Privacy policy

1. Who we are

Loopr is made and published by Eddy Leon Tejeda, an independent developer, on the App Store and on Google Play. In this policy, "we" and "us" mean the developer, who decides how the information described here is handled, and "Loopr" on its own means the app.

This policy covers the Loopr app for iPhone and iPad, available on the App Store; the Loopr app for Android, which invited testers install from Google Play while it is in closed testing; and this website, apploopr.com. Where the two apps work differently, it says so.

Questions about privacy, and requests about your data, go to privacy@apploopr.com.

2. What we collect

What Loopr collects depends on whether you sign in. Everything you create is saved on your phone first; signing in adds a copy of it in your account, apart from your photos.

Without an account

Tap Continue without an account and Loopr gives your phone a random identifier that is kept on it. Your routes, saved places, settings, notes and photos are kept only on that phone, though on iPhone and iPad your phone's own backup can include the photos, and on Android, before version 1.37, your Google account's backup can include them and the rest too: nothing is stored in our database or sent to our purchase provider. (In version 1.32.2 on iPhone and iPad, a link that opens Loopr's scanner or its Loopr Pro screen also asks RevenueCat for Pro's prices. Until Loopr is closed, RevenueCat then receives a random identifier and the technical details described under Loopr Pro purchases, including the identifier Apple gives Loopr on your device, but nothing you have entered.) Address search, routing, optimizing, the map and the update check still need the services described below, and work the same way for everyone. From version 1.44, so do the usage, speed and crash reports described below, unless you turn them off.

If you sign in later, what is on the phone — routes, saved places, preferences and the current plan — is copied into your account, alongside anything already there.

With an account

You can sign in with Google, and on iPhone and iPad also with Apple. Sign-in happens in Apple's or Google's own screens, so Loopr never sees your password. Loopr receives a sign-in token and a few profile details:

• Sign in with Apple (iPhone and iPad only): your name and email address, which Apple shares only the first time you sign in to Loopr. If you choose Hide My Email, we get Apple's private relay address instead of your own. Apple sends no photo.
• Google: your Google account ID, email address, name and a link to your profile photo. Settings and Account show that photo, loaded from Google. Loopr doesn't ask for ongoing access to your Google account.

Your sign-in becomes an account in Google's Firebase Authentication, which holds an account ID, your Apple or Google user ID, your email address and, for Google, your name and profile photo link. Loopr then keeps the following in your account, in Google's Cloud Firestore database:

• Your profile: how you signed in, and your email address, name and profile photo link where we have them.
• Your preferences: distance units, navigation app, map style, appearance, language, haptic feedback, Search my country only, whether the scanner reads addresses live, Time at each stop, and your route settings (where the route starts and how it ends, Start time and Finish by), each with the time it last changed.
• Saved routes: the name, the stops, the total distance and drive time, and when the route was created and changed. A starting point taken from your current location, and any progress, are removed before a route is saved; with a Fixed start, the first stop is where the route starts, and it is saved with the others.
• Saved places: the name you give a place, its address and coordinates, and when it was created and changed.
• The current plan: the route you're working on, including its starting point — which can be your current position — whether a run is in progress, and each stop's progress (Done, Collected or Failed).
• Deletion records: the internal ID of each saved route or saved place you delete, and when you deleted it, so a phone that was offline at the time doesn't bring it back.

Each stop holds its name, address and coordinates, whether it is a delivery or a pickup, a package count, any opening times you set, the file names of its photos (not the photos themselves) and your note of up to 500 characters. Notes — gate codes, for instance — are stored in your account with the route.

The addresses, notes and photos you add are often about other people, such as the customers you deliver to. You decide what to enter, and we keep it only to run Loopr for you.

Loopr copies changes to your account as you make them — the current plan a few seconds after you stop editing, and straight away when a run starts or ends or the app goes to the background — and checks for changes made on your other phones when you sign in, when the app starts and when you return to it. Signing out deletes none of your data: it stays in your account, and on the phone so you can pick up where you left off if you sign back in. From version 1.37, signing out does clear the offline copy of your account that the database software keeps, which Loopr reads again from your account when you sign back in. From version 1.36.12, if someone else then signs in on that phone, or anyone chooses Continue without an account there, Loopr first erases your routes, saved places, preferences, current plan and stop photos from the phone, and none of it is copied into their account. In earlier versions, the next person to sign in on the phone can get a copy of your routes, saved places and preferences in their account. Before you hand over a phone running one, sign out, choose Continue without an account, and then use Delete local data in Settings → Account.

