Privacy Notice

Your trips stay yours

Loomo never sells or rents your data to anyone. Your trip plans, stops, and notes are visible only to your account unless you choose to share them.

Information we collect

• Account info: your name, email address, and a securely hashed password (never the password itself). If you add them in Settings, also a profile photo, a phone number, a recovery email address and your 2-step verification settings. Friends who already know your email address or phone number can use it to find you in Together.
• Trip info: whatever you enter — trip names, stops, locations, dates, costs, confirmation numbers, and notes — and any files you attach to a stop, such as a confirmation PDF or a boarding pass.
• People you invite or send things to: the email address or phone number of someone you invite to a trip, kept with the invitation, and the name and email address of an accountant you send Budgetino tax documents to, with when that link was sent and opened. When you invite a friend to Loomo, their address is used only to send that one email; Loomo keeps a one-way scrambled form of it, never the address itself, so the same person isn’t invited twice in a day.
• Budgetino: the budget years, income, bills, cards and other money entries you add, and any tax documents you upload. Each tax document is encrypted with its own key before it is stored.
• Basic session data (a login cookie) so you stay signed in, and which notifications in the bell you have read, so they stay read on every device.
• When you sign in, we record your approximate region (state or country) and a point rounded to about 100 km, which our hosting provider derives from your connection, for account security and usage statistics. We keep them for 90 days and never store your IP address itself.
• Places you save in Trails: the name, note and coordinates you choose. Only you can see them, and they are deleted with your account.
• Voice pins you record with the Loomo Apple Watch app: the recording, where and when you made it, its length and any title you give it. The recording is stored privately with your account, without the file’s own metadata; only you can play or download it, and it is never shared with anyone, including in activity shares, live location shares and the Friend Locator. You can delete a voice pin at any time, which deletes the recording right away; they are included in your data export and deleted with your account. Until your iPhone has uploaded one, it is kept only on that iPhone and removed when you sign out.
• Activities you record or import in Trails: your GPS track, times and elevation, and your heart rate at each point when an Apple Watch is connected to the Loomo iPhone app while you record (see Apple Watch and Apple Health below). They stay private unless you choose a sharing option, and deleting an activity or your account deletes its track. Public activities you post may contribute only to the anonymous community density map described below; Private, Friends-only and unposted activities never do. While you record, the track is also kept on your device until it's uploaded, and until you sign out. When you rate, save, copy or start a route, Loomo notes that against your account so each person counts once; other members only ever see the totals, never who. If you import your own Strava export on loomo.cc, the activities, routes, photos and videos it brings in are stored privately with your account by default and never posted to your followers, you can delete any of them (or the whole import at once with Undo), and they are included in your data export.
• Other Trails extras: the items you tick in a wildlife Prepared kit, and map areas or routes you send to your phone from the website, which go once the iPhone app has downloaded them. Only you can see them, and they are deleted with your account.
• If you turn on the calendar link (Settings → Linked apps): a private address your calendar app uses to read the names, dates, times and places of your trips and their stops (never costs, booking codes, seats or notes), and when it last did. Anyone who has the link can read that, so you can reset it or turn it off there at any time.
• Booking emails you forward to your private Loomo booking address: we keep only the bookings found in them (for example flight, times, hotel, booking code and traveler names), the subject, the sender and when it arrived, never the email itself. Nothing is added to a trip until you approve it. Handled ones are deleted after 30 days, unanswered ones after 60. When an email has no machine-readable booking data and you have tapped Got it on the Loomo AI line, its text is sent to Google's Gemini AI to read the booking, with the links, email addresses, phone and card numbers, booking codes and names that Loomo can recognise taken out. Names are only recognised in greetings and on lines labelled with a passenger, guest or other name, so a name elsewhere, for example in a table, can still be sent. Booking text you paste or share to Loomo is cleaned the same way. A screenshot or PDF you hand to Loomo yourself is sent to Gemini as it is and is not stored; only what it finds is kept.
• Supported PDF email attachments are read locally; only their cleaned text is sent to Gemini after consent. Original email attachments are not uploaded or stored.
• On your device only: maps you download for offline use stay in your browser until you delete them, and a copy of your saved places list stays until you sign out. Deleting your account removes both from that device.
• Reports you send about a shared trip or a published route: the reason and any note you add, for the person who runs Loomo to review. They are deleted with your account.
• The Loomo AI notice: when you tapped Got it on the one-time line that says Loomo AI is powered by Google Gemini, so it isn’t shown again. Until you do, nothing you type, paste, upload or forward is sent to Gemini. It is kept with your account and deleted with it.

