, because that link is what lets us find and delete every copy when you ask us to.
What happens to other people in the photographs
We want to be straightforward about this rather than leave it implied.
Every photograph uploaded to an event is scanned for faces, and a face record is created for each face found — not only for people who turned face matching on.
Those records carry no name, no phone number and no account. They are unnamed. If that person later joins the event and turns on face matching, their record is claimed and becomes theirs. If they never do, it stays unnamed and is deleted with everything else when the event's retention period ends.
We do this because it is the only way face matching can work: the photographs have to be scanned before anyone can be found in them.
How long we keep it
| What | How long |
|---|---|
| Your selfie | Until you delete your face data or your account, or 90 days after the event ends, whichever comes first |
| Your face records | 90 days after the event's end date |
| Unnamed face records from photographs | 90 days after the event's end date |
| Photographs you were matched to | They stay in the album; the matches stay in your collection |
After 90 days the whole set of face records for that event is deleted from Amazon Rekognition. Photographs you have already been found in stay where they are. What stops is new matching.
Deleting it
Three things erase your face data, and all three work the same way — your selfie is removed from our storage, and your face records are deleted from Amazon Rekognition in every event:
- Settings → Face & privacy → Delete my face data. Your account and your photographs are untouched.
- Deleting your account.
- The host deleting the event, which removes that event's face records for everyone in it.
What we never do with it
We do not use face data for advertising, for marketing, or to build any profile of you. We do not sell it. We do not share it with anyone other than Amazon Web Services, who process it on our instructions and are not permitted to use it for anything of their own.
Children
You must be 18 or over to make a Circles account.
Children are in wedding photographs — that is ordinary photography and we are not going to pretend otherwise. Like every other face in an uploaded photograph, a child's face is scanned and given an unnamed record (see Face data): no name, no phone number, no account, and it is deleted 90 days after the event ends. No child is ever enrolled in face matching. A face record can only be claimed by an account holder, and you must be 18 or over to hold an account — so no child's face is ever claimed, named, or matched to a person.
If you believe a child's photograph is being misused, see our child safety standards.
Who else can see your photographs
- Other guests in the same event. That is what the album is for. Nobody outside the event sees it.
- Our suppliers. Photographs are stored on Google Firebase and delivered through Bunny.net. They hold the files so we can show them to you; they are not allowed to use them for anything else.
- Amazon Web Services, who run the face matching for us and are not allowed to use anything we send them for anything else. See Face data above.
The honest bit about shared links. During this pilot season, the web address of a photograph is not locked to your account. It is long and impossible to guess — but if you forward that link to somebody outside the event, or someone copies it from your phone, whoever holds the link can open the photograph. Treat a photo link the way you would treat the photograph itself. We are tightening this before general availability.
How long we keep things
| What | How long | Then |
|---|---|---|
| Face data (selfie and face records) | 90 days after the event's end date, or sooner if you delete it | See Face data above |
| Photographs and videos | 12 months from the event date | Deleted. The host is warned at 11 months and can extend or download everything |
| Your phone number and account | Until you delete your account | — |
| Consent records | 3 years | Kept as proof that you agreed — that is the whole reason they exist. See below |
| App activity data | 12 months | Kept only as totals, with nothing that points to you |
An event closes 30 days after the last function, unless the host extends it. We tell everyone in the app and on WhatsApp a week before it happens, so nobody is caught out.
Deleting things, and your other rights
You can:
- Delete just your face data and keep everything else — in the app, Settings → Face & privacy → Delete my face data. Photographs already matched to you stay in your collection; no new matching happens.
- Delete your whole account. See Delete your account. You do not need the app installed to ask.
- Ask what we hold about you, ask us to correct it, or complain — write to the Grievance Officer below. We answer within 30 days.
Two things survive a deletion, and we would rather say so here than surprise you:
- Consent records are kept for 3 years — which consent, which version of this notice, when you gave it and when you took it back. No name, no phone number, no photograph, no face signature.
- Photographs other guests already downloaded to their own phones. Once a picture is on somebody else's device it is out of our reach, and anyone who tells you otherwise is guessing.
Complaints
Grievance Officer: Ayush Goyal
ohana.software.inc@gmail.com · ayush1.contact@gmail.com
47 Vimal Vatika, Kamla Nagar, Agra, Uttar Pradesh, India
Write in English or Hindi. We reply within 30 days. If you are not satisfied, you can take the matter to the Data Protection Board of India.
Changes to this notice
Circles is in a limited pilot season. This notice will be updated before general availability. If we change something that matters, we will tell you in the app rather than quietly editing this page.