Circleboom

GDPR overview

There is no GDPR implementation to report. The word GDPR does not appear once across the fourteen pages collected, neither in the text nor in the archived HTML. No Article 27 EU representative is designated, no data protection officer is named, no Data Processing Agreement is offered, no subprocessor list is published, and no legal basis or transfer mechanism is described. The framework Circleboom does address is entirely American: the California Consumer Privacy Act and COPPA. Under the CCPA it grants deletion, copy and right-to-know requests covering the past twelve months, accepts a designated agent, honours California's Shine-the-Light disclosure, promises non-discrimination and states that it does not sell personal information. Requests go to info@circleboom.com. The policy was last revised on 5 June 2024.

Who owns the data?

Circleboom claims no intellectual property rights over the material users supply, a point the terms make twice, so accounts keep ownership of their content. Everything Circleboom builds itself, from interfaces and code to templates and visual design, remains its own property. Two clauses cut the other way: feedback sent to the company is granted back under a perpetual, irrevocable, royalty-free licence, and an account terminated by Circleboom forfeits all of its content. Data pulled from the X API serves the product; Circleboom may republish public account information such as influence rankings, but never private information. It states that it does not sell personal information, email addresses or Twitter handles.

Reuse rights

Because Circleboom asserts no ownership over user material, users may reuse, republish and export their own content freely, without asking permission; the X side even ships dedicated export functions for engaging accounts and retweeters. The limits sit on Circleboom's side of the line: its design, code, HTML and CSS may not be duplicated without written consent, and no part of the service may be reproduced, resold or otherwise exploited. Feedback submitted to the company becomes freely exploitable by it, with no compensation. Use of the service is also bound by X's own rules, which the terms incorporate by reference, and content can be lost outright if Circleboom terminates an account.

Data retention & training

Hosting summary

Circleboom publishes nothing about where its data lives. No country, no region and no hosting provider is named anywhere on the site. The terms acknowledge only that the company relies on third-party vendors and hosting partners for the hardware, software, networking and storage that run the service, without identifying any of them. What can be established from outside is thin and should not be mistaken for a storage location: on 9 August 2026 the domain resolved to 172.66.41.15, a Cloudflare anycast node advertised from San Francisco, which is a content delivery point of presence rather than a data centre holding user records. The domain registrar is Cloudflare as well, in the United States. The publisher itself is American, based in Cherry Hill, New Jersey, and the terms impose US export law and bar use from US-embargoed countries, so the operative jurisdiction is plainly the United States. Two further points deserve attention: the terms concede that transmissions may travel unencrypted across networks, and the privacy policy states that data is shared with third-party tools, including AI models, without listing them.