Privacy Policy

This explains what Ad Fontes LLC, the maker of Loop, collects, where it goes, and what you can do about it. It is written to be specific rather than reassuring — every third party is named, and so is the exact thing each one receives.

Loop is a consumer product for individual students. It is not designed, marketed, or sold to schools, and no school has access to your account.

1. What we collect

• Account: your email address and a password hash. We never see your password.
• Your profile: the name you choose, your age, and optionally your occupation, height, weight, biological sex, training style and goals. Age is required; the body measurements are not, and Loop shows fewer numbers rather than guessing if you leave them out.
• What you log: whatever you put in the modules you turned on — courses and grades, meals, weigh-ins, workouts, habits, money in and out, clients, calendar events, notes.
• Health data, if you connect Apple Health or a WHOOP band: sleep, heart rate, recovery, strain, workouts, steps, and similar daily figures. Apple Health sends what you choose to send; WHOOP is read a few times a day until you disconnect it. Loop asks before saving any health data, and asks separately before AI reads it; the health privacy policy has the details.
• School data, if you connect Canvas: your course names, grades and scores, and what is due. Canvas emails each new grade to a private Loop address you add to your Canvas account, and a screenshot of each class's grades page gives Loop the weights and scores so far. If you add your Canvas calendar feed link, Loop keeps it in your account and reads it for due dates. Loop never asks for your Canvas password or an access token, and never writes to Canvas.
• Technical: a per-browser device id (so we can alert you to a sign-in from somewhere new), and standard server logs including IP address.
• Which features you use: a short, fixed list of product events — that a tab was opened, that you reached a locked feature, that you asked Max something, that setup finished, that a module crashed. Each one is a name from that list plus at most one short label such as body or appleHealth. There is no page history, no session recording and no free text, so this can tell us that forty people reached a locked feature and cannot tell us what any one person did with their evening. Email us and we will send you the full list of names. A job runs every day and deletes anything older than 90 days.
• Anything you send us: if you use the feedback form in Settings, we keep what you wrote, which of the four kinds you picked, and the diagnostics listed on the form itself — the screen you were on, the build number, your plan, your window size and your browser family. The form shows you that list before you send.

We do not collect location, contacts, or anything from your device that you have not chosen to send. Apart from the cookie-free page counts described under Analytics below, we use no analytics product, and nothing above follows you to any other website.

2. Where it goes

Loop runs on twelve outside services. This is all of them, and what each one sees. Several of them only ever see anything if you switch on the feature they belong to.

• Supabase (database and sign-in) stores your account and everything you log. The database itself enforces, on every query, that one account cannot read another's rows.
• Anthropic (the Claude AI models) receives data only when you use an AI feature, and only the part that feature needs — the day's figures for a brief, the image you dropped in for a scan. Their API terms state inputs are not used to train their models.
• Vercel (hosting) runs the site and sees request traffic and server logs. It also counts page views and measures how fast pages load (Vercel Analytics and Speed Insights), without cookies and without building a profile of you.
• Stripe (payments) handles card details. Card numbers go to Stripe directly and never reach us; we keep a customer id and which plan you are on.
• Sentry (crash reports) is told when something breaks, so it can be fixed without waiting for you to report it. It gets the error and the page you were on, not what you logged — text is masked and email addresses are stripped before the report leaves your device. If the crash happened on screen, a few seconds of that screen is recorded, with every piece of text blanked out.
• Cloudflare (Turnstile) checks that a sign-up is a person rather than a script. It sees the signals a browser gives off during that check, on the sign-up and sign-in screens only. It is not analytics and it does not follow you.
• Resend (email) delivers the confirmation and password-reset messages your account needs, and the alerts that tell the operator something has broken. It sees the address a message is going to and what that message says. If you connect Canvas by grade emails, Resend also receives the grade notifications Canvas sends to your private Loop address; Loop keeps the class, the assignment and the score, and nothing else from them. If you pay for a yearly plan, Resend also sends the reminder before it renews.
• Google receives nothing unless you choose “Continue with Google”, in which case it tells us your email address and name and nothing else. Loop asks for no other access to your Google account.
• WHOOP is read, not written, and only if you connect your band. Loop pulls your recovery, sleep, strain and workouts a few times a day. “Disconnect WHOOP” on the Body tab stops it immediately and deletes every day of WHOOP data Loop saved.
• Fish Audio (Max's voice) receives the sentence Max is about to say, so it can be spoken aloud. Only when Max speaks.
• Nutritionix (food database) receives what you typed into a meal — the words, not your name, your targets or anything else about you.
• Your browser's push service (Apple, Google or Mozilla, depending on your device) carries a notification to your phone if you turn notifications on. The message is encrypted on the way; they deliver it without being able to read it.

We do not sell your data, share it with advertisers or data brokers, or hand it to anyone else — except where we are legally required to, in which case we will tell you unless we are legally forbidden from doing so.