Sharing your live location

If you choose Share live location while recording in the Loomo iPhone app, Loomo stores your position, distance, time, speed, the route you are following and, if the app sends it, your phone’s battery level, and shows them on a private web page to anyone you give the link to, without them needing an account. The page never shows the first 200 m from where you started (nor the last 200 m once you finish), and it isn’t listed in search engines. You can stop or revoke the link at any time; it stops working a day after you stop, or when it expires. Your positions are deleted 7 days after the share ends, or straight away with your account, and are included in your data export until then.

Friend Locator

If you start a Friend Locator in the Loomo iPhone or Apple Watch app, or accept a friend’s invite to one, Loomo stores who is in it, the route name if there is one, the pings you send and receive with any answer, and your latest position (coordinates, accuracy, direction, speed and time). Only the other people who accepted the same locator see your position, and nobody else: not people who were invited but haven’t accepted, not anyone you have blocked or who has blocked you, and not Loomo’s public pages. Only mutual friends can be invited. Loomo keeps just your latest position, never a track, and never writes it to its logs. It is deleted as soon as you stop sharing, leave or are removed, or the locator ends, which happens when its owner ends it, when nobody is sharing any more, when the activity it was started for ends, after 30 minutes without positions, or 12 hours after it started at the latest. Everything else about the locator is deleted 24 hours after it ends, or straight away with your account, and is included in your data export until then.

When there’s no cellular or Wi-Fi signal, the app can keep a locator going over Bluetooth with members close by (usually 30–100 m). Positions then go directly between the phones of the locator’s accepted members, encrypted with a key only they get, and never reach Loomo’s servers. To make that work, Loomo gives each accepted member that key while the locator is active, and your iPhone keeps who is in your current locator (no positions) until it ends.

Community map density

Only activities you deliberately make Public and post can contribute to Loomo’s community density map. Before counting anything, Loomo removes the first and last 200 m of every eligible activity, applies blocks, moderation hiding and account deactivation, and requires at least five distinct members in the same coarse map cell. The phone receives only a blurred raster image with no names, account numbers, individual tracks, start or end positions, or cells below that threshold. Changing the activity to Private or Friends, removing its post, deleting it, blocking another member, or account moderation removes its future contribution after the private cache window of up to one minute.

Apple Watch and Apple Health

This only applies if you use the Loomo iPhone app or its Apple Watch app, and only after you allow it in iOS. Loomo never uses workout or health data for advertising, never sells it or shares it with anyone, and never sends it to Loomo AI (Google Gemini).

• What Loomo reads: on Apple Watch, your heart rate and distance during a hike, ride or run, to show them while you go. On iPhone, when you choose Import from Apple Health, your hiking, cycling and running workouts from the last 30 days and the route of the one you pick; and while you record with the iPhone app, your Apple Watch’s live heart rate.
• What Loomo writes to Apple Health: each workout you finish on the watch and, while "Save to Apple Health" is on, each activity you record with the iPhone app (its type, times, distance and route).
• What Loomo keeps: the activities you import or record, as described above, with a heart rate only for those recorded on iPhone while your watch was connected; the summary the watch sends when you finish (the activity, route name, start and end time, distance, duration and climb), without your heart rate; the identifier Apple Health gives a workout Loomo saved or imported; the route you last sent to the watch; and a scrambled form of the token the watch signs in with.
• How to delete it: deleting an activity in Trails deletes its track and heart rate. Disconnect under Settings → Linked apps in the iPhone app stops the watch from reaching your account. Deleting your account deletes all of it, including the watch’s summaries; email hello@loomo.cc to have those removed sooner. What Loomo saved to Apple Health stays there until you delete it in the Health app.