Loopr Pro purchases

Loopr Pro is a subscription sold through the App Store on iPhone and iPad and through Google Play on Android, so Apple or Google takes the payment and we never see your card or bank details. Pro is tied to your account, which is why you need to sign in to buy it.

To check whether your subscription is active, and to restore it on another phone, Loopr uses RevenueCat. Whenever you're signed in, whether or not you buy Pro, RevenueCat receives your Loopr account ID and the technical details its software sends with every request: your phone's model, system version, languages and store country, and on iPhone and iPad the identifier Apple gives Loopr on your device, which is not the advertising identifier. After you sign out or delete your account, it can go on receiving those technical details, without your account ID, until Loopr is closed. When you buy or restore, it also receives the store's purchase and transaction information: the App Store's on iPhone and iPad, Google Play's on Android. From version 1.36, Loopr also gives RevenueCat the email address and name on your account, where Apple or Google shared them, so that we can find your subscription when you write to us about it. Loopr doesn't read your advertising identifier, and doesn't turn on RevenueCat's optional identifier collection or Apple Search Ads attribution.

Location

Loopr asks for permission to use your location only while you're using the app, never in the background. It asks when you tap Continue on the Start from where you are card, tap the locate button, or choose Current location as a route's start. Everything else works without it, and you can turn it off for Loopr at any time in your phone's settings. Wherever Loopr sends your position, it sends it as your phone reports it, without rounding: precise, unless you've allowed Loopr only your approximate location. Once you allow it, Loopr uses your location in four ways:

• As a starting point. Loopr reads your current position and makes it the route's first stop. It sends that position to Google's geocoding service to name the place and, with your other stops, to the routing and optimizing services. It is kept in the current plan, which is copied to your account if you're signed in; saved routes leave it out. While the start is set to Current location, Loopr takes your position again, without asking again, whenever the route has no starting point yet: when the app opens, after you clear the route, or when you open a saved route.
• To rank search results. Whenever Loopr holds a position — one it took for a current-location start or the search country, or the last one your phone recorded in the past hour, read without asking again — it sends that position to Google with each address search, so places near you come first and show their distance. This happens whether or not Search my country only is on. Loopr keeps that position only in memory, until the app is closed. Without location permission, no position is sent.
• To choose the search country. While Search my country only is on — when the app opens or you turn it on, when you return to the app or search before it has found a country, and after each new current-location position — Loopr reads the position your phone last recorded (if it is less than an hour old) without asking again, and asks the phone's own geocoder which country that is: Apple's on iPhone and iPad, and on Android the one the phone provides, usually Google's. So Apple or Google receives that position. Versions before 1.36.11 also did this when the app opened with Search my country only off. From the geocoder's answer, Loopr keeps only the two-letter country code, in memory, and uses it to limit searches to your country while Search my country only is on. Without location permission, Loopr uses your phone's language and region settings instead.
• On the map. Your position appears as a blue dot. On iPhone and iPad, Apple Maps draws it. On Android, Google's map does, with your position from Google Play services, updated every few seconds while the map is on screen. Loopr itself doesn't read those updates.

Camera, scanning and photos

Loopr asks for the camera when you open the package scanner, a Loopr Pro feature, or take a photo of a stop. It uses photos from your library only when you choose them. On iPhone and iPad it asks for access to your photo library before showing it. On Android 12 and older it may ask for storage access before showing your photos, and on Android 8 and 9 before taking a stop photo too.

