Looplet

Security

Effective 1 November 2026

Looplet holds photos of people’s children and the moments they care most about keeping private. If you have found a way that something here could go wrong, we would genuinely rather hear it from you than find out any other way.

How to report

Email security@looplet.app. The more of this you can include, the faster we can act:

• What you found — the bug, in your own words.
• How to reproduce it — steps, requests, or a short proof of concept. Enough that we can see it ourselves.
• What you think the impact is — what someone could do with it, and to whom.

You don’t need a polished write-up. A rough email that arrives today beats a tidy one that arrives next month.

Scope

In scope:

• The Looplet apps for iOS and Android.
• looplet.app — this site, and fimly.app, our earlier address.
• api.fimly.app — our application programming interface (API).
• cdn.fimly.app — our media delivery.

Out of scope:

• Our providers’ own infrastructure. We build on services from other companies. A flaw in one of their platforms should go to that provider’s own security team, who can actually fix it — though if you think their flaw exposes Looplet data specifically, please do tell us too.
• Anything needing physical access to a device or to our hardware.
• Social engineering of us, our providers, or the people who use Looplet.

What we ask of you

This part matters more here than it does for most services. The data in Looplet is other people’s private photographs, a lot of them of children. Please:

• Test only against accounts and content you control. Make yourself a second account and a Loop of your own to attack. That is nearly always enough to prove a bug.
• Never access, download, modify or keep anyone else’s data. If you discover you can reach someone else’s photos, posts or account, stop right there and tell us. Describe the capability, not the data — “this endpoint returned a post I’m not a member of” tells us everything we need; the photo itself tells us nothing extra and makes the situation worse for the person in it.
• Don’t degrade the service for the people using it. No denial-of-service testing, no load or stress testing, and no automated scanning heavy enough to slow Looplet down for the Loops relying on it.
• Don’t social-engineer our users, our staff or our providers, and don’t try to phish your way in.
• Give us reasonable time to fix things before you publish. Talk to us about timing and we’ll be straight with you about where we are.

What you can expect from us

• An acknowledgement within 3 working days — from a person, not an autoresponder.
• An honest assessment. Whether we think it’s a real problem, how serious we think it is, and why.
• A fix timeline, and an update when it ships.
• Credit, if you want it. Tell us how you’d like to be named, or say you’d rather stay anonymous. Either is fine.

Being straight with you about what we are: Looplet is a very small operation, built and run by one person. There is no paid bug-bounty programme — we have no budget for one and we’d rather say so plainly than imply otherwise. What we can offer is that your report will be read properly, taken seriously, answered by a human, and credited if you’d like. We’re grateful, not rich.

Safe harbour

If you follow the guidance above in good faith, we will not pursue or support legal action against you for your research, and we will treat what you did as authorised. If someone else raises a complaint about research that stayed inside this policy, we’ll say publicly that it was authorised.

If you’re partway through and unsure whether something is in bounds, email us and ask first. We would much rather answer a question than receive an apology.

If real data was exposed

If a report shows that other people’s personal data was actually reachable — not just theoretically, but in fact — we treat that as a personal-data breach, with the legal obligations that carries: assessing the risk to the people affected, and notifying the regulator and, where required, those people themselves, to the deadlines the law sets.

That is exactly why precise detail helps so much. Knowing which records were reachable, by whom, for how long, and whether anyone actually reached them is the difference between us telling affected people something accurate and us having to guess. Detail about the scope of a flaw is one of the most useful things you can give us — and it is a separate thing from taking copies of the data, which we’re asking you not to do.

Contact

security@looplet.app

Machine-readable version: /.well-known/security.txt

For privacy questions, data-protection requests, or anything that isn’t a security flaw, use privacy@looplet.app instead.

See also our Privacy Policy.