Privacy Policy

SpecialCircle ("SpecialCircle," "we," "us," or "our") operates the website and mobile application available at specialcircle.org (the "Service" or "Platform"), a private, parent-to-parent community for families of children with special needs, disabilities, and rare conditions.

This Privacy Policy explains what personal information we collect, how we use it, the legal bases on which we process it, with whom we share it, your rights, and how you can exercise those rights. By creating an account or using the Service, you acknowledge that your personal information will be processed as described here.

If you are a resident of the European Economic Area ("EEA"), the United Kingdom, or Switzerland, this Policy is issued by SpecialCircle as the "controller" of your personal data within the meaning of the General Data Protection Regulation ("GDPR"). If you are a resident of California, additional rights under the California Consumer Privacy Act ("CCPA") apply as described in Section 10.

Information you provide directly. When you register and use the Service, you may provide:

• Account data: email address, password (stored as a one-way hash), and authentication tokens when you sign in via Google, Facebook, or Apple.
• Profile data: display name or nickname, avatar, cover image, bio, country, city, language, and anonymous-mode preferences.
• Family data: your child's first name or nickname, birth year, gender, diagnosed condition(s), year of diagnosis, and the daily challenges you choose to share.
• Content you post: posts, questions, replies, reactions, bookmarks, reshares, messages in circles, and reports you submit.
• Communications: information you provide when you contact us, request support, or apply to the Ambassador program.

Information collected automatically. When you use the Service, we and our service providers collect:

• Device and browser information (type, model, operating system, language, screen size).
• Internet protocol (IP) address, approximate location derived from IP, and access times.
• Usage data: pages or screens viewed, features used, taps, time on page, and similar interaction logs.
• Cookies, local storage, and similar technologies - see our Cookie Policy.

Information from third parties. If you register or sign in through Google, Facebook, or Apple, we receive the profile information those providers choose to share (typically your name and email address), subject to their own privacy policies.

Sensitive data. Information about your or your child's health, diagnosis, or disability is "special category" data under the GDPR. We process such data only when you voluntarily post it to the community, on the legal bases described in Section 4. You are under no obligation to share any health information, and you should share only what you are comfortable making visible to other members.

We process your personal information for the following purposes:

• To create and administer your account, authenticate you, and keep the Service secure.
• To provide, personalize, and improve the Service - for example, matching you with relevant circles, parents, research, and condition/topic hubs.
• To display and distribute the content you post to other members according to your visibility choices.
• To send transactional messages (e.g., verification codes, password resets) and, where you have opted in, onboarding emails, digests, and notifications.
• To moderate content, enforce our Terms and Community Guidelines, investigate reports, and protect the safety of members.
• To analyze usage, fix bugs, prevent abuse and fraud, and develop new features.
• To comply with legal obligations and respond to lawful requests.

Where we rely on "legitimate interests," we balance those interests against your rights and the reasonable expectations of a parent using a support community.

For EEA, UK, and Swiss residents, we process personal data only where we have a valid legal basis:

• Consent: for non-essential cookies, marketing and notification emails, and any processing we expressly ask you to opt into. You may withdraw consent at any time.
• Contract: to provide the Service you requested when you created an account and to operate core features such as posting and messaging.
• Legal obligation: to comply with applicable law, regulation, or lawful government requests.
• Legitimate interests: for security, fraud and abuse prevention, moderation, analytics, and product improvement, where these are not overridden by your rights.
• Vital interests / substantial public interest: only where necessary to protect the vital interests of a person or for public health, and only to the extent permitted for special-category data.

We do not sell your personal information. We share it only as described here:

• Service providers: third parties that help us operate the Service (hosting, authentication, email delivery, analytics, customer support). They process data on our behalf and under written contracts that require confidentiality and GDPR-appropriate safeguards.
• Other members: the content you post is visible to other members according to your chosen audience. Profile and family data you enter may be shown to other members to facilitate matching and support.
• Safety and legal: we may disclose information to investigate, prevent, or respond to conduct we believe violates our Terms, threatens safety, or is required by law, court order, or government request.
• Business transfers: in connection with a merger, acquisition, asset sale, or financing, information may be transferred subject to confidentiality and continued protection under this Policy.
• Aggregated or de-identified data: we may share statistics that no longer identify you.

Your information may be processed in countries other than your own, including the United States and Israel, which may have data-protection laws different from those in your jurisdiction. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses, an applicable adequacy decision, or another lawful transfer mechanism, and we minimize the data transferred.

We keep your personal information only as long as necessary for the purposes described here:

• Account and profile data is retained while your account is active and deleted or anonymized shortly after you delete your account.
• Content you post is retained until you delete it or your account is deleted, except where retention is required for moderation records, legal compliance, or harm prevention.
• Server logs and analytics data are kept for a limited period consistent with security and legal needs, then deleted or anonymized.

You may request earlier deletion as described in Section 10.

The Service is directed to parents, guardians, and adult caregivers - not to children. We do not knowingly collect personal information from children under 13, and the Service is not directed to them, in compliance with the U.S. Children's Online Privacy Protection Act ("COPPA"). If you are under 18, you may use the Service only with the involvement of a parent or guardian and may not register an account yourself.

When you share information about your child (for example, a diagnosis or photo), you do so as the parent or legal guardian acting on the child's behalf. You are responsible for deciding what information about your child is appropriate to share and for ensuring you have the right to share it. If you believe a child under 13 has provided us personal information directly, please contact us and we will delete it.

We use reasonable administrative, technical, and physical safeguards designed to protect your personal information - including encrypted transmission (HTTPS), hashed passwords, access controls, and regular security reviews. However, no system is perfectly secure, and we cannot guarantee absolute security. In the event of a personal data breach affecting your rights or freedoms, we will notify you and the relevant supervisory authority where legally required.

If you are an EEA, UK, or Swiss resident, you have the following rights, subject to applicable limitations:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data.
• Restriction: limit our processing of your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: withdraw consent at any time without affecting prior processing.
• No automated decision-making: we do not make solely automated decisions with legal or similarly significant effects about you.

California residents (CCPA): you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, to opt out of any "sale" or "sharing" of personal information, and not to be discriminated against for exercising these rights. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

To exercise any right, contact us at privacy@specialcircle.org. We will respond within the timeframe required by applicable law (generally one month) and may verify your identity before acting on a request.

We use cookies and local storage to operate the Service, keep you signed in, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings. For full details, see our Cookie Policy.

The Service contains links to third-party websites and research summaries derived from external sources. We are not responsible for the privacy practices or content of those third parties, and this Policy does not cover them. Research summaries are provided for general information only and are not medical advice.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised Policy on this page and, where appropriate, through the Service or by email. The "Last updated" date at the top indicates when the Policy was last revised. Continued use of the Service after a change constitutes acceptance of the updated Policy.

If you have questions, requests, or complaints about this Privacy Policy or our handling of your personal information, contact our privacy team at privacy@specialcircle.org or through our Contact page. If you are an EEA, UK, or Swiss resident, you also have the right to lodge a complaint with your local data-protection authority.