Who this app is for

MamaCircle is an app for mothers to connect with other nearby mothers, plan playdates, and share information and support. It is intended for adult users only. Children are never account holders or users of the app themselves; information about a user's child (nickname, birth month/year and, if the parent chooses, a photo) is entered by the parent, about the parent's own child, for the purpose of matching with other parents of similarly-aged children.

Information we collect

Account and profile information: your email address (used to sign in), a display name, and, if you choose to add them, a short bio, a profile photo, your interests, hobbies and the activities you are interested in, what you are looking for, and the languages you speak. We also store your app settings (such as language, notification, quiet-hours and privacy choices) and which kind of device you signed up on (Android, iPhone or web).

Approximate location: the neighborhood and city you choose, and an approximate point. If you allow location access, the app reads your device's position and rounds it to a grid of about 200 metres on your phone, before anything is sent; we store only that rounded point. If you don't allow location access, we use the centre of your chosen neighborhood instead. We never store your precise GPS position or your address. Your location is used only to show you other nearby parents, with an approximate distance, and to let them find you.

Information about your child: a nickname (optional, defaults to "Baby"), birth month and year, and, if you choose to add one, a photo. We do not collect your child's full birth date or legal name.

Content you create: posts, photos, and comments in groups; questions and answers in the community forum; messages you send in chat; groups you create or join; articles you contribute to the knowledge base; and any reports you submit about another user or piece of content.

Bug reports (optional): if you use "Report a bug", we store what you write, an optional screenshot you choose to attach, and technical details that help us find the problem: the app version, your device's operating system and version, the app language, the screen you were on, and the last error message the app showed. Only you and our moderators can see your bug reports. Your description and the technical details (not the screenshot) are also sent to our crash-reporting tool (Firebase Crashlytics in the mobile app, Sentry in the web app), so the report can be matched with any crash it describes. Bug reports and their screenshots are deleted automatically after 90 days, or earlier if you delete your account.

Device information for notifications: if you allow notifications, we store a device push token so we can notify you about new messages. This token identifies your device for this purpose only.

Identity verification with Vipps (optional): if you choose to verify your identity, you log in with Vipps, and Vipps shares your phone number and a Vipps user identifier with us. We never store your phone number itself. We immediately turn it into an irreversible, keyed code (a cryptographic hash) that lets us check that the same phone number is not used to verify more than one account, and we store only that code and the fact that your account is verified. Other users never see your phone number; they only see a verified badge.

Signing up or logging in with Vipps (optional): instead of an email address and password, you can sign up or log in with Vipps. Vipps then shares your phone number, a Vipps user identifier, your email address and whether Vipps has confirmed that email address. We only use an email address that Vipps has confirmed. If you already have a MamaCircle account with that email address, you are logged in to it; otherwise we create your account with it. Your phone number is handled exactly as for identity verification above: we store only the irreversible code, never the number itself, and your account is verified at the same time. So that we can recognise you the next time you log in with Vipps, we also keep a code made the same way from your Vipps user identifier, linked to your account. Vipps does not share your name or date of birth with us.

An email address is required to create an account; everything else is optional. Some features need certain information to work (for example, matching needs a location and your child's age), but you decide what to add.

How we use this information

We use your information to operate the app's core features: matching you with nearby parents of similarly-aged children, showing your posts and messages to the people you share a group or conversation with, and sending push notifications you have enabled.

We do not use your information for advertising. MamaCircle does not show ads and does not use any advertising or analytics tracking services.

Legal basis

To provide the app you signed up for: your account and profile, your child's information, your location, groups, chat, the forum, events, and the emails needed to run your account. This is necessary to provide the service under our terms (GDPR Article 6(1)(b)).

Things you choose to switch on: push notifications, letting the app read your device's position, identity verification with Vipps, and signing up or logging in with Vipps. These rely on your consent (Article 6(1)(a)), which you can withdraw at any time by turning notifications or location access off in your phone's settings, or by withdrawing your consent in the Vipps app. Withdrawing does not affect what happened before.

