This Privacy Policy explains how [Company Legal Name] (“Loop,” “we,” “us”) collects, uses, and protects information when you use the Loop application and website at [your-domain.com] (the “Service”). By using the Service you agree to this policy.
Who we are
The Service is operated by [Company Legal Name], located at [Company Address], [Jurisdiction/Country]. For any privacy question, contact us at [privacy@your-domain.com].
Information we collect
Information you give us
- Account details — your name, email address, and a password (which we store only as a secure hash, never in plain text). If you sign in with Google, we receive your name, email, and Google account identifier.
- Connected social accounts — when you connect a network (Bluesky, Mastodon, Facebook, Threads, LinkedIn), we store the account handle and the access token or app password needed to publish on your behalf. These credentials are encrypted at rest. We never receive or store the password to your social accounts unless you paste an app-specific password (e.g. Bluesky/Mastodon), which is also encrypted.
- Content you create — the text of posts you write or schedule, and any prompts you enter into the AI composer.
Information we collect automatically
- Usage and activity logs — records of actions such as connecting an account, scheduling or publishing a post, and signing in, together with timestamps.
- Technical data — IP address, browser type, and similar information collected by our web server and WordPress.
How we use your information
- To create and secure your account and log you in.
- To publish the posts you schedule to the social accounts you have connected.
- To generate draft post text when you use the AI composer.
- To operate, maintain, secure, and improve the Service, including troubleshooting and preventing abuse.
- To communicate with you about your account, including verification and important service notices.
We rely on the following legal bases where GDPR applies: performance of our contract with you, our legitimate interests in operating and securing the Service, your consent (which you may withdraw), and compliance with legal obligations.
How your content is shared to third parties
To provide the Service, some information is necessarily shared with the providers you choose to use:
| Provider | What is shared | Why |
|---|---|---|
| Social networks you connect (Bluesky, Mastodon, Meta/Facebook & Threads, LinkedIn) | The post content and media you schedule | To publish your posts |
| Sign-in request and profile basics | “Continue with Google” login (if you use it) | |
| Groq, Inc. | The prompt text you submit to the AI composer | To generate a draft post |
| [Hosting provider] | All Service data (as our infrastructure host) | To run the Service |
| [Email/SMTP provider] | Your email address and message content | To send verification and account emails |
We do not sell your personal information, and we do not display third-party advertising or share your data with advertisers.
Cookies
We use only the cookies needed to run the Service — chiefly WordPress authentication and session cookies that keep you logged in. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details.
How long we keep your data
We keep your account information for as long as your account is active. When you delete your account, we delete or anonymize your personal data within [30] days, except where we must retain certain records to comply with legal obligations, resolve disputes, or enforce our agreements. Disconnecting a social account removes its stored credentials.
Your rights
Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, and to object to certain processing. If you are in the EEA/UK (GDPR) or California (CCPA/CPRA), these rights apply to you. To exercise any right, contact [privacy@your-domain.com]. You also have the right to complain to your local data protection authority.
Security
We protect your data with measures including HTTPS in transit, encryption of connected-account credentials at rest, hashed passwords, and access controls that ensure members can only see their own accounts and posts. No system is perfectly secure, but we work to protect your information. See our Security page.
Children
The Service is not directed to children under [16], and we do not knowingly collect their personal data. If you believe a child has provided us information, contact us and we will delete it.
International transfers
Your information may be processed in countries other than your own, including where our providers operate. Where required, we use appropriate safeguards such as Standard Contractual Clauses for such transfers.
Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date at the top and, for material changes, provide a more prominent notice.
Contact us
Questions about this policy or your data? Email [privacy@your-domain.com] or write to [Company Legal Name], [Company Address].