Circla Cookie Policy

This document explains what information we store on your device and what we read from it, why, and how you can change that.

It covers both of our addresses: the website withcircla.com and the application app.withcircla.com.

The tables below are generated from the same configuration file the consent banner uses. That way this document cannot drift from what the application actually does.

§ 1. What cookies and similar technologies are

1.1. A cookie is a small text file that a website stores in your browser and can read back on a later visit.

1.2. Other mechanisms work similarly and are also covered by this policy:

• localStorage and sessionStorage — browser storage; the first persistent, the second cleared when the tab closes;
• IndexedDB — an in-browser database able to hold larger data, such as chunks of a file being uploaded;
• pixels — invisible images or network requests used to count views.

1.3. What we do not use. No advertising pixels and no marketing cookies, no tracking advertising, and no data passed to ad networks. We also do not use browser fingerprinting — we do not read your device's characteristics (how it renders graphics, screen resolution, processor core count) and do not derive an identifier from them.

§ 2. Legal basis

2.1. Storing information on your device and gaining access to it is governed by Art. 399 of the Polish Electronic Communications Act of 12 July 2024 (PKE), which replaced Art. 173 of the former Telecommunications Act on 10 November 2024.

2.2. Under that provision:

a) mechanisms necessary to provide the service you asked for do not require consent — but we must inform you about them (Art. 399(4) PKE);

b) everything else requires your prior consent (Art. 399(1) PKE), expressed by a clear affirmative action.

2.3. Where these mechanisms involve processing personal data (for example an IP address or a device identifier), the GDPR applies in addition — the basis is then your consent (Art. 6(1)(a)) or, for strictly necessary mechanisms, performance of the contract and our legitimate interest (Art. 6(1)(b) and (f)). Details are in the Privacy Policy.

2.4. Consent is voluntary. Refusing does not restrict your access to the Service in any way. We use no cookie walls and no "consent or pay" model.

§ 3. Categories and the full list

Below is everything we store or read, grouped by category. The Where column shows whether it applies to the marketing site, the application, or both.

3.1. Strictly necessary

Needed for the service to work at all: keeping you signed in, CSRF protection, remembering your cookie choice, and resuming an interrupted upload. These cannot be switched off, because without them the account does not function.

No consent required — we inform you, but it cannot be switched off without losing the ability to use the Service.

Legal basis: Art. 399(4) of the Polish Electronic Communications Act — necessary to provide the service the user requested. No consent required; we inform you.

3.2. Functional

Remember your interface preferences. The service works without them, just less conveniently.

Requires your consent. Nothing in this category runs until you give it.

Legal basis: Art. 399(1) PKE — consent. Personal data: Art. 6(1)(a) GDPR.

We currently use nothing in this category.

3.3. Analytics

Show us how many people visit, where they come from and which features they use, so we know what to improve. In the app they also include click heatmaps, error reports and session recordings with on-screen text masked. Loaded only after you consent.

Requires your consent. Nothing in this category runs until you give it.

Legal basis: Art. 399(1) PKE — consent. Personal data: Art. 6(1)(a) GDPR.

3.4. Diagnostics

Collect application errors and, in a share of cases, record your session inside the app so we can reproduce a failure. Loaded only after you consent.

Requires your consent. Nothing in this category runs until you give it.

Legal basis: Art. 399(1) PKE — consent. Personal data: Art. 6(1)(a) GDPR.

3.1. Website and app analytics are kept separate. The marketing site and the app report to separate PostHog projects, so each sets its own analytics cookie (ph_<key>_posthog, with a different <key>). Your visit to the website is not linked to your app account. In the app, once you sign in, analytics are linked to your account (Account identifier, e-mail, name and Account role — see Privacy Policy § 3). This applies only to the "Analytics" category and only once you've consented to it.

§ 4. Session recording in the application

4.1. With your consent, two tools may record your session in the application — clicks, navigation and what is on screen:

a) the diagnostics tool Sentry, so we can reproduce an error you ran into. A share of sessions is recorded, as are sessions in which an error occurred. This requires consent to the "Diagnostics" category;

b) the analytics tool PostHog, so we can understand how the application is used and where it gets in your way. The recording also includes console logs and error reports. This requires consent to the "Analytics" category.

4.2. Recording excludes the content of your video recordings — the player and media elements are blocked from capture — and on-screen text and form fields are masked, so file names, clip titles and transcript text are not captured.

4.3. Recording happens only after you consent to the relevant category. Without consent the recording script is not loaded.

4.4. You can withdraw consent at any time — see § 5.

§ 5. How to change or withdraw consent

5.1. The "Cookie settings" link is in the footer of every page — both on withcircla.com and in the application. It opens a panel where you can switch each category on and off individually.

5.2. Withdrawing consent is as easy as giving it — the same panel, one click, no need to contact us and no need to give a reason.

5.3. Once you withdraw consent:

• we stop loading the scripts in that category,
• we delete the cookies belonging to it,
• we update your stored choice in the cc_cookie cookie.

5.4. We will ask you again when:

• we add a new category or a new provider,
• we change the version of this policy in a way that affects the scope of consent,
• 12 months have passed since your last choice.

5.5. One choice covers both domains. We store your choice in a cookie set on .withcircla.com, so it applies to both the marketing site and the application — you do not have to decide twice.

§ 6. Managing cookies in your browser

6.1. Independently of our panel, you can block and delete cookies in your browser settings. Vendor instructions:

• Chrome — Settings → Privacy and security → Cookies
• Firefox — Settings → Privacy & Security → Cookies and Site Data
• Safari — Preferences → Privacy
• Edge — Settings → Cookies and site permissions

6.2. You can also use private browsing mode, which clears data when the window closes.

6.3. Note: blocking strictly necessary cookies will prevent you from signing in and using your Account. Deleting cookies also erases your stored choice, so we will ask for consent again.

§ 7. How we demonstrate your consent

7.1. Under Art. 7(1) GDPR we must be able to demonstrate that consent was given. So along with your choice we record:

• the categories you agreed to,
• the date and time of the choice,
• the version of this policy in force at that moment.

7.2. We store this in two first-party cookies: cc_cookie (the categories and the timestamp of your choice) and cc_policy_version (the version of this policy you consented to).

7.3. This record lives only in your browser — we do not keep a separate, server-side log of banner clicks. That is a deliberate choice, consistent with how most consent banners work: the cookie itself is the evidence (it carries the categories, a timestamp and the policy version), and its 12-month lifetime (§ 5.4) is also the point at which we would ask you again regardless. If you delete this cookie yourself, we treat that the same as no prior choice — we will ask again on your next visit.

§ 8. Contact and related documents

8.1. Questions about this policy: [email protected].

8.2. Related documents:

• Privacy Policy — /privacy (who the controller is, what rights you have, who we share data with, transfers outside the EEA)
• Terms of Service — /terms

This policy exists in a Polish and an English version. In the event of any discrepancy, the Polish version prevails.