Privacy policy

Updated 18 September 2026

Who this is

Loop is built and run by Mate Gozner, an individual, based in Romania. There is no company between you and the app: one person writes the code and runs the server it depends on.

For anything in this policy, including the requests listed under "Your rights", write to hello@loop.goznair.app.

What we collect

Loop is invite-only, built for one small group of friends at a time. Everything below exists to run a season for that group, not to build a profile of you for anyone else.

What you give us

To sign in you give us an email address, or, if you use Sign in with Apple, an identifier Apple sends us in place of your Apple account. There is no password to store either way.

Profile: your display name and, if you add one, an avatar photo.
Season activity: the photos or videos you post as mission proof, and any caption you add to them.
Confessionals: the short, anonymous text you write for the evening prompt.
Votes: who you vote for in each evening's poll.
Reactions: the emoji you tap on a proof, event or confessional.
Reports and blocks: if you report something or block someone, we keep a record so it can be reviewed and acted on.
Export choice: if you opt a season out of the shareable recap, we remember that choice so exported highlights never include you.

What the system records

Push token: a device identifier Apple issues so we can send you a notification, along with your app version and locale so we send it in a form that version understands.
Notification preferences: which categories of notification you've turned on or off.
Product analytics: our own log of what happened in the app, for example that a mission was completed or a season started. Events carry ids, not free text, and are attributed to an anonymous install id before you sign in and to your account after.
Device settings: locale and timezone, so dates and times in your season show correctly.
Age confirmation: the timestamp of your confirmation that you're 18 or older. We don't ask for or store your date of birth.

We don't collect your contacts, your precise location, your phone number, biometric data, or your browsing history. There's no advertising identifier and no third-party analytics software anywhere in the app.

Three things are worth being specific about, because they're enforced in ways that go beyond a promise in this document. Confessionals are anonymous to your crew by construction: the database function that returns the confessional feed has no author column in its result at all, so the app has no author to display even if it wanted to. A secret mission is visible only to the person assigned it until the group's reveal at the end of the day, a rule enforced by the database itself, not only by what the app chooses to show on screen. And photos or videos live in a private storage bucket that is never public; the app reads them through links that expire after one hour.

Why we're allowed to collect it

Under the GDPR, each use of your data needs a legal basis. Here is ours:

Contract: your profile, season membership, missions, votes and confessionals exist because running a season is the service you signed up for. Without them, Loop can't work.
Legitimate interest: product analytics, so we can tell whether the app is working, and reports and blocks, so we can keep a crew safe, are both processed on this basis. We weigh that interest against your privacy by keeping analytics id-based rather than identity-based, and by never using it for advertising.
Consent: push notifications are sent only if you allow them when iOS asks. You can withdraw that consent at any time, in iOS Settings or in the app's own notification preferences.

Nothing about you is sold. Loop has no advertising, no ad network, and no data broker relationship of any kind. What you post is visible to your crew, and only your crew, unless this policy already describes it as private to you alone (a secret mission before reveal, a confessional, your vote).

Three processors run infrastructure on our behalf, under our instructions, and touch no more of your data than their job requires:

Oracle Cloud hosts the server Loop runs on.
Resend delivers the sign-in code and other transactional email.
Apple delivers push notifications through its Push Notification service.

None of these three ever receive your confessional text, your votes or your media. They carry the traffic, not the content.

Where it's stored

Loop's database, file storage and sign-in all run on one server in Frankfurt, Germany, inside the EU. Your data doesn't leave the EU, except where a processor above is itself EU-based: Resend sends Loop's email from its Ireland region.

How long we keep it, and what deleting your account does

Photos and videos from a season are kept for 12 months after the season ends; the smaller thumbnails used in lists and recaps, for 24 months. You can delete your own media at any time from within the app. Raw analytics events are kept for 13 months. Notifications waiting to be sent are cleared after 30 days whether or not they went out.

Deleting your account is reachable from your profile in two taps. It does the following, right away:

Attempts to revoke your Apple sign-in token, if you used Sign in with Apple.
Replaces your display name with "Former member" and removes your avatar, rather than deleting your profile row outright, so the rest of your crew's season stays intact.
Deletes your own media and your push devices.
Permanently deletes your confessionals and your votes. These aren't anonymised or kept; they're gone.
Disables your account in our sign-in system, so you can never sign back in. The record isn't removed outright, for the same reason your profile isn't: doing so would cascade away the season history your crew keeps.

What stays behind is the shared history your crew earned together: missions completed, points, the fact that you were there, without your name attached to the content that was specifically yours.

Your rights

If you're in the EU or the UK, you have the right to:

Access the personal data we hold about you.
Correct it, if it's wrong.
Erase it, beyond what deleting your account already does.
Restrict or object to certain processing, in particular the legitimate-interest uses described above.
Receive a copy of your data in a portable format.
Withdraw consent for push notifications at any time.
Lodge a complaint with a supervisory authority. As the operator is based in Romania, that's the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), though you can also complain to the authority in your own country.

To exercise any of these, write to hello@loop.goznair.app. We aim to respond within one month.

Age requirement

Loop is for adults. You confirm you're 18 or older during onboarding, and the app isn't built or intended for anyone younger. If we learn that an account belongs to someone under 18, we'll remove it.

Changes to this policy

If this policy changes, the date at the top changes with it. For a change that materially affects how your data is handled, we'll tell you inside the app, not only here.

A note on this document: this policy describes what Loop actually does, honestly, written directly from its codebase rather than copied from a template. It hasn't yet been reviewed by a lawyer. It should be, before the app is released publicly.