Signing in with Google or Apple

If you choose "Continue with Google", Google tells us your name, your email address, and whether that address is verified. We use that to create or find your Loomo account, and we store the identifier Google uses for you so we recognise you next time you sign in.

We only ask Google for the basic "openid email profile" permissions. We never receive your Google password, we do not import your Google profile photo, and we have no access to your Gmail, Drive, Calendar, contacts, or any other Google service.

If you choose "Sign in with Apple", Apple tells us your name (the first time only), your email address or the private relay address Apple creates for you, and the identifier Apple uses for you. We store that identifier and the token Apple gives us so we can tell Apple to disconnect Loomo when you delete your account. Nothing else from your Apple ID reaches us.

Cookies and local storage

Loomo uses only what it needs to work. There are no advertising or analytics cookies and no tracking pixels.

• A sign-in cookie that keeps you signed in for 30 days. It is marked HttpOnly and is not readable by scripts.
• While 2-step verification asks for your code, a cookie that lasts 10 minutes ties the code to the sign-in you started.
• If you tick "Remember this device" when 2-step verification asks for a code, a second cookie marks this browser as trusted so it is not asked again. It stays until you change or reset your password, turn 2-step verification off, or clear your browser’s cookies.
• An accountant who opens a link you send gets a cookie that lasts 2 hours once they enter the emailed code, so they can download the documents without entering it again.
• Your preferences in the browser’s storage: theme, language, the last map view, a few Trails screen settings (such as the tab you last used and your Start and route builder choices), which hints you have already seen and, for the open tab only, whether the opening animation has played. Which notifications you have read is kept with your account instead (see above).
• Maps you download for offline use in the browser’s storage on that device and, once you have downloaded one, the files the Trails map needs to open without a connection.
• A short-lived cookie while you sign in with Google or Apple, so the sign-in that comes back is the one you started.
• Paddle’s checkout sets its own cookies, under Paddle’s privacy policy (paddle.com/legal/privacy), only when you open the checkout from Settings → Membership. Cloudflare’s Turnstile bot check runs on the sign-up form only.

Payments

In the iPhone app, Apple processes confirmed In-App Purchases under its own terms and privacy policy; Loomo does not receive your card details. We verify Apple-signed purchase and renewal evidence and store purchase identifiers, product, environment, ownership, dates and refund or renewal status so access can be restored and coordinated with web membership. Financial purchase records and original purchase-token associations remain after account deletion to handle refunds, prevent duplicate claims and verify a later purchase-only restore. Deleted trips, photos and profile data are not restored.

On the web, Loomo Plus is sold through Paddle (Paddle.com Market Ltd and its affiliates), our merchant of record. When you buy a membership, Paddle collects your payment details, billing address and any tax information directly, under its own privacy policy; Loomo never sees your card number. Paddle tells us that your account paid, and we store only the plan you chose, when it renews or ends, and the identifiers Paddle uses for your customer record and subscription so we can recognise renewals, cancellations and refunds. We also keep the record of each payment event Paddle sends us (Paddle’s identifiers, Loomo’s internal number for your account, the plan and the amounts — never your card details) as part of our accounting records, including after your account is deleted. If Paddle can’t be reached to cancel a running subscription when you delete your account, the subscription’s identifier is kept with those records so we can cancel it by hand.

How we use it

Solely to run Loomo for you: showing your trips, calculating costs and estimates, and looking up weather or location details you ask for. We don't use your trip data for advertising, and we don't use it to train AI models.

