The fine print, in plain words.

Loomii is an anonymous-messaging app and website (www.loomii.link) operated by JKNEETU SON ENTERPRISES. For this policy, Loomii is the “data fiduciary” for the personal data described below. You can reach us, including our grievance contact, at loomii.appsupport@gmail.com.

Loomii has no email, phone number, password or social login. When you open the app, it creates a random device token and keeps it in your phone's secure storage. Our server stores only a one-way hash of that token and uses it to recognise your device. If you delete the app, your profile cannot be recovered, so delete your account first if you no longer want it.

Your profile (app users): username, optional profile photo (resized on your phone before upload), your question prompt and chosen template, which platforms you share to (Instagram, Snapchat or WhatsApp), hidden words and filter settings, whether your link is paused, templates you unlocked, coin balance, the date you confirmed you are 18 or over, and the phone platform and app version tied to your device token. We do not store your birth month or year.

Messages sent to you: the message text, the template and prompt it answered, when it was sent, whether it was filtered, and hint details (where the sender found your link, their device type such as “iPhone”, and an approximate city and country from their network).

People who send messages or take a quiz (no account needed): the message or quiz answers, the name they type for a quiz, and two keyed hashes — one of a random browser cookie and one of their IP address. The hashes cannot be turned back into the cookie or IP address and are used only to block senders, stop spam and enforce bans.

Coins and purchases: your coin history (earned, spent, bought) and, for Google Play purchases, the product, order ID and purchase token Google gives us so we can verify the payment. We never see or store card, UPI or bank details — Google Play handles the payment.

Reports, blocks and moderation: the reason and details you give, a copy of the reported message, and the sender's keyed hashes.

Support, feedback and bug reports: your topic and message, and only if you choose to give them, your email, a username the request is about, your platform and app version. We also keep a keyed hash of your IP address to stop form spam.

Loomii Daily (app users): your Daily setting, which Loomii Daily questions we scheduled for you and when they arrived, and whether you unlocked a question's clues. These questions are written by Loomii. We pick them using only your setting, your hidden words and the questions you already had — never your messages, contacts or location.

Usage analytics (optional): on the website, only if you allow it, Google Analytics records the pages you visit and basic browser and device details under a random cookie ID; it never runs on profile links. In the app, unless you turn it off, we send Google Analytics a short list of events — screens opened and features used, such as sharing, hints, Loomii Daily and coin purchases — with a keyed pseudonymous ID. The app never sends Google your messages, username, device token or IP address.

No name (unless you type one into a quiz), email (unless you give it to support), phone number, contacts, exact GPS location, camera or microphone access, advertising ID, or your other social-media accounts. Loomii has no ads, no advertising or tracking SDKs, and push notifications only say that a new message arrived (you can turn them off); the optional usage analytics above is the only measurement we do. We do not sell personal data or use messages for advertising or to train AI models.

• Running your public link, delivering messages and showing your inbox.
• Showing hints only after you choose to unlock them with coins.
• Running the quiz scoreboard and templates you unlocked.
• Scheduling Loomii Daily questions at spread-out times and not repeating them.
• Verifying Google Play purchases and adding coins exactly once.
• Keeping Loomii safe: filtering abusive words, rate limits, blocks, bans, and reviewing reports.
• Understanding, in aggregate, which pages and features people use, so we can improve them (optional analytics).
• Answering support, privacy and safety requests, and fixing bugs you report.
• Meeting legal duties, such as responding to lawful requests and reporting child sexual abuse material.

Senders are anonymous to you. A sender is told, before sending, that the recipient may unlock hints. Hints never show a name, IP address, exact location or cookie. Anonymous does not mean untraceable: we can act on keyed hashes to block or ban a sender, and we may share what we hold with authorities when the law requires it.

Loomii Daily questions are different: Loomii writes them, the app always labels them “Loomii Daily”, they have no sender, and their clues are playful prompts made up by Loomii that never point to a real person.

We process your data on the basis of your consent when you create a profile, send a message or buy coins, and for legitimate uses the law allows, such as preventing fraud and complying with legal duties. Website analytics runs only if you allow it, and you can change that on our cookie policy page; app analytics and Loomii Daily can be switched off in Settings → Privacy & safety. You can withdraw consent at any time by deleting your account (for your profile) or asking us to delete a message or support request. Withdrawing does not affect processing already done, and some safety records are kept as described below.

We use a small set of processors, bound by their terms, to run Loomii:

• Vercel — hosts the website and API (Singapore region). It sees request data such as IP addresses and keeps short-lived logs under its own policy.
• Neon — our Postgres database (Singapore region), where everything above is stored.
• Google Play — processes coin purchases made through Google Play. Google's privacy policy covers what it collects.
• Google Analytics and Firebase Analytics (Google) — measure website visits (only with your consent) and app usage events (unless you turn them off). Google signals, ad personalisation and Advertising ID collection are off.
• Firebase Cloud Messaging (Google) — delivers the “you got a new message” notification to your phone. It receives only your phone's notification token and that fixed sentence — never the message, the sender or your username. Turn it off in Settings → Privacy & safety → New message alerts.
• Gmail (Google) — if you email us, your email is handled in our support inbox.

When you share to Instagram, Snapchat or WhatsApp, the app hands the image to that app on your phone; we do not send your data to them. We share data with police or courts only when Indian law requires it, and we report child sexual abuse material to the appropriate authorities.

Our database and servers are in Singapore. Data may be processed outside India by the providers above, subject to any restrictions notified under the Digital Personal Data Protection Act, 2023.

• Profile, messages, quiz, coins and purchase records: until you delete them or your account. Account deletion is immediate.
• Quiz attempts: until the quiz owner removes them, replaces the quiz, or deletes their account.
• Blocks: until you remove them or delete your account; timed blocks and bans end when they expire.
• Reports: until reviewed, then up to 12 months, even if the account involved is deleted.
• Support, feedback and bug reports: up to 12 months.
• Loomii Daily delivery history: 120 days, only to avoid repeating questions (deleted with your account).
• Rate-limit counters: up to 2 days.
• Visitor cookie in your browser: up to 12 months, or until you clear it.
• Analytics: website analytics cookies expire after 13 months; Google Analytics keeps event data for our chosen retention period, at most 14 months.

All traffic uses HTTPS. Device tokens are stored only as hashes; sender and IP identifiers are keyed hashes; purchase verification and secrets stay on the server. Database access is limited to the Loomii operator. No system is perfect, so please keep your phone locked.

If a personal data breach happens, we will contain it, investigate, and notify affected users and the Data Protection Board of India as the DPDP Act and its rules require, telling you what happened and what you can do.

• Access: Settings → Privacy & safety → Copy my data exports your data.
• Correct: change your username, photo, prompt and settings in the app at any time.
• Erase: delete single messages, quiz results, or your whole account in the app, or use www.loomii.link/delete-data.
• Control: pause your link, block senders, add hidden words, filter mean language, and turn Loomii Daily or app analytics off.
• Nominate: you may name someone to exercise these rights if you die or become unable to — email us.
• Grievance: email loomii.appsupport@gmail.com. We aim to reply within 7 days and resolve within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Loomii is only for people aged 18 and over. The app asks for your birth month and year before you create a link and does not let younger users continue. We do not knowingly process children's data; if we learn a profile belongs to someone under 18, we delete it. Tell us via our report page. See our child safety standards.

The website sets one essential cookie, plus Google Analytics cookies only if you allow them. Details are in our cookie policy.

When this policy changes we will post the new version here and update the date above.