Launch review

Fictional testing only

Circleloom is not ready for real-member launch. The checks below do not certify security, legal compliance or accessibility. No paid subscription was activated; optional AI requests use existing Lovable AI credits.

Member and hosting improvements

Admin accounts now see Admin before authenticator verification; private access still requires a verified code. Calendar downloads, Google Calendar and map links use the actual venue and time. Hosts can add checked travel details, private arrival notes, a weekly, fortnightly or monthly rhythm and hand a future gathering to another approved host.

Repeats remain independent drafts with no attendees copied. Other published dates are linked. Optional private check-ins open two hours after completed gatherings end; verified admins can review answers. Hourly maintenance sends in-app check-in prompts, so these can arrive up to one hour after eligibility. Email alerts remain blocked: no owner sender domain is configured and no paid email service was activated.

AI planning helpers

Find a plan for me interprets editable filters and searches actual published gatherings. Help me plan generates three ideas for approved hosts and verified admins, then opens an editable form saved only as a draft. Venue details remain unconfirmed, admission stays free and existing publication checks apply.

Live member interpretation, no-match adjustments, real result links, one clarification question and a host’s actual draft save were checked. Private preferences, role denial, account limits and deletion cleanup passed direct checks. The AI dialog had no selected automated accessibility findings. Supplier contracts, countries and output-retention approval remain launch blockers.

Created

• Connected privacy notice, cookie policy and settings, terms, community guidelines, accessibility statement and contact pages.
• Private optional profile name and approximate area, working in-app reminder preference, two-step verification and session sign-out choices.
• Tracked private information requests, admin review and replies, deletion requests and verified account deletion.
• Blocking, private moderation queue, reviewer assignment, account restrictions, appeals route and minimal action history.

Repaired

• Known dependency vulnerabilities, unsafe sign-in return paths, field associations and errors, touch target sizes and deletion-dialog focus return.
• Admin permissions require two-step verification in actual data access, not just a hidden menu.
• Optional visitor analytics switched off. There are no optional tracking switches or misleading delivery claims.

Tested

• Earlier privacy review: 15 focused tests and 28 direct permission/workflow checks passed using separate member, host and admin accounts.
• Actual profile saving, reminder preference readback, admin queue access, blocking and restrictions passed.
• Deletion stopped for an unresolved report, then completed after review; account removal and request status were confirmed.
• No selected automated WCAG findings on ten public pages, Profile and Admin. Keyboard dialog closing and focus restoration passed. Narrow 320px layout had no horizontal overflow.
• No known vulnerabilities remained in 54 scanned production dependencies during the earlier privacy review. Basic and original-app deep scans reported no findings. All disposable test accounts and records were removed.

Your action before admin use

Open Admin or Profile → Account security, set up your own authenticator and verify a code. Your admin role remains, but private admin access requires that extra verification. Do not share the setup key or codes.

Missing business details

• Operator’s legal name remains outstanding. Postal address supplied: 89 Paul St, London EC2A 4NE, United Kingdom; public contact: contact@circleloom.co.uk.
• Named moderation, privacy, incident and backup owners, response arrangements and escalation cover.
• Supplier contracts, processing locations and transfer safeguards.

External checks and specialist review

• Verify managed confirmation/recovery delivery, password security settings, email-change verification, auth rate limits and lost-authenticator recovery.
• Inspect actual backup timestamps and test restoration in a separate environment; no production restore was attempted.
• Qualified review of privacy lawful bases, terms, ICO fee applicability, privacy-impact assessment and UK online-service safety duties.
• Real screen-reader speech, complete zoom/device coverage, production logging minimisation and a complete security-standard assessment remain unverified.
• Publish these page changes and recheck the live site’s headers. The current published response has no Content Security Policy; a tested enforcement policy remains to be established.

Data-copy delivery uses a verified manual request process; a secure external delivery channel still needs to be agreed. Emails for gathering updates and marketing are not enabled.