Where your data is stored and who processes it

Loomo runs on Cloudflare’s global network (Workers, the D1 database and R2 file storage), and the person operating it is in the United States, so your data is processed there. We share the minimum needed with the services that power specific features; none of them receives your account details except as described here.

• Cloudflare: hosting, database and file storage, routing the booking emails you forward to us, and the Turnstile bot check at sign-up.
• Resend: sends our emails (verification, password reset, sign-in and security codes, invitations, reminders, and the links you send to an accountant). It receives the address each email goes to, yours or the one you send to, and the message.
• Google Gemini API: the AI features, used only after you tap Got it on the one-time line in the AI window that says Loomo AI is powered by Google Gemini. It receives what you type or dictate to the trip companion, to Loomo Search and when you ask for an AI route, a redacted version of booking emails and of booking text you paste, and the screenshots or PDFs you hand to Loomo. For Loomo Search it also receives a list of what you might be looking for, so it can pick the matches: the names, places and dates of the trips you can see (yours and those shared with you) and of their stops, with places as they were entered, which can include a street address; your checklist items; and the names, categories and dates of your Budgetino bills and tax records. It never receives notes, confirmation numbers or amounts. Precise GPS positions are not sent. We use the paid API, under which Google does not use these prompts to improve its models.
• Google and Apple: only when you sign in with them, as described above.
• Apple and Paddle: payments, as described under Payments.
• Open-Meteo: weather forecasts, time zones, place lookup and temperature map samples. It receives only a place name, coordinates, or the coarse bounds of a requested map tile, without your account details.
• NOAA / National Weather Service and NIFC WFIGS: U.S. precipitation, snow and active-fire map data. Loomo’s server requests only the coarse bounds of a map tile, without your account details or an individual activity track.
• OpenStreetMap’s Nominatim service: turns a position into a place name, for your position rounded to about 100 m when you press "use my location", for the places an AI route suggests, and for an activity’s area name (one point from the middle of the activity, rounded to about 1 km, never its start or end and never within 1 km of a privacy zone). It receives coordinates only.
• Amazon Web Services Open Data: basic elevation tiles for the Trails map are loaded by your browser directly from AWS; Loomo’s server also fetches the same open Terrarium tiles to derive slope and smoother terrain tiles. AWS receives only tile requests, without your Loomo account details.
• USGS PAD-US: public-land boundaries are built into Loomo’s map archive in advance, so opening that layer sends nothing about you to USGS.
• US National Park Service API: park boundaries, alerts and campgrounds. It receives park codes only; park photos are loaded by your browser from nps.gov directly.
• Wikimedia Commons: photos of a place you drop a pin on in the Loomo iPhone app’s map. Loomo’s server asks Commons for photos near the pin, rounded to about 100 m, without any account details; the photos themselves are loaded by your phone from Wikimedia directly, and each shows its author and licence.
• Park routes (ready-made routes in Trails → Discover and the Loomo app): built in advance from open data (OpenStreetMap, the US National Park Service, Wikidata, Wikimedia Commons, USGS PAD-US and EEA Natura 2000), so opening one sends nothing about you to those services; their photos are loaded by your browser or phone from Wikimedia or nps.gov directly. Members’ photos appear on a park route only from activities their owners made Public and posted that walked that route; photo locations aren’t kept, so they aren’t placed on the map.
• Park route live usage and Conditions: while you record or follow a park route, the Loomo app sends an anonymous heartbeat about every 2 minutes with only the route, a coarse progress quarter and the activity, never your position. Loomo stores it under a digest that changes every day, not your account, deletes it after about 30 minutes, and only ever shows a rounded count from 5–10 minutes earlier, and only once at least 3 people are on the route (“A few people recently” below that). Turn it off in the app’s Settings → Live route usage. Conditions posts you write are shown with your name to members on that route, fade after 7 days and are hidden after 30, can be reported and moderated, are in your data export and are deleted with your account.
• Mapillary (Meta): Trail View street-level photos on park routes, when it’s turned on. Loomo’s server asks Mapillary for photos along the route itself, never with your position or account details; the photos are loaded by your browser or phone from Mapillary directly, and each shows its author and licence.
• Voice input is not a Loomo service: when you use the microphone button, your browser or phone turns what you say into text with its own speech recognition (Google’s in Chrome, Apple’s in Safari and in the Loomo iPhone app), under its maker’s privacy terms. Loomo only receives the text.

