The fine print, in plain words.

Loomii is an anonymous-messaging app and website (loomii.link) operated by JKSON-LOOMII(INDIA). For this policy, Loomii is the “data fiduciary” for the personal data described below. You can reach us, including our grievance contact, at loomii.appsupport@gmail.com.

Loomii has no email, phone number, password or social login. When you open the app, it creates a random device token and keeps it in your phone's secure storage. Our server stores only a one-way hash of that token and uses it to recognise your device. If you delete the app, your profile cannot be recovered, so delete your account first if you no longer want it.

Your profile (app users): username, optional profile photo (resized on your phone before upload), your question prompt and chosen template, which platforms you share to (Instagram, Snapchat or WhatsApp), hidden words and filter settings, whether your link is paused, templates you unlocked, coin balance, the date you confirmed you are 18 or over, and the phone platform and app version tied to your device token. We do not store your birth month or year.

Messages sent to you: the message text, the template and prompt it answered, when it was sent, whether it was filtered, and hint details (where the sender found your link, their device type such as “iPhone”, and an approximate city and country from their network).

People who send messages or take a quiz (no account needed): the message or quiz answers, the name they type for a quiz, and two keyed hashes — one of a random browser cookie and one of their IP address. The hashes cannot be turned back into the cookie or IP address and are used only to block senders, stop spam and enforce bans.

Coins and purchases: your coin history (earned, spent, bought) and, for Google Play purchases, the product, order ID and purchase token Google gives us so we can verify the payment. We never see or store card, UPI or bank details — Google Play handles payment.

Reports, blocks and moderation: the reason and details you give, a copy of the reported message, and the sender's keyed hashes.

Support, feedback and bug reports: your topic and message, and only if you choose to give them, your email, a username the request is about, your platform and app version. We also keep a keyed hash of your IP address to stop form spam.

No name (unless you type one into a quiz), email (unless you give it to support), phone number, contacts, exact GPS location, camera or microphone access, advertising ID, or your other social-media accounts. Loomii has no ads, no analytics or tracking SDKs, and no push notifications. We do not sell personal data or use messages for advertising or to train AI models.

• Running your public link, delivering messages and showing your inbox.
• Showing hints only after you choose to unlock them with coins.
• Running the quiz scoreboard and templates you unlocked.
• Verifying Google Play purchases and adding coins exactly once.
• Keeping Loomii safe: filtering abusive words, rate limits, blocks, bans, and reviewing reports.
• Answering support, privacy and safety requests, and fixing bugs you report.
• Meeting legal duties, such as responding to lawful requests and reporting child sexual abuse material.

Senders are anonymous to you. A sender is told, before sending, that the recipient may unlock hints. Hints never show a name, IP address, exact location or cookie. Anonymous does not mean untraceable: we can act on keyed hashes to block or ban a sender, and we may share what we hold with authorities when the law requires it.

We process your data on the basis of your consent when you create a profile, send a message or buy coins, and for legitimate uses the law allows, such as preventing fraud and complying with legal duties. You can withdraw consent at any time by deleting your account (for your profile) or asking us to delete a message or support request. Withdrawing does not affect processing already done, and some safety records are kept as described below.

We use a small set of processors, bound by their terms, to run Loomii:

• Vercel — hosts the website and API (Singapore region). It sees request data such as IP addresses and keeps short-lived logs under its own policy.
• Neon — our Postgres database (Singapore region), where everything above is stored.
• Google Play — processes coin purchases. Google's privacy policy covers what it collects.
• Gmail (Google) — if you email us, your email is handled in our support inbox.

When you share to Instagram, Snapchat or WhatsApp, the app hands the image to that app on your phone; we do not send your data to them. We share data with police or courts only when Indian law requires it, and we report child sexual abuse material to the appropriate authorities.

Our database and servers are in Singapore. Data may be processed outside India by the providers above, subject to any restrictions notified under the Digital Personal Data Protection Act, 2023.

• Profile, messages, quiz, coins and purchase records: until you delete them or your account. Account deletion is immediate.
• Quiz attempts: until the quiz owner removes them, replaces the quiz, or deletes their account.
• Blocks: until you remove them or delete your account; timed blocks and bans end when they expire.
• Reports: until reviewed, then up to 12 months, even if the account involved is deleted.
• Support, feedback and bug reports: up to 12 months.
• Rate-limit counters: up to 2 days.
• Visitor cookie in your browser: up to 12 months, or until you clear it.

All traffic uses HTTPS. Device tokens are stored only as hashes; sender and IP identifiers are keyed hashes; purchase verification and secrets stay on the server. Database access is limited to the Loomii operator. No system is perfect, so please keep your phone locked.

If a personal data breach happens, we will contain it, investigate, and notify affected users and the Data Protection Board of India as the DPDP Act and its rules require, telling you what happened and what you can do.

• Access: Settings → Privacy & safety → Copy my data exports your data.
• Correct: change your username, photo, prompt and settings in the app at any time.
• Erase: delete single messages, quiz results, or your whole account in the app, or use loomii.link/delete-data.
• Control: pause your link, block senders, add hidden words and filter mean language.
• Nominate: you may name someone to exercise these rights if you die or become unable to — email us.
• Grievance: email loomii.appsupport@gmail.com. We aim to reply within 7 days and resolve within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Loomii is only for people aged 18 and over. The app asks for your birth month and year before you create a link and does not let younger users continue. We do not knowingly process children's data; if we learn a profile belongs to someone under 18, we delete it. Tell us via our report page. See our child safety standards.

The website sets one essential cookie. There are no analytics or advertising cookies. Details are in our cookie policy.

When this policy changes we will post the new version here and update the date above.