Civli uses your email for sign-in codes, your chosen city for approximate distance, and your profile to match shared interests. We do not request GPS access. Profiles are visible to signed-in members only when discovery is enabled.
Letters, optional photos and voice postcards are held in a private Cloudflare R2 bucket. Camera access captures a photo only when you choose. Microphone access records a voice postcard only while recording in the foreground. Photo library access shows only the photos you allow, and only the photo you select is attached. Permissions are requested when using each feature, never on launch. Delivery checks run on the server. Staff with infrastructure access can access stored content for support and abuse investigations; letters are not end-to-end encrypted. Account data is stored in Supabase in Canada. Cloudflare operates globally and Resend delivers transactional emails.
Arrival emails are optional. We do not sell personal information or use advertising trackers. Sign-in codes expire after ten minutes; session tokens expire after thirty days. Expired challenges are cleaned daily. Drafts, kept-letter IDs, reflections and reply reminders are stored on your device. Notification permission is requested only when you set a local reply reminder; reminders clear on reply, block or sign-out. Delete your account in the app to delete profiles, sessions, letters, photos and voice postcards; file erasure is retried in the background if necessary. Provider backups follow their retention policies.