LOOP ("Loop", "the app") is an Android app made by Arpan Patra, an independent developer in Indore, India ("I", "me"). On Google Play it is listed as "LOOP: Location Tracker". This policy explains what the app and its server handle, why, how long it's kept, and the choices you have.
Loop is built to know as little about you as possible. There is no account with an email or phone number, no advertising, no analytics and no tracking in the background.
1. The short version
- People you approve can ask where you are. You decide each time, or choose to share automatically with someone you trust.
- Your location is end-to-end encrypted on your phone for the one person who asked. The Loop server passes the sealed message on. It can't read it and doesn't keep it.
- Loop doesn't run in the background. It reads your location only at the moment someone you approved asks, sends it once and stops.
- Every time someone sees your location you get a receipt, and your privacy log on your phone lists them all.
- You can delete everything at any time, from the app or by email.
2. What Loop handles, and why
On your phone only (never sent to the server)
- Your birthdate, used to confirm you are 18 or older.
- Your people: the names you saved them under, the last location each person shared with you, and when they last saw yours.
- Your privacy log: a list of who saw your location and when.
- Your keys. Your signing key is kept in your phone's secure hardware (Android Keystore). Your encryption key and your app data are stored encrypted with a Keystore key.
- Crash details, if the app ever crashes. They stay on your phone. If you tap Settings → Send diagnostics, your phone opens Android's share sheet with a short report (device checks and the last crash, no IDs or locations) and you choose whether and where to send it.
On the Loop server
The server runs on Cloudflare. It stores:
| What | Why | How long |
|---|---|---|
| Your Loop ID, stored only as a one-way hash, and your public keys | So the people you connect with can reach you and encrypt locations that only you can read | Until you delete your Loop |
| Your display name (the name you chose in the app) | So people who have your Loop ID or invite link can check they're adding the right person, and so your contacts see your current name | Until you change it or delete your Loop |
| Your push token from Google Firebase Cloud Messaging | So the server can wake your phone when someone asks | Until you delete your Loop or the token changes |
| Your connections: pairs of hashed IDs, the sharing choice for each person (Ask me, Share automatically or Paused), and whether you paused all sharing | To check that only people you approved can ask, and to respect your choices | Until you or they remove the connection, or you delete your Loop |
| The day you last used Loop (the date, not the time) and when your Loop was created | To keep the service running and clean up | Until you delete your Loop |
| Location requests: who asked whom, when, and whether it was answered (no location) | To deliver the request and the answer | 5 minutes |
| Pending contact requests and invite links (an invite link is stored only as a hash) | So someone can accept your request or join through your link | 7 days |
| One-time request codes | To block replayed requests | 10 minutes |
| Abuse counters, for example how many requests an ID or a network sent recently. A network is identified only by a keyed hash of its IP address; the IP address itself is never stored | To stop floods of requests and fake sign-ups | Until the counter's time window ends (at most an hour), then deleted by a daily clean-up |
| If you made a backup: the public half of a single-use recovery key | So your backup can move your Loop to a new phone | Until the backup is used or replaced |
Passing through the server without being stored
- Your location and battery level. When you share, your phone encrypts them for the person who asked (P-256 key agreement with AES-256-GCM). The server and Google's push service only carry the sealed message. Neither can read it, and neither the server nor I keep a copy.
- SOS alerts. When you send an SOS, your phone seals your location separately for each of your people, and the server forwards each sealed copy at the highest priority. Nothing is stored.
- Your name, when you change it, is passed on to your contacts so their app can show it.
What Loop never collects
Your phone number, email address, phone contacts, photos, messages, advertising ID, or any history of where you've been.
What other people's phones keep
When you share your location with someone, their phone keeps the last location you sent so they can see it on their map. It is removed from their phone when either of you removes the other, or when you delete your Loop.
3. Location permission
Loop asks for location access so it can answer when someone you approved asks where you are, and to show your own position on the map. By default it uses location only while you're using the app: you tap "Share once" on a request.
If you choose "Always" (share automatically) for a person, Loop first explains what that means and then asks Android for "Allow all the time", so it can answer that person even when the app is closed. Even then it takes a single reading only at the moment they ask, never continuously, and you get a receipt every time. You can switch anyone back to "Ask me", pause all sharing, or turn off location access in your phone's settings at any time.