• Scanning. The scanner uses Google's ML Kit, running on your phone, to read barcodes, QR codes and printed address labels. Camera images are never uploaded. Stills the scanner takes are temporary files on the phone: from version 1.37, Loopr deletes each one as soon as it no longer needs it, and Delete account and Delete local data remove any left behind; earlier versions leave the still Read now takes for the phone to clear. What does leave the phone is the result — the address text picked from a label, or the text or coordinates in a code — which goes to Google's address search to find the place. Most results are sent as soon as they are read. When live reading finds several possible addresses on a label, nothing is sent until you choose one; Read now and Capture address send their best guess straight away. You confirm the match before it becomes a stop. Loopr skips most codes that hold nothing but a tracking number, but a tracking number read off a label can still be searched for. Labels and codes often carry other people's names: Loopr searches with the lines that look like an address, but it can include a line next to them, the longest line on a label when none looks like an address, or the whole text of a code.
• ML Kit diagnostics. Google says ML Kit sends Google diagnostic and usage information about how it runs, such as the device model and operating system version, the app's identifier and version, a per-installation identifier, performance and error data, and the size and format of the images it reads. The images themselves are not on Google's list. The software that carries these reports can also add your phone's language and country, its time zone and the type of network it's on, and on Android your mobile carrier's network code and the phone's system build. On Android, ML Kit starts with the app, so it may send this even if you never open the scanner.
• Stop photos. You can attach up to 6 photos to a stop, from the camera or your library. Loopr keeps its own copy of each in its storage on the phone. From version 1.37, on both iPhone and Android, that copy is a newly saved JPEG that carries none of the original's metadata, such as its GPS location, and photos you attached with an earlier version are saved again the same way after you update, apart from any the phone can't open, which stay as they were. Before 1.37, on iPhone and iPad, camera photos and JPEG and PNG photos from your library are re-compressed, which removes metadata such as GPS location; photos in HEIC, the iPhone's usual format, and a few other formats are copied as they are, metadata included. On Android, a photo you take for a stop is taken with your phone's own camera app, whose location setting decides whether it records where it was taken, and before 1.37 Loopr's copy keeps the original photo's metadata, which can include that location. Loopr never uploads them: only their file names are synced, so another phone shows a placeholder. While you choose photos, the photo picker makes temporary copies of its own; from 1.37, Loopr deletes them once its own copies are saved. Your phone's own backup can include Loopr's copies: iCloud or a computer on iPhone and iPad, and on Android, before version 1.37, your Google account's backup.

Usage, speed and crash reports

From version 1.44, while Settings → Privacy → Share usage data is on, Loopr reports to Expo, through its EAS Observe service, which features are used, how fast the app runs and when it crashes. Versions before 1.44 send none of this. A report never holds a stop, a search, a place, a name, a photo or anything else you enter in Loopr, and carries no account ID, name or email address; a link that opens Loopr from outside it is the one exception, described under Speed below. What the reports do hold, each part with the date and time the phone recorded it:

• Two random IDs. The random install ID that Expo's update check already sends, which is generated on your phone, kept by Loopr, and not derived from the phone's hardware or your account; and a random ID for each session in the app. The install ID changes when you uninstall Loopr, though on iPhone and iPad, restoring the phone from its backup can carry it over. Your advertising identifier, the identifier Apple gives Loopr on your device and the Android ID are not sent.
• Your phone and the app. The phone's model identifier (iPhone17,1, for example, or on Android its manufacturer and model) and, on iPhone and iPad, the type of device (iPhone or iPad), or on Android the device's code name (such as husky); its operating system and version; its language and region setting, such as en-US; and the app's name and identifier (com.zombielion.loopr), its version and build number, the ID of the EAS build it came from, the over-the-air update it is running, its release channel and runtime version, and the versions of Expo's SDK and React Native it is built with.
• Speed. How long the app took to start — whether from cold or warm, and how long it took to load its code, draw its first frame and become usable — and how long each screen took to appear, with the screen's route in the app, such as /settings or /scan, and the path and parameters it was opened with; and how long an over-the-air update took to download, with that update's ID. None of Loopr's own screens takes parameters, so these hold nothing of yours, unless Loopr was opened from a loopr:// link made outside the app: that link's path and parameters are then sent with the timing of the screen it opened. A report never says what was on the screen.
• Once per launch, with the time the app took to become usable: the battery level and whether the phone was charging; whether Low Power Mode was on; the phone's thermal state; how many frames were slow and how many froze; whether the phone was online, and on Wi-Fi, cellular or another network; and a summary of the internet requests the app made while starting — how many, how many failed, the bytes sent and received, their total and slowest duration, and the host name of the slowest one, such as osrm.apploopr.com. Only the host name: never the rest of the request, so never an address or a position.
• On iPhone and iPad only, how long each visit to the app lasted, and when the system warned that it was low on memory, with how much memory the app was using and how much it had left at that moment, and how many warnings there had been so far.
• Which features are used, as counts, durations, yes-or-no answers and fixed words: the stops added between opening the app and leaving it, counted by how — search, saved place, map pin, scanned address or scanned barcode — and the packages added to stops already on the route; Optimize finishing, failing or being cancelled, with the number of stops, the seconds it took, whether the order changed and which constraints it had to relax; a run started, with its number of stops with and without the starting point, its pickups, and whether Optimize put it in that order since Loopr last started; a run finished, with how many stops were delivered, collected and failed, and how many minutes it took; a run ended early, with how many stops were resolved, out of how many, and its minutes; directions handed to Google Maps or Apple Maps, and whether you chose the app when Loopr asked; a route saved or loaded, with its number of stops; a place starred; photos added to a stop, from the camera or the library, and how many; the Loopr Pro screen shown; a purchase completed, cancelled or failed, with the plan and whether it began a free trial; a restore of purchases, with whether it found one, found nothing or failed; a session begun from the sign-in screen, with Apple, with Google or without an account; and the tour closed, completed or skipped, on which page of how many, and whether it was replayed from Settings.
• Crashes and errors. When the app crashes, or meets a JavaScript error that nothing in it handles: the error's type and message, and the stack trace, which says where in Loopr's code it happened; for a crash in the app's native code, also the exception and signal codes, the reason the system gave for ending the app, how many threads it had, and the identifiers of the app's binary files. Loopr writes its own error messages from the app's fixed text, so these describe its code, not your data. Errors the app catches and explains to you on screen are not sent.

