We take the security of your data seriously. This page summarizes how Loop protects your account and your connected social profiles. For how we handle personal data, see our Privacy Policy.
Protecting your credentials
- Connected-account tokens are encrypted at rest. The access tokens and app passwords that let Loop publish for you are encrypted before they are stored, using strong symmetric encryption.
- Passwords are hashed. We never store your Loop password in plain text — only a secure one-way hash.
- Encryption in transit. Traffic to the Service is served over HTTPS.
Access controls
- Members can only ever see and manage their own connected accounts and posts.
- Members cannot reach the administrative back end of the site.
- Sensitive actions are protected against cross-site request forgery.
Account safety
- New accounts are activated by email verification, and unverified accounts cannot sign in.
- “Continue with Google” lets you sign in without a separate password.
- Every connection, publish, and sign-in is recorded in an activity log for administrators.
Your part
Use a strong, unique password, keep your email account secure, and disconnect any social account you no longer use. Connected-account access is granted by you and can be revoked at any time from the network’s own settings or by disconnecting in Loop.
Reporting a vulnerability
If you believe you’ve found a security issue, please email [security@your-domain.com] with details so we can investigate. We appreciate responsible disclosure and ask that you not publicly disclose an issue until we’ve had a chance to address it.