Loop also asks for notification permission, so you see requests and receipts.
4. Services that help run Loop
| Service | What it does for Loop | What it receives |
|---|---|---|
| Cloudflare (Workers and D1 database) | Runs the Loop server and stores the records in section 2 | The data in section 2. Like any web host, it sees the IP address your phone connects from in order to deliver the service. Server logs are kept for a few days, contain no locations and no IDs |
| Google Firebase Cloud Messaging | Delivers wake-up messages to your phone | Your push token, a Firebase installation ID, and sealed messages it can't read |
| Google Play services | Provides the location reading on your phone | Location signals (GPS, Wi-Fi, mobile network) under Google's own privacy policy |
| OpenFreeMap | Serves the map | When you view the map, your phone downloads map images from it, which shows its servers your IP address and the area you're looking at |
I don't sell, rent or trade your information, I don't use it for advertising, and I don't share it with anyone else, unless the law requires me to. Even then, I can only hand over what's in section 2: there are no locations to give.
5. How long things are kept
Each record is kept for the time shown in the table in section 2. A daily clean-up deletes everything that has expired. Your server record stays until you delete your Loop. Data on your phone stays until you delete your Loop, clear the app's data, or uninstall it. A backup file you made stays wherever you saved it until you delete it; it is encrypted with a passphrase only you know.
6. Your choices and rights
- See and correct: your name is in Settings → Edit profile; your people, their sharing choices and your privacy log are in the app.
- Control sharing: for each person choose Ask me, Share automatically or Paused; pause all sharing; block or remove anyone; turn off "Share battery level".
- Delete: see the next section.
- Ask me: you can email me to ask what data relates to your Loop ID, to correct it, to delete it, or to withdraw your consent. Under India's Digital Personal Data Protection Act, 2023, you also have the right to nominate someone to exercise these rights for you, and to complain to the Data Protection Board of India if you're unhappy with my answer. If you are in another country, you have the rights its law gives you, and I will honour them.
7. Delete your data
From the app (fastest). Open LOOP → tap your picture on the map to open Settings → Delete my Loop → Delete. This immediately deletes your server record (hashed ID, public keys, name, push token), your connections, pending requests, invite links and backup key, tells your people that you've left, and wipes the app's data and keys from your phone.
Without the app or phone. Email thispc119@gmail.com with the subject "Delete my Loop" and your Loop ID (it looks like K7QM-4XRT-9PZW; you'll find it on the map screen and in Settings). I'll delete the server record for that ID and everything linked to it within 7 days and reply to confirm. I may ask you to confirm the request.
What remains. Nothing linked to you. Abuse counters and short-lived records expire on their own within a day, and server logs within a few days; none of them contain locations. Locations and battery levels are never stored, so there's nothing to delete there. A backup file you saved is yours to delete.
8. Children
Loop is only for people aged 18 and over. The app checks your age when you set it up, and your birthdate stays on your phone. If you believe someone under 18 is using Loop, email me and I'll delete their data.
9. Security
Locations are end-to-end encrypted. Every request your phone makes to the server is signed with a key held in your phone's secure hardware, protected against replay, and sent over HTTPS. Data on your phone is encrypted. Backups are encrypted with your passphrase (PBKDF2 and AES-256-GCM) and can be used only once. No system is perfectly secure, but Loop is built so that the server holds as little as possible. If I learn of a breach that affects you, I'll tell you and the authorities as the law requires.
10. Where data is processed
The Loop database is hosted in Cloudflare's Asia-Pacific region, and Cloudflare's network serves requests from the data centre nearest to you. Google may process push messages and location signals in other countries under its own safeguards.
11. Changes to this policy
If this policy changes, I'll update the effective date above. For important changes, I'll also tell you in the app before they take effect.
12. Contact and grievances
Arpan Patra (developer and grievance officer), Indore, Madhya Pradesh, India. Email: thispc119@gmail.com. Please include your Loop ID if your question is about your data. I aim to reply within 7 days and to resolve any grievance within 30 days.