Keeping members safe and the app working: screening uploaded photos, handling reports, blocking and moderation, suspensions (including keeping the code for a suspended phone number), the sign-in security check, crash and error reports, and bug reports you send. These rely on our legitimate interest in a safe, working service for mothers and their families (Article 6(1)(f)). You can object to this use; contact us and we will consider your objection.

Cultural or language background: we removed this optional field on 6 October 2026, because it could reveal ethnic origin, which the GDPR treats as especially sensitive, and deleted everything that had been entered in it.

We do not make decisions about you based solely on automated processing. Automated checks only flag photos for a person to review, or stop sign-in attempts that look automated.

Who we share information with

We use the following service providers to operate the app:

• Supabase (database, authentication, file storage, and real-time messaging infrastructure), hosted in the EU (eu-north-1 region).
• Firebase Cloud Messaging, a Google service used only to deliver push notifications to your device. Only a device token and the notification content are sent to this service, for this purpose only.
• Firebase Crashlytics, a Google service used to help us detect and fix app crashes and errors. If the app crashes or hits an unexpected error, a technical report is sent to this service: what went wrong, your device model and OS version, the app version, and a short log of what the app was doing just before (for example which tab was open, or that you had just signed in). If you are signed in, the report also carries your account's internal ID, a random code rather than your name or email address, so we can tell which account a crash happened on when we investigate it or help you with a problem. It does not include your posts, messages, or other personal content.
• Sentry (Functional Software, Inc.), used only in the web version of the app, in the same way and for the same purpose as Firebase Crashlytics above: if the web app hits an unexpected error, a technical report (what went wrong, your browser and its version, and the app version) is sent to Sentry, stored in its EU (Germany) region. If you send a bug report from the web app, your description is sent there too. It does not include your posts or messages.
• Google Cloud Vision API, used to automatically screen photos you upload for content that may violate our community guidelines (for example, explicit or violent imagery), so our moderators can review it. Only the photo itself is sent to this service, for this purpose only; it does not decide on its own to remove anything, a human reviews any photo it flags.
• Resend, used only to send account emails, such as confirming your email address and resetting your password. Only your email address and the content of that email are sent to this service.
• Cloudflare Turnstile, a security check on the log-in, sign-up and password-reset screens that tells real people apart from automated sign-ups. For this check only, Cloudflare processes technical information about your browser or device, including your IP address.
• Webhuset AS, in Norway, which hosts the web version of the app (app.mamacircle.no). Like any web host, its servers process your IP address and browser details to deliver the pages to you.
• Vipps MobilePay AS, used only if you choose to verify your identity, or to sign up or log in with Vipps. You log in inside Vipps's own app or website, and Vipps sends us your phone number and user identifier and, when you sign up or log in with Vipps, your email address, as described above. Vipps's own privacy terms apply to that login.

We do not sell your information, and we do not share it with any other third party, advertiser, or data broker.

What other members can see. Other signed-in members can see your profile: your display name, photo, bio, neighborhood and city, the profile details you choose to fill in (such as interests and languages), whether you are verified, and your children's age ranges (for example 0 to 6 months). Your children's nicknames, birth months and years, and photos are visible only to members you have an accepted one-to-one chat with, and to our moderators. They see an approximate distance to you; their app can access your rounded location point (about 200 metres), never your precise position. They can also see which groups you belong to and which events you have said you will attend, posts and comments you make in groups, your questions and answers in the forum, and messages in conversations you are part of.

People you have blocked cannot see your profile or your children's details. Today, other members' apps can technically also read the settings stored with your profile (such as your notification and privacy settings). We are restricting what other members can access in upcoming updates and will update this policy when we do.