How long we keep it

Active accounts and their trips are kept until you delete them. The rest has a clock:

Apple sign-in security: verified account changes can sign you out without deleting your Loomo account or its data. Sensitive details in completed account-change receipts are scheduled for removal after 90 days; account-linked sign-in and forwarding preferences remain while the account exists. Minimal hashed revocation proofs, containing no raw Apple identifier or email, are scheduled for removal 90 days after receipt and may remain for that period if you delete your Loomo account. They prevent an old Apple credential from recreating access.

• Sign-in sessions: 30 days, or until you sign out.
• Approximate sign-in regions: 90 days.
• Guest sessions and their trips: 30 days.
• Accounts whose email address is never verified: 30 days, with reminder emails 7 days and 1 day before.
• Bookings found in forwarded emails: 30 days after you handle them, 60 days if you never do.
• Trip invitations, with the email address or phone number invited: 30 days after they are accepted or run out.
• Which notifications you have read: 180 days.
• Counters that limit repeated requests (sign-in attempts, emailed codes, invitations, daily and monthly allowances) and the record of which reminder emails went out: deleted in the daily clean-up once they run out, which is after minutes for most and a year at most. They hold an internal account number or a one-way scrambled form of a network or email address, never the address itself.
• Service logs: Cloudflare keeps the short status and error messages Loomo writes, which can include an internal account number but not the addresses you open or where you are, for up to 7 days.
• Backups: anything deleted can remain for up to 30 days in the database’s automatic backups, which exist only to recover from a fault, and is then gone for good.
• Billing identifiers on your account: until the account is deleted. Financial purchase and event records from Apple and Paddle, including original Apple purchase-token associations: kept after deletion for accounting, refund handling and verified purchase-only restoration. Paddle, as the seller, keeps its own invoices and tax records for as long as the law requires it to.

Your rights and choices

Wherever you live, you can see and correct what Loomo holds by opening it in the app, and you can download a copy of your data yourself at any time: Settings → Security & privacy → Download your data gives you a JSON file with your account details, trips, budgets, saved places, routes, route ratings, activity list, Apple Watch summaries, security settings and the bookings found in forwarded emails (up to 3 downloads an hour). Attachments, tax documents and GPS tracks are downloadable from where they live in the app, and the file lists the path to each. You can also delete your account yourself under Settings → Security & privacy → Delete account; that removes your account and everything it owns right away (the database’s backups can keep a copy for up to 30 days, as described above).

For anything the download does not cover, or to object to how we use your data, email hello@loomo.cc and we will answer within 30 days. We don't sell personal data and never have.

If you are in the EU, the UK or another place with a general data-protection law: we process your data to perform our contract with you (running Loomo) and, for security and abuse prevention, on the basis of our legitimate interests. You may ask for access, correction, deletion, portability or restriction, object to processing, and complain to your local data-protection authority.

Children

Loomo is not for children. You must be at least 18 to use Loomo or create an account. We don't knowingly collect personal data from anyone under 18; if we learn that we have, we delete it. If you believe a child has an account, email hello@loomo.cc.

Changes to this notice and contact

If we change this notice meaningfully, we will update the date at the top of this page and, for changes that affect you materially, tell you in the app or by email before they take effect. Questions and requests: hello@loomo.cc.