One other person can see two things, if you choose it. You can share a streak with one friend. Neither side can start that alone: it begins only when one of you sends a link and the other accepts it. While it is on, each of you sees the other's first name and whether they logged something that day. Nothing else crosses — no grades, no money, no weight, no notes, no messages. Either of you can end it in one tap, and ending it stops the sharing immediately.

3. Cookies, and why there is no banner

Loop sets no cookies on your device. Not for sign-in, not for preferences, not for analytics. There is nothing to consent to, which is why you have never been asked.

There is exactly one exception, and it is not about you: the operator's own admin console sets a single cookie on the operator's browser, so the server can refuse to serve that page to anybody else. It holds no information about any user, it is only ever issued to the one account that owns this app, and no visitor to Loop will ever receive it.

Things are kept on your device, in your browser's own storage, and they are all necessary for the app to work at all:

• Your sign-in. The session that keeps you logged in between visits. Signing out deletes it, along with everything below.
• A copy of what you logged. Your homework, grades, habits and money are mirrored locally so the app opens instantly and still works with no signal. This is the same data already in your account, not extra data about you.
• Small preferences. Which tab you were on, light or dark, your accent color.

None of it is readable by another website, none of it is sent anywhere on its own, and none of it follows you around the internet.

Analytics. We use Vercel Analytics to count page views, and Vercel Speed Insights to measure how fast pages load. Both use no cookies and builds no profile of you or your device across sites. It tells us that a page was opened, not who opened it. There is no Google Analytics, no advertising pixel, no Facebook tag, and no third-party tracker of any kind.

Nothing is embedded from anywhere else. No YouTube players, no comment widgets, no social buttons, no chat bubbles. Even the typeface is downloaded from our own server rather than from Google's, so loading Loop does not tell anyone else that you did.

4. What we do not protect you from

Every company above can technically access what is stored with or sent to them. That is inherent to using cloud services and cannot be configured away. Encryption in transit and at rest protects your data from outsiders and from other users; it does not hide it from the provider holding it.

5. AI features, specifically

AI features send only what they need, when they run. Most run when you use them; the Today brief, the Body brief and weekly insights write themselves when their card opens. Health data reaches the AI only if you turned on “Let AI read my health data” in Settings. If you never use an AI feature, nothing you log leaves our infrastructure.

AI output is generated by a language model, is not reviewed by a person, and can be wrong. See the Terms for what that means for health and money decisions.

6. If you are under 18

Loop is for people 13 and over. We do not knowingly collect anything from a child under 13; if we learn we have, we delete the account and its data.

Under-18 accounts are treated the same as any other, with two differences built into the product: supplement suggestions are never shown to a minor, and a monthly earnings target is not shown below 15, because handing a 13-year-old an income goal invents a pressure nobody asked for.

Under 16, Loop never switches on weight or calorie tracking by itself and never offers a weight-loss goal. A student can still turn tracking on in Settings, but the app does not suggest it first.

A parent or guardian can email looposapp.help@gmail.com to see what we hold about their child, correct it, or have it deleted.

7. What you can do

• See it: everything we hold is visible in the app.
• Export it: Settings → Export, which gives you a file of everything you have logged in Loop.
• Correct it: edit anything, any time.
• Delete it: Settings → Delete account. It cancels any subscription, then deletes your account and everything in it, permanently, straight away. Nobody has to approve it and we cannot undo it. If you would rather we did it, email looposapp.help@gmail.com.
• Turn features off: switching a module off stops it collecting anything further.

Loop is built for students in the United States. Depending on where you live, state law (California's CCPA, for example) or, outside the US, laws such as the GDPR may give you further rights, such as to object to or restrict processing or to complain to a regulator. Email looposapp.help@gmail.com and we will respond within 30 days. We do not charge for this and we will not ask you why.

8. How long we keep it

• Your logged data: until you delete it or close your account.
• Deleted accounts: removed immediately; backups roll off within 30 days.
• Server logs: about 30 days.
• Billing records: kept as long as tax and accounting law requires, typically seven years. This is a legal obligation and applies even after an account is closed.

9. Security

• Encrypted in transit (HTTPS everywhere) and at rest.
• Row-level security on every table, so isolation is enforced by the database rather than by application code remembering to.
• Optional device unlock with Face ID or Touch ID.
• A notification when your account is used on a device we have not seen before.
• Your WHOOP connection token is encrypted before storage.

No service can promise it will never be breached. If one happens and your data is affected, we will email you within 72 hours of finding out, and tell you what was involved rather than the minimum we can get away with.

10. Where data is held

Loop is operated from the United States and data is processed there. If you use it from elsewhere, you are sending your data to the US, where privacy law differs from your own.

11. Changes

If we change this policy in a way that materially affects you, we will email you and show a notice in the app before it takes effect. The date at the top always reflects the current version.

12. Contact

Any privacy question, request, or complaint: looposapp.help@gmail.com. A person reads it.