Transfers outside the EEA

Our database is stored in the EU. Some of the providers above are based outside the European Economic Area (EEA), so using them can mean your data is transferred abroad. Each transfer is protected as the GDPR requires:

• Supabase (Supabase Pte. Ltd., Singapore) stores our database in its EU region in Stockholm, Sweden. Any processing outside the EEA is covered by the EU Standard Contractual Clauses.
• Google (Google LLC, USA), for Firebase Cloud Messaging, Firebase Crashlytics and Cloud Vision, may process data in any of its data centres. Google is certified under the EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses also apply.
• Apple (Apple Inc., USA) delivers notifications to iPhones, as for every iPhone app, under the EU Standard Contractual Clauses.
• Cloudflare (Cloudflare, Inc., USA) is certified under the EU-U.S. Data Privacy Framework, with the EU Standard Contractual Clauses as a fallback.
• Resend (Plus Five Five, Inc., USA) is certified under the EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses also apply.
• Sentry (Functional Software, Inc., USA) stores our data in its EU region in Germany; it is certified under the EU-U.S. Data Privacy Framework, with the EU Standard Contractual Clauses as a fallback.

Vipps MobilePay AS and Webhuset AS are in Norway, inside the EEA.

Your choices and controls

You can edit or remove your child's information (including a photo), edit your neighborhood, and block or report another user or piece of content at any time from within the app. You can also download a copy of everything we hold about your account at any time from Settings > Download my data.

If you verified with Vipps, you can withdraw your consent at any time in the Vipps app; your verified badge is then removed. You can also choose to receive new chat requests only from verified members, in Settings > Privacy and data > Chats.

If you signed up with Vipps, your account has no password. To log in with your email address as well, tap "Forgot password?" on the log-in screen and set one.

In a 1:1 chat, you can choose to send a photo as "view once": it disappears from the recipient's view after they open it. The photo itself is still kept on our servers for up to 72 hours after it was sent, regardless of whether or when it was opened, before being permanently deleted. This short window exists so that a report about the photo, filed shortly after it was sent, still has something for us to review, rather than the photo being unrecoverable the moment someone taps to view it.

Your rights

Under the GDPR you have the right to:

• access the information we hold about you (Settings > Download my data gives you a copy at any time);
• correct information that is wrong (most of it you can edit yourself in the app);
• delete your data (Settings > Delete account, or ask us);
• restrict how we use your data, or object to uses based on our legitimate interest;
• take your data with you in a machine-readable format (data portability);
• withdraw your consent at any time, for anything that relies on it.

To use any of these rights, use the options in the app or write to support@mamacircle.no. We answer within one month. If you think we handle your data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet), www.datatilsynet.no, or to the data protection authority where you live.

Data retention and deletion

We retain your information for as long as your account is active.

If you would rather have us delete your account on your behalf, you can also contact us at support@mamacircle.no.

If you withdraw your consent in Vipps, we remove your verified status and delete these codes from your profile. We keep the code for your phone number for 30 days after the withdrawal, used only so that a suspension for breaking our rules can still stop that phone number from verifying a new account. After 30 days it is deleted automatically. If your account is suspended, the code is kept for as long as the suspension lasts, for the same reason.

If you sign up or log in with Vipps, the codes that link your Vipps identity to your account (made from your Vipps user identifier and your phone number) are kept so that logging in with Vipps finds your account. They are deleted when you withdraw your consent in Vipps (apart from the phone number code kept for 30 days, as described above) or when you delete your account.

Crash and error reports are kept by the crash-reporting services for a limited time (Firebase Crashlytics keeps them for 90 days). Bug reports are deleted after 90 days, as described above.

Security

All information sent between the app and our servers is encrypted in transit (HTTPS/TLS). Access to your data is controlled by database-level security rules, which decide what other members can see, as described under "Who we share information with" above.

Changes to this policy

If we make material changes to this policy, we will update the date above and, where appropriate, notify users in the app.

Contact

Questions about this policy or your data can be sent to support@mamacircle.no. The controller is HAFMULA GROUP OMOSANYA (Hafmula Group), organisation number 935143918, Norway.