Effective 1 November 2026
Looplet is a private space where the people closest to you share photos and videos with each other — and only with each other. This policy explains what we collect, why, who we share it with, and the choices you have. We have tried to write it in plain English.
The short version. We collect the minimum needed to run a private sharing app: how to sign you in, what you post, and who you share it with. Your posts are visible only to the Loops you share them into. We do not sell your personal information. We never use your photos to target advertising. Your photos and videos are stored in the European Union.
Looplet Ltd is the data controller for the personal data described here. Looplet Ltd is a company registered in England and Wales, company number 17414917, with its registered office at 50 Princes Street, Ipswich IP1 1RJ.
An email address and/or mobile phone number (whichever you sign up with), a display name, and optionally a profile picture. After sign-up you can optionally add a date of birth, which is used to show birthdays to people you share a Loop with; you can clear it at any time. We also store a country and region marker that decides where your data is kept.
Your name, email address and phone number are encrypted at rest using AES-256-GCM. Looking an account up uses a one-way keyed hash rather than a readable value.
Photos, videos, captions, titles, comments, reactions, and the Loops you create or join. Media carries technical details like dimensions, duration, format and the capture time your device reports. We do not collect GPS location from your photos. If you add a place to a post, we store the place name you chose, such as a town or a venue. Your phone works that name out from the photo; the photo's position itself is removed before upload and never reaches us.
An adult can create a profile for a child or a pet in their care, so they can appear in shared moments without having an account. See section 8.
If you turn on notifications we store a push token issued by Apple or Google for that device. We record a rough “last seen” time so we can count how many people use Looplet. Our servers handle IP addresses and normal request information in passing, to serve requests and to stop abuse.
If the app crashes, a report goes to Google Firebase Crashlytics: device model, operating system version, app version and a stack trace. On Android the report is tagged with your account identifier so we can tell whether a crash hit one person or everyone. Crash reporting is off in development builds.
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Create your account and sign you in | Performance of a contract |
| Store your content and deliver it to the people you chose | Performance of a contract |
| Send the notifications you turned on | Performance of a contract; consent for optional ones |
| Show your birthday to your Loops | Consent — the field is optional and you can clear it |
| Keep the service working and diagnose crashes | Legitimate interests (a stable product) |
| Stop abuse, spam and fraud | Legitimate interests (security) |
| Handle a paid subscription | Performance of a contract |
| Show personalised ads | Consent — only if you grant it |
| Show non-personalised ads | Legitimate interests, or consent where your region requires it |
We do not sell your personal data. We share it only with the providers below, each working under contract on our instructions.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Signing you in — one-time codes, magic links, password resets, and the emails that carry them | EU / global |
| Scaleway | Storage for all photos and videos, and our database | Paris, France |
| Cloudflare | Delivering media, DNS, and protection against attacks | Global edge network |
| Apple | Push notifications to iPhone and iPad | Global |
| Push notifications to Android (Firebase Cloud Messaging) | Global | |
| Crash reporting (Firebase Crashlytics) | Global | |
| Apple / Google app stores | Taking subscription payments. We never see your card details. | Global |
We may also disclose data where the law requires it, or to defend a legal claim.
Looplet does not show ads. No advertising is served anywhere in the app, on any tier, free or paid.
We are removing the advertising components altogether. Until the next app update reaches your device, an advertising library remains present in the installed app but is dormant: it requests no ads, and your device’s advertising identifier is not used to target anything. Once you update, the library is gone entirely.
Looplet is funded by its subscription, not by advertising. If that ever changes we will update this policy and ask for your consent first — we would not start advertising to you on the strength of a policy you agreed to before it existed.
Your photos and videos are stored in Scaleway object storage in Paris, France, and our database sits in the same region. Media is served through Cloudflare’s edge network, which caches it closer to whoever is viewing.
Some providers — Google for notifications and crash reports, and Apple for notifications — operate globally and may process data outside the UK and EEA. Where that happens, transfers rely on the UK International Data Transfer Addendum, the European Commission’s Standard Contractual Clauses, or an adequacy decision.
Looplet is not directed at children. You must be at least 13 to create an account, and at least 16 if you are in the EEA or UK.
We don’t knowingly collect data from anyone under these ages. If you think a child has an account, tell us and we’ll delete it.
Separately, an adult can create a managed profile for a child or pet in their care. A managed profile is not an account: there is no sign-in, no email address, no password, and no way to log in as it. It exists so a young child or a pet can be named and appear in the moments you share.
By creating one, the guardian confirms they have parental responsibility for that child and consents to this on the child’s behalf.
You have the right to:
Email privacy@looplet.app to use any of these. We’ll reply within one month, free of charge.
You can also complain to a regulator. In the UK that’s the Information Commissioner’s Office (ico.org.uk); in the EEA it’s the authority where you live.
This section is for California residents, under the CCPA as amended by the CPRA.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined by the CCPA. We haven’t done so in the last twelve months, and we don’t knowingly do it for anyone under 16.
In the last twelve months we collected these categories, for the purposes in section 3, from the sources and to the recipients in sections 2 and 4:
We don’t use sensitive personal information beyond the purposes the CCPA permits, so there is no “Limit the Use of My Sensitive Personal Information” control to offer.
You have the right to know, delete and correct your personal information, and not to be treated differently for asking. Delete your account in the app, or email privacy@looplet.app. We’ll verify the request against the email or phone number on the account. An authorised agent can act for you with written proof.
No system is perfectly secure, but we take this seriously and will notify you and the regulator of a qualifying breach without undue delay.
If we make a material change we’ll update the date at the top and tell you in the app or by email before it takes effect.
By post: Looplet Ltd, 50 Princes Street, Ipswich IP1 1RJ.