Loopr sends the reports in batches once the app has left the foreground: on iPhone and iPad as it leaves, and on Android from a background task that waits for a connection, which can run after the app has closed. A crash is recorded the next time the app starts, and sent with the next batch. Share usage data is on until you turn it off, and it belongs to the phone, not your account: each phone has its own, it isn't synced, and it stays as it is through Delete account, Delete local data and the erasing described under With an account, when someone else signs in on the phone. Turning it off takes effect at once: no new sending starts, and what the phone has recorded and not yet sent is never sent, nor is anything recorded while it stays off. Turning it back on takes effect the next time Loopr starts — opened afresh, not returned to from the background — and before it sends anything, that start marks everything recorded until then as never to be sent. There are two exceptions. A batch already being sent when you turn it off is finished, and can carry what was recorded until it ends. And on iPhone and iPad the system can hand Loopr a crash report some time after the crash: one that arrives once the switch is back on is sent, even if the crash happened while it was off. Development builds of Loopr never send any of this.

The library that sends these reports, expo-observe, records them on the phone from the moment the app starts, whether Share usage data is on or off, in a small database of its own. With the switch off, nothing in it leaves the phone. The library deletes anything in it older than 7 days, but only when Loopr runs: on iPhone and iPad, each time Loopr starts afresh, and on Android, in a background task it queues each time Loopr leaves the screen, which runs once the phone is online. So if you stop opening Loopr, what the database holds can stay on the phone until you uninstall Loopr. Delete account and Delete local data don't empty it. On iPhone and iPad it is kept in the app's documents, so the phone's own backup can include it.

On this website

• No cookies, no analytics. apploopr.com sets no cookies and loads no analytics, web fonts or third-party scripts. Everything a page loads comes from apploopr.com itself.
• Your language choice. If you pick English or Spanish with the EN | ES switch, or open a link that names a language, your browser remembers the choice in its local storage, under the name "loopr.lang". Nothing else is stored.
• Hosting. Cloudflare serves the site and runs its domain name system, so it handles every request and sees your IP address and browser details. Cloudflare may also ask your browser to report failed connections to it.
• Forms. The Android waitlist form on the home page sends your email address and the language you were reading the page in, English or Spanish, with fixed fields that label the message. We use them for one thing: a single email when Loopr for Android is open to everyone on Google Play. The account deletion form sends the email address on your account, how you sign in, what you want deleted, any notes you add and your confirmation, also with fixed fields that label it. Both go to Web3Forms, a form service that forwards each submission to our inbox and also sees your IP address. Nothing is sent until you press the button.

When you email us

Our email at apploopr.com is hosted by Google Workspace, so Google processes the messages you send us. We keep what you write, and your address, to answer you.

