CircleCam: Private Social App Built with Rork AI

How it was built

• Rork AI generated the React Native app with Expo, so one codebase targets iPhone and Android.
• Supabase (EU-hosted) handles authentication, the database and media storage, keeping personal data in the EU.
• Sign in with Apple and Google Sign-In are the only ways to log in, so there are no passwords to store or leak.
• Expo push notifications, delivered through APNs on iOS and Firebase Cloud Messaging on Android.
• Localized into English, German, French and Dutch for its European audience.

The audit: AI-generated code, store-grade standards

I reviewed the app as a store reviewer and a privacy regulator would, against the rules a private social app actually gets judged on:

• Account deletion inside the app (App Store Guideline 5.1.1(v), Google Play account deletion policy). One setting removes the account, profile, moments, chats, reactions, memberships, push tokens, blocks and reports.
• Login rules (Guideline 4.8). Because Google Sign-In is offered, Sign in with Apple is offered too.
• User-generated content safeguards (Guideline 1.2). Users can block and report anyone, every moment has per-person visibility controls, and the terms define what isn't allowed.
• Child safety. A published Child Safety Standards page, as Google Play requires for social apps, and a 13+ age rating with parental consent below the local minimum age.
• Permissions kept to the minimum. Camera, microphone, photos and notifications, each tied to a feature. No location, no contacts, no tracking.
• Privacy disclosures that match reality. The App Store privacy label, the Play Data safety form and the privacy policy describe the same data: name, user ID and user content, used for app functionality. No ads, no data sold, no ad profiles.
• GDPR and German requirements. EU data hosting, every processor named in the privacy policy, server logs kept for at most 30 days, HTTPS/TLS for all traffic, and a legal notice (Impressum).
• Honest security claims. Chats are encrypted in transit but not end-to-end, and the policy says so plainly instead of implying more.

Publishing

• Managed the App Store and Google Play submissions: listings, age-rating questionnaires, privacy label and Data safety forms.
• Lined up store copy, screenshots and the four localizations with what the app actually does.
• Made sure the privacy policy, terms, child safety page and support contact were live and linked from both store listings before review.

• Audit the AI-generated code, don't rewrite it. Rork's output was kept and checked against store and privacy rules. The trade-off: you trust a codebase you didn't write line by line, so the review has to be thorough where it matters (auth, data access, deletion, permissions).
• Social sign-in only. Apple and Google handle credentials, so the app stores no passwords. The cost is that users without an Apple or Google account can't join.
• EU hosting over the default region. Supabase in the EU keeps GDPR simple for a German company and its European users.
• No ads, no tracking. This keeps the privacy label short and means no App Tracking Transparency prompt. It also matches the product promise of "only your people".
• Say what the app doesn't do. Chats aren't end-to-end encrypted yet, and the privacy policy states it. That's better for users and for review than an overclaim.

• Live on the App Store (iPhone, iOS 16.4+, also available on Apple Vision Pro) and Google Play.
• Rated 13+ with matching privacy disclosures on both stores.
• Shipped in four languages: English, German, French and Dutch.
• Free, with no ads and no tracking.

AI app builders like Rork shrink the time from idea to working app. They don't shrink the rules. CircleCam shows the work that sits between an AI-generated prototype and a store-ready product: checking the code, the data flows and every public disclosure against the standards Apple, Google and EU regulators hold real apps to.