Last modified: September 14, 2026 · Version 2026-09-14
Needed for the website to work: keeping you signed in, protecting forms against forgery, remembering that you have seen this notice, and running the human check on the contact form. They cannot be switched off.
| Name | Set by | Type | Lasts | What it is for |
|---|---|---|---|---|
| circin_session | Circin (first party) | HTTP cookie | 8 hours | Identifies your browsing session so the pages you open belong together and, after you sign in, keeps you signed in. Marked HttpOnly and Secure. Set for our whole site domain, so it is also sent to our sub-domains; the 8-hour window restarts on each request. |
| XSRF-TOKEN | Circin (first party) | HTTP cookie | 8 hours | Security token that proves a form or request was sent from this website and not forged by another site (CSRF protection). Same domain scope and 8-hour window as circin_session. |
| circin_cookie_consent | Circin (first party) | HTTP cookie | 12 months | Remembers that you have seen this notice — it stores the policy version you saw, the date and time you dismissed it and, if optional categories are ever offered, the choices you made — so we do not ask again on every visit. It contains no identifier. |
| theme | Circin (first party) | localStorage | Until you clear site data | Remembers whether you chose light or dark mode. Only written when you use the toggle. |
| firebaseLocalStorageDb | Google Firebase (on our behalf) | IndexedDB | Until you sign out or clear site data | Holds the sign-in state created by Firebase Authentication — for email-and-password, "Sign in with Google" and email sign-in links alike. Only created on the sign-in pages (/login and the sign-in link page). |
Some parts of the Website are delivered by other companies' servers. When your browser fetches them, that company receives your IP address and basic browser details, as any web server does. None of these services sets a cookie on this Website; each processes the request under its own privacy policy, linked below. These providers operate servers outside India and the European Economic Area, so your IP address may be processed in other countries; each provider publishes the safeguards it applies to such transfers in the policy linked.
| Service | Where | Why we use it | What it receives | Their policy |
|---|---|---|---|---|
| Cloudflare Turnstile challenges.cloudflare.com |
Home page only (the contact form) | Tells human visitors apart from bots without a CAPTCHA puzzle. Runs inside an isolated frame from Cloudflare. | IP address, browser and device signals used for the check | www.cloudflare.com |
| Google Fonts fonts.googleapis.com, fonts.gstatic.com |
Password-reset and email-verification pages only | Serves the typeface used on those pages. | IP address and browser details | policies.google.com |
| Firebase Authentication (Google) identitytoolkit.googleapis.com, securetoken.googleapis.com, circin-prod.firebaseapp.com, www.gstatic.com, apis.google.com, developers.google.com, accounts.google.com |
Sign-in pages only (/login and the sign-in link page) | Verifies staff sign-ins. Every sign-in — email and password, "Sign in with Google", or a sign-in link from an email — is checked by Firebase Authentication, which we use as our identity provider. | IP address; the email address and password you enter (over an encrypted connection), or your Google account details if you sign in with Google | policies.google.com |
| Content delivery networks (cdnjs.cloudflare.com, unpkg.com, cdn.jsdelivr.net) cdnjs.cloudflare.com, unpkg.com, cdn.jsdelivr.net |
All pages | Deliver the open-source scripts and styles the pages are built with. | IP address and browser details | www.cloudflare.com |
Session cookies are deleted when you close your browser. Persistent cookies stay for the period shown in the tables above, or until you delete them.
The cookie that remembers that you have seen the notice lasts 12 months. After that, or sooner if this policy changes materially, you will be shown the notice again.
We update this policy when the cookies we use change. The version and "last modified" date at the top tell you which edition you are reading; a material change re-triggers the notice so you see it on your next visit.
Questions about cookies or this policy: support@circin.ai.
Grievances under the Digital Personal Data Protection Act, 2023 may be addressed to our grievance-redressal team at support@circin.ai. We acknowledge grievances within the period the Act and its rules prescribe.
Circin, Ground floor, Cinnabar Hills, Embassy Golf Links Business Park, Challaghatta, Bengaluru, Karnataka 560071, India.