3. How we use it

We use the information above only to:

• run the features you use: find addresses, draw and optimize routes, show the map, hand directions to your navigation app, and scan packages
• sign you in, and keep your routes, saved places and preferences in step across your phones
• check whether you have Loopr Pro, and restore it on a new phone
• check for app updates
• from version 1.44, while Share usage data is on, see how many installs use each version of Loopr, find and fix crashes and slow screens, and learn which features are used, without linking any of it to your account
• answer your emails and requests, including deletion requests
• send the one email you asked for with the Android waitlist form, when Loopr for Android is open to everyone on Google Play
• comply with the law

We don't use it for advertising, we don't build profiles of you, and we don't sell it.

4. Who else handles it

Loopr relies on the services below. Each receives what is listed here and handles it under its own privacy policy, except the two we run ourselves, on our own server: our route optimizer and, from version 1.38, our routing server. We choose services that protect what they receive at least as well as this policy does, and give each only what it needs to do its job. Beyond them, we share your information only when the law requires us to.

Sign-in and sync

• Google Firebase (Authentication and Cloud Firestore) — for signed-in users only, your account and the data listed under With an account, along with your phone's model and system version, which Firebase's software sends with each request. Used for sign-in and sync.
• Apple (Sign in with Apple, on iPhone and iPad) and Google (Google Sign-In) — confirm who you are when you sign in.

Purchases

• Apple (App Store) — sells Loopr Pro on iPhone and iPad and takes payment.
• Google (Google Play) — sells Loopr Pro on Android and takes payment. With each purchase, Google Play also receives a scrambled form of your Loopr account ID. Google Play's billing library, which runs inside the app, also sends Google its own diagnostics.
• RevenueCat — whenever you're signed in, whether or not you buy Pro: your Loopr account ID, your phone's model, system version, languages and store country (and on iPhone and iPad, the identifier Apple gives Loopr on your device), and the App Store's or Google Play's purchase information, to check your subscription; from version 1.36, also the email address and name on your account, to find that subscription when you write to us about it.

Maps, search and routing

• Apple Maps — draws the map on iPhone and iPad, so Apple receives requests for the map area you view. Apple's geocoder also works out the search country there, as described under Location.
• Google (Maps SDK for Android) — draws Google's map in the Android app, through Google Play services, so Google receives requests for the map area you view, along with what its map software reports to Google on its own: your phone's model and system version, crash reports, and a pseudonymous identifier for the map software. On Android, the phone's own geocoder, usually Google's, works out the search country, and Google Play services supplies your position.
• Google Maps Platform (Places and Geocoding) — address search: the text you type, as you type, once it is 3 characters long, or the text read from a label or code; the app's language with your phone's country or region setting; the country filter; and your position, when Loopr has one, to rank the results. A place you choose is then looked up by its ID. Google's geocoding also names a dropped pin, your current-location start and a place in a scanned code, from its coordinates. Requests identify the app as Loopr.
• Our routing server, at osrm.apploopr.com — OSRM routing software that we run ourselves, on the same machine as our route optimizer. From version 1.38 it draws the line on the map and works out the drive times. Whenever Loopr draws or redraws the route, the server receives the coordinates of every stop in it, including the starting point. Names, addresses, notes and package counts are never sent. Cloudflare carries these requests to it, as described below. Versions before 1.38 get the line and the drive times from OSRM's public routing server at router.project-osrm.org instead, which the FOSSGIS association runs and Loopr doesn't, and which receives the same coordinates whenever the route is drawn or redrawn. FOSSGIS says it saves each route request in its server logs, and its privacy statement gives no period for keeping them.
• Our route optimizer, at vroom.apploopr.com — a VROOM server we run ourselves, which reorders your stops when you tap Optimize. It receives the coordinates of every stop, including the starting point; your Time at each stop setting; any opening times, as dates and times on the day of the route; and, when Finish by or opening times are set, when the route starts (your Start time, or the moment you tap Optimize) and, if you set one, your Finish by time. Names, addresses, notes and package counts are never sent. Cloudflare carries these requests to it, as described below.
• Apple Maps or Google Maps on iPhone and iPad, and Google Maps on Android, when you tap Directions — the coordinates of the stop you chose, and nothing else. If the Google Maps app isn't installed, the directions open on Google's website. From there, Apple's or Google's own privacy policy applies.

