Privacy Policy

When you choose Google or GitHub sign-in, that provider shares the basic profile and email information you authorize with Logto, which provides our identity service. This can include a stable account identifier, name, email address, and profile picture. The available fields depend on your provider and authorization. Your provider handles your password; Loom does not ask you to provide it.

Loom uses Google user data only for authentication, maintaining your account, and providing account-related access to Loom services. The current application does not send this data to model services or use it for model training.

Logto processes the sign-in identity and authorization flow. Cloudflare hosts the applications and D1 database. D1 stores account identifiers, names and email addresses when supplied, encrypted session-token state, and order and access records. The application does not store session tokens in browser cookies.

For current test checkouts, Loom sends Creem the order and account identifiers, product information, amount, and currency. Creem hosts checkout in Test mode and processes the information entered there. Historical Stripe Sandbox orders and webhook records are retained for reconciliation, refunds, and access-revocation handling. These providers process information needed to provide their respective services.

The sign-in cookie contains a random session identifier, rather than your profile or tokens. It is Secure, HttpOnly, and SameSite=Lax on HTTPS and is sent to subdomains of .loom-labs.ai for shared sign-in. Those subdomains are part of the same session trust boundary.

A session has an absolute limit of 14 days from successful sign-in. Signing out, revocation, provider failure, or a security check can end access earlier. Temporary sign-in flow cookies last up to 10 minutes. Language and appearance preference cookies can last one year; they contain preference values, not identity or purchase rights.

If you allow optional analytics, Google Analytics uses _ga cookies to distinguish browsers and sessions for up to 180 days; our configuration does not renew that expiry on each visit. Separate LOOM_ANALYTICS_CONSENT and LOOM_ANALYTICS_TEST cookies remember your analytics choice and any browser test exclusion for up to 180 days across .loom-labs.ai. These preferences do not contain your identity or purchase rights. Clearing browser cookies can reset these choices.

Payments currently use Creem Test mode and do not charge real money. Use Creem test payment details. Test order and access records support testing and are separate from live payments.

The available work plan is curated, static reading and planning content. It does not call a model, create files, or perform external actions on your behalf.

Professional Headshot Pack purchases currently record test package entitlements only. Photo upload, generation, and downloads are not available yet.

Loom and its infrastructure providers may process request, error, and security-related technical information to operate and protect the service. These operational records are separate from the optional website analytics described below.

If you allow optional analytics, Loom uses Google Analytics 4 on its public pages to estimate visitor counts and understand page usage. Google receives page paths and hostnames, the referring site's origin, event times, browser and device information, and a pseudonymous browser identifier. Technical information such as your IP address can reach Google when your browser sends these requests. Visitor counts are estimates rather than an exact count of people.

Loom does not load Google Analytics before you opt in. Our implementation removes query strings and fragments from page URLs and sends only the origin of a referring site. It does not send your Loom account identifier, name, email address, sign-in tokens, order details, or payment data to Google Analytics. Profile, receipt, callback, and API routes are excluded. Google signals and advertising personalization are disabled.

Google processes this information as the analytics service provider. Analytics data is retained according to the Google Analytics property settings. Use Analytics settings on a public page to change your choice or exclude this browser from your own tests. Withdrawing permission stops future analytics from this browser and clears its Google Analytics cookies; it does not erase information already collected. Declining analytics does not affect sign-in or purchases.

Signing out revokes the current shared session; it does not delete your account. You can also manage Loom authorization in your Google or GitHub account settings. Provider authorization changes do not themselves delete records held by Loom.

To request account access, correction, or deletion, email boylucky2012@gmail.com. The administrator will need to verify that the account belongs to you before processing the request. Account, order, and security records are handled according to the actual service need and applicable requirements. There is no single automatic deletion mechanism covering all records, and this notice does not promise deletion when a session expires or when you sign out.

This notice should be updated if the service or its data practices change. A new use of Google user data must be disclosed, with any required authorization obtained before that new use. Contact boylucky2012@gmail.com if anything here is unclear.