Privacy
Your data stays yours.
This page covers the waitlist only. When the app launches, its own privacy policy applies inside the product.
What we collect
- Your email address.
- A referral code, if you were invited by a friend or share your own invite link.
- A scrambled version of your IP address when you submit the form. We never store the address itself — only a one-way hash of it, used to stop one machine from flooding the waitlist. It is not linked to your email.
That’s all. No name, no date of birth, no health data — nothing about your cycle, your sleep or your body is collected by this website.
Why we collect it
So we can tell you when Cirova opens, hold your place in line, credit the friend who invited you, and keep the queue free of bot signups. That’s the whole reason.
Where it’s stored
With Google Firebase, in Google’s European multi-region — data centres in Belgium and the Netherlands. The database refuses all public access by default: nothing on this website can read the waitlist back, and the only things that can are our own server code and the people on our team. Google hosts it for us and cannot use it for its own purposes.
Our legal basis, and how long we keep it
We process your email on the basis of your consent, given when you submit the form. We keep it until Cirova opens to everyone and the waitlist is retired, or until you ask us to remove it — whichever comes first. The anti-flood hash is short-lived and expires on its own.
One honest detail most policies skip: when you ask us to delete you, we remove the live record straight away, but our database also keeps encrypted daily backups. Your record can survive in those for up to 98 days before they roll off, and in Google’s point-in-time recovery window for 7 days. We don’t touch backups for any other reason.
Leaving the EU
Your data is stored in Europe, but our two providers — Google (Firebase) and PostHog — are US companies, so their staff could in principle access it from outside the EU for support. Both are engaged under the European Commission’s Standard Contractual Clauses, which is the legal mechanism that permits it.
Age
Cirova is for adults — please only join the waitlist if you are 18 or over. If you tell us a signup belongs to a child, we’ll delete it.
Analytics
We use PostHog (EU-hosted) to see, in aggregate, how this page is used so we can make it better. It runs cookie-free — no identifiers are stored on your device — with session recording and click-autocapture switched off, and there’s no cross-site ad tracking. That’s why you don’t see a cookie banner here: there’s nothing to consent to.
Your rights
Under the GDPR you can ask us for a copy of your data, correct it, delete it, take it elsewhere, or withdraw your consent at any time — email info@cirova.app and we’ll action it. Withdrawing consent doesn’t affect anything we did before you withdrew it. You also have the right to complain to your national data protection authority. Nothing here is decided about you automatically, and there is no profiling.
What we never do
We never sell your data, hand it to advertisers, or email you anything other than Cirova early-access news. This site carries no advertising pixels — nothing here reports your visit back to Meta, TikTok, Google or anyone else. If that ever changes, this page changes first.
Your choices
Leave any time. Email info@cirova.app and we’ll remove you from the waitlist — no reason needed, no reply required.
Changes
If anything here changes before launch, we’ll update this page and move the date at the bottom.
Who is responsible
Cirova is the data controller for this waitlist, and you can reach us any time at info@cirova.app. We’ll publish our full company details here as soon as the company is registered.
Last updated 23 July 2026.