Scanning, updates and usage reports

• Google ML Kit — reads codes and labels on your phone, and sends Google the diagnostic information described under Camera, scanning and photos.
• Expo (EAS Update) — when the app starts, it asks Expo's servers whether a newer version of its code exists. The request carries the platform, the app's version, its release channel and a random install ID, and nothing you have entered. If the app failed to start properly the time before, it also carries a short description of that error.
• Expo (EAS Observe) — from version 1.44, while Share usage data is on, the reports described under Usage, speed and crash reports, labelled with the same random install ID as the update check. They go to Expo's servers at o.expo.dev, which Expo (650 Industries) runs in the United States, and Expo deletes them after 90 days, as described under How long we keep it. Like any server, Expo also receives the IP address they come from; its dashboard can show us the country that address suggests, but Loopr doesn't receive the address.

This website and email

• Cloudflare — hosts apploopr.com, and carries the app's requests to our route optimizer and, from version 1.38, to our routing server. It decrypts and re-encrypts those requests on the way, so it can see what they contain.
• Web3Forms — forwards form submissions to our inbox.
• Google Workspace — hosts our email.

Every one of these services also sees your phone's or browser's IP address and ordinary request details, because that is how internet connections work. Each keeps its own logs for as long as its own policy says; we don't receive them. Our route optimizer and our routing server are the exception: their logs are ours, as described under How long we keep it. From version 1.44, we also see the usage reports in Expo's dashboard, with the country an IP address suggests but not the address itself.

5. What we don't do

• No ads. Loopr shows no advertising and has no advertising or marketing partners. We don't sell your personal information or share it for advertising. Versions before 1.44 have no analytics service of their own; from 1.44, the only one is Expo's EAS Observe, described under Usage, speed and crash reports, which you can turn off.
• No tracking tools. Loopr has no advertising, attribution or tracking software of its own. Of Firebase it uses only sign-in and the database, not Analytics or Crashlytics. Before version 1.44 it has no analytics or crash-reporting software either, and errors are logged only on your phone, apart from the failed start Expo's update check reports; from 1.44, while Share usage data is on, Expo's EAS Observe also reports crashes and the errors nothing in the app handles. Separately, Google's ML Kit, and on Android Google's map and Google Play's billing library, send Google their own diagnostics, as described above.
• No tracking across apps. Loopr doesn't track you across other companies' apps or websites and doesn't use your device's advertising identifier, which is why it never asks for permission to track you. The usage reports from version 1.44 don't change that: the library that sends them declares to Apple that what it collects — crash data, performance data, other diagnostic data, a device ID and product interaction — is not linked to your identity and not used for tracking.
• No background location. Loopr doesn't read your location when you aren't using it, and doesn't ask for permission to.
• No motion or fitness data. Loopr doesn't collect it. While the scanner is open, the camera uses the phone's motion sensor only to tell which way up it is.
• No passwords and no card details. Apple or Google handle sign-in and take payment.
• No sharing between users. Loopr has no feed, profiles, messages or sharing, and nothing you add is shown to other Loopr users. Versions before 1.36.12 make one exception, on a shared phone, as described under With an account.

