Privacy policy
Loopea is a habit tracking application. It works with the strict minimum of personal data: what is needed to identify you, and the content you create in it yourself. No data is sold, rented or used for advertising.
The essentials in five points
- Your database is in Paris. The site is served by Vercel (United States) and the AI coach, if you use it, sends some of your data to Anthropic (United States).
- No advertising trackers or third-party tools, no embedded social networks. Only an in-house, anonymous audience count of the visits to the public pages.
- No resale, no advertising, no sharing for commercial purposes.
- You can delete your account and all its content at any time, from the settings.
- No profiling, no automated decision concerning you.
1. Who is responsible for your data
The data controller is Eloan Da Silva Gentet EI, publisher of Loopea. Full contact details are in the legal notice. For any question about your data, write to contact@eloandsg.com.
Given the size of the structure and the nature of the processing, no data protection officer (DPO) has been appointed: appointing one is not mandatory here under article 37 of the GDPR.
2. What data, why, and for how long
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address and password | Create your account and authenticate you | Performance of the contract (art. 6.1.b) | For the lifetime of the account |
| Display first name or nickname | Address you in the application | Performance of the contract | For the lifetime of the account |
| Profile photo (optional) | Personalize your space and your recap card | Consent (art. 6.1.a), data you choose to add | Until you delete it or the account is deleted |
| Personal goal (optional) | Show the goal you set yourself in your settings and, if you use the AI coach, personalize its replies | Consent, optional free-text field | Until you delete it or the account is deleted |
| "Your context" (optional): areas, goals, situation, rhythm, obstacles, review frequency | Suggest habits that suit you and, if you use the AI coach, personalize its replies. Depending on your choices, these answers may hint at health information (stress, fatigue, consumption...) | Consent, optional answers that you can edit or delete at any time in the settings | Until you delete them or the account is deleted |
| Habits, frequencies, pause periods | Provide the service: this is the very content of the application | Performance of the contract | For the lifetime of the account |
| Check-in history (date and habit) | Calculate your streaks, your consistency and your recap | Performance of the contract | For the lifetime of the account |
| Display preferences (theme, color) | Show the interface as you set it | Performance of the contract | 1 year, renewed at each visit |
| Referral code and link to a referrer | Let a member share Loopea and see how many accounts came through their link, without ever seeing which ones | Legitimate interest (art. 6.1.f) in making the service known, with no identity data exchanged | For the lifetime of the account. The link disappears if the referrer's account is deleted |
| Push notification subscription (optional) | Send you the daily reminder you turned on | Consent, which you can withdraw at any time in the settings | Until you turn reminders off |
| Messages sent to the AI coach (Premium), with your first name, your context, your personal goal and a summary of your habits over the last 30 days (names, categories, numeric targets, streaks, consistency, vacation mode) | Generate the coach's reply | Performance of the contract, on a feature that you open yourself | Not kept by Loopea after the reply is sent |
| Number of messages sent to the AI coach per day (Premium, without their content) | Apply the daily usage limit of the coach | Performance of the contract | 7 days (purged the next time you use the coach, or when the account is deleted) |
| Sign-in sessions (IP address, browser, dates) | Show you your connected devices in the settings and secure your account | Performance of the contract and legitimate interest (art. 6.1.f) in securing accounts | As long as the session is open, then deleted with it |
| Administration data: email address, first name, creation and sign-in dates, aggregated usage statistics | Support, security, abuse prevention and monitoring of the use of the service by the publisher | Legitimate interest (art. 6.1.f) in running a reliable service | For the lifetime of the account |
| Audience measurement of the public pages (page view, referring site, device, country and region, clicks, scrolling), with no IP and no cookie, never linked to an account | Know how many people discover Loopea and improve the home page | Legitimate interest (art. 6.1.f), within the CNIL's consent exemption for audience measurement. You can refuse on the