What does my keyholder see?

Everything your keyholder sees

Eleven things, and this is all of them.

1. Your first name. Never your full name.
2. Whether protection is on, and which status word the pass is carrying.
3. How far through the term you are, and the end date when the term has one.
4. A count of blocked attempts, and a note when that count runs higher than usual.
5. Milestone days you reached, and a term you extended with its new end date.
6. Whether an early exit request is open, and a note when you withdraw one.
7. Which alert categories you muted, by name.
8. A lapsed subscription, and the date protection would end if renewal stays off.
9. The app deletion lock turned off or kept, and which of three reasons you gave: freeing up space, changing phones, or other.
10. A handover: that one is running, the first name of the person taking over, and the date it takes effect.
11. A notice if you close your account, if you stop having a keyholder, or if you remove them.

Not which apps or sites, not anything you browse, no amount of money, and nothing you typed. The money you keep is worked out on your phone and never leaves it.

A witness sees less: items 1 to 5 and 7, and the date your protection ends if you end early. Never the request itself, and nothing else.

If a partner leaves you their own phone number on the page where they accept, it is stored with their invite and shown to you in the app. It reaches nobody else.

Why the list is short

There is no spend figure anywhere in what the server sends a partner, which is why no page and no pass can leak one by accident. The money you keep is derived on the phone from a figure you set yourself and has no partner facing producer at all. The same is true of what you browse and of the apps you sealed: Screen Time hands the app tokens back to the phone in a form nothing can read as a name, so there is nothing to send even if a surface wanted to.

Free text was removed from the whole partner path. An early exit request carries no message from you and no reply from them, so nothing you write can travel.

Why an event is on the list at all

Several of the eleven are events rather than states, because a keyholder who learns nothing is not a keyholder. Four of them are the integrity events, and those are guaranteed by email rather than left to a card: an early exit request opening, protection turning off, the phone going quiet, and a subscription lapsing or being refunded. A day milestone and the notice that you closed your account ride the same floor. Everything else reaches the pass alone. Each one is a type and a count, never the thing that happened: the deletion lock's reason is one of three words you picked from, and the attempt count is an integer with a window word beside it.

The same facts are recorded for you

Every invite sent, every acceptance, every close and every decision is also written to your own record, which the Circle's receipt shows. That is what makes the Clear control on a Circle row honest: clearing the row removes the row, and the receipt keeps the fact.

What this does not do

The list does not shrink because you would like it to: there is no per item switch, and the four events on the email floor cannot be muted. Muting the optional categories is itself item 7, so quieting an alert is visible rather than silent. The list does not grow either, because the same eleven items are written in the app, on this site, in the privacy policy and in the footer of every letter, and a change has to reach all of them. It does not hand them any control either. The only signed in caller that can change which alerts go out is you, so a keyholder can neither add an alert nor silence one. And it does not describe what they can do about the block: they can keep the lock on, or approve an early exit in person, and they can never cancel a wait that is already running.