6. How long we keep it

• On your phone: until you delete it, use Delete account or Delete local data, or uninstall Loopr. Signing out doesn't remove it, though from version 1.37 it does remove the offline copy of your account that the database software keeps. A few things outlast Delete account and Delete local data: the random install identifiers that Expo's update check and ML Kit use, and RevenueCat's own records on the phone, until you uninstall Loopr. From version 1.44, Expo's install identifier also labels the usage reports, and two more things stay: your Share usage data choice, until you uninstall Loopr, and the usage reports recorded on the phone, which are cleared of anything older than 7 days only when Loopr runs, so if you stop opening it they can stay until you uninstall it. Versions before 1.37 also leave photos copied while you choose them and stills the scanner takes, until the phone clears them, and the database software's offline copy of your account, until you uninstall Loopr. On iPhone and iPad, your sign-in is kept in the phone's keychain, which uninstalling Loopr doesn't clear. From version 1.37, a reinstalled Loopr signs you out the first time it opens; earlier versions sign you straight back in, so with those, sign out before uninstalling to remove it. Your phone's backup — iCloud or a computer on iPhone and iPad, and on Android, before version 1.37, your Google account's backup — keeps what it copied for as long as that backup does. From 1.37, Loopr for Android is left out of your Google account's backup, though on some phones a direct transfer to a new phone can still copy its data across.
• In your account: until you delete the item, clear your saved routes, or delete your account. Nothing in your account expires on its own, apart from the deletion records below.
• Deletion records: removed the first time Loopr syncs after they are 90 days old, and at most the newest 500 of each kind are kept. They hold only an internal ID and a date — nothing about what was deleted.
• Stop photos: when you're signed in, a photo that no route or plan uses any more is removed from the phone automatically at a later launch, once Loopr has synced with your account, and never less than 24 hours after it was added. Without an account, unused photos stay on the phone until you use Delete local data or uninstall Loopr. Delete account and Delete local data remove Loopr's copies of your photos immediately, and from version 1.37 the temporary copies described above as well; earlier versions leave those until the phone clears them.
• Purchase records: kept by Apple or Google for as long as their own policies say, and by RevenueCat, under your Loopr account ID, until you ask us to delete them there. Deleting your account from version 1.36 asks RevenueCat to remove the email address and name it holds for you, but not the purchase records — see below.
• Usage, speed and crash reports at Expo: from version 1.44, deleted once they are 90 days old, in monthly batches, so a report can be up to about four months old when it goes. After that, Expo keeps only a count of each app's events, for billing. The reports are kept under the install ID, not your account, so we can't find yours from your email address, and deleting your account doesn't reach them; they expire on their own.
• Emails and form submissions: kept in our mailbox, with no automatic schedule apart from the Android waitlist below; ask and we'll delete yours. We keep our correspondence about a deletion request as a record that we carried it out. How long Web3Forms keeps a submission is up to Web3Forms.
• The Android waitlist: until the one email it is for has gone out. Then we delete it, along with the form submissions it came from. Ask before then and we'll take your address off it.
• Logs kept by the other services above: as long as each one's own policy says. The logs of our route optimizer and our routing server are described next.
• The logs on our own server: the route optimizer keeps a log line for each request, with its time, until we replace the server's software, and keeps a request's contents only while it is being solved. The routing software on the same machine, which the optimizer uses too, logs the coordinates in each request, with its time — including your position when a route starts from Current location — in logs that are capped in size and overwritten as they fill. From version 1.38 that includes every route the app draws, not only the ones you optimize. None of these logs holds your name or account, so we have no way to tell which entries are yours; that is why deleting your account doesn't reach them.
• Your language choice on this website: in your browser until you clear its site data.

7. Deleting your data, and your other rights

In the app

Go to Settings → Account → Delete account. Settings is the gear on the map, and Account is the row at the top; you can also reach it from the person icon in Saved routes. After you confirm, you sign in with Apple or Google once more, which needs a connection, and Loopr then, straight away:

1. deletes your saved routes, saved places, current plan, preferences, deletion records and profile from our database
2. asks Apple or Google to revoke Loopr's access to your Apple or Google account, and deletes your sign-in account; if that request fails, the deletion still goes ahead, and you can remove Loopr in your Apple or Google account settings yourself
3. from version 1.36, asks RevenueCat to delete the email address and name it holds for you. The app can't always confirm that this arrived, and earlier versions don't ask, so if you want to be sure, write to privacy@apploopr.com and we'll delete them there for you
4. erases Loopr's routes, saved places, plan, settings and stop photos on that phone, and signs you out (from version 1.37, along with the photo picker's and the scanner's temporary copies and the database software's offline copy of your account); the few things described under How long we keep it (from version 1.44, among them your Share usage data choice and the usage reports recorded on the phone), and anything already in your phone's backup, stay behind

There is no waiting period and no "deactivate" option: the account is deleted. Without an account, the same screen offers Delete local data, which erases what Loopr stored on the phone in the same way, from version 1.37 the temporary copies included.

To delete less, delete a single saved route or saved place, or use Settings → Data → Clear saved routes. When you're signed in, those deletions reach your account and your other phones too.

An account created with Sign in with Apple can only be signed into, and so deleted in the app, on an iPhone or iPad. From an Android phone, use the request form below.

Without the app

If you've already removed Loopr, or can't sign in to your account on the phone you have, request deletion at apploopr.com/delete-account or by email to privacy@apploopr.com. A person handles these requests. Within two business days we email the address on the account to confirm the request came from you. Within 30 days of your reply, we delete the account and the email address and name RevenueCat holds for you, and email you when it's done.

What deleting your account doesn't do

• It doesn't cancel Loopr Pro, or a free trial of it. Cancel in the store that sold it — on iPhone or iPad, Settings → your name → Subscriptions; on Android, the Play Store's Payments & subscriptions → Subscriptions — or it keeps renewing, and a trial becomes a paid subscription when it ends.
• It doesn't delete your purchase record at RevenueCat, which is kept under your Loopr account ID after your email address and name are removed. You can ask us to delete it there by writing to privacy@apploopr.com.
• It doesn't delete what Apple or Google keep about your sign-in or purchase, the logs the services above keep, the logs on our own server, copies in your phone's own backup, or messages you've sent us. From version 1.44, it doesn't reach the usage reports already sent to Expo either: they are kept under the install ID, not your account, and expire on their own.
• Another phone still signed in to the account keeps its copy until you uninstall the app there, or sign out there and choose Continue without an account, which from version 1.36.12 erases it; in earlier versions, use Delete local data after that, as described under With an account. So sign out there before you delete your account. Opening Loopr there can give RevenueCat your email address and name again.

Your other rights

You can ask us for a copy of the personal information we hold about you, and ask us to correct it, delete it, or stop or limit a particular use of it. Most of it you can see and change in the app yourself; your name and email address come from Apple or Google. To ask, write to privacy@apploopr.com and tell us the email address on your account (if you used Hide My Email, the relay address); we'll reply to that address to confirm the request came from you. From version 1.44, that route can't reach the usage reports: they are kept under the install ID rather than your account, so we can't find yours from an email address. To stop that use, turn off Settings → Privacy → Share usage data; reports already sent expire on their own. Depending on where you live, you may also have the right to complain to your data protection authority.

Without an account, nothing about you is stored in our database: your data is on your phone, and Delete local data removes it there, apart from the few things described under How long we keep it, which before version 1.37 include temporary copies of your photos and of the scanner's stills. The logs on our own server, which hold no name or account, keep the coordinates of the routes you optimize and, from version 1.38, of every route Loopr draws, either way. From version 1.44 the same goes for the usage reports at Expo, which are sent with or without an account while Share usage data is on, and expire on their own.

8. Children

Loopr is a tool for planning driving routes and is not directed at children. Its App Store age rating is 4+ and its Google Play content rating is Everyone, which reflect its content — it has no way for users to see or contact one another — rather than an intended audience. Our terms of service require users to be at least 13. Loopr doesn't verify age or collect parental consent, and we don't knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, write to privacy@apploopr.com and we'll delete it.

9. Where your information is processed

Most of the services listed above are run by companies in the United States, and they operate servers in many countries; the public routing server that versions before 1.38 use is in Switzerland. Using Loopr or this website means your information may be processed outside the country where you live, including in the United States, where data protection law may differ from yours.

10. Security

• In your account. Database rules let a signed-in user read and write only their own data, checked against an identity Google has verified, so no other Loopr user can reach it. It is not end-to-end encrypted: as the developer, we can reach the database through Firebase's administration tools.
• On your phone. Loopr's data sits in the app's private storage, protected by your phone's own security, such as its passcode. Loopr adds no encryption of its own, so anyone who can unlock your phone can open Loopr. If your phone backs up its apps, the backup is protected by its own security; from version 1.37, Android's backup to your Google account leaves Loopr out.
• In transit. Loopr's connections to the services above are encrypted. Requests to our route optimizer and, from version 1.38, to our routing server are decrypted at Cloudflare and passed on to our server through Cloudflare's tunnel.

No system is perfectly secure, and we can't promise that information will never be accessed without permission.

11. Changes to this policy

When this policy changes, the date at the top changes with it. If a change is significant, we'll say so here before it takes effect and, where we can, in the app or by email.

Some changes will come with new versions of the app. If a version starts sending information this policy doesn't describe, or uses a new service, we'll update this policy before that version is released.

12. Governing law

This privacy policy is governed by the laws of the Dominican Republic, without regard to its conflict of laws provisions. You consent to the exclusive jurisdiction of the courts of the Dominican Republic in connection with any action or dispute arising under or in connection with this privacy policy, except that consumers may bring proceedings in the courts of their own country of residence where local law gives them that right.

Your use of the app may also be subject to other local, state, national or international laws, and nothing in this policy takes away the rights that data protection law where you live gives you.

13. Contact

Email privacy@apploopr.com. For anything about your account, tell us the email address on it (if you used Hide My Email, the relay address); we'll reply to that address to confirm the request came from you. For help with the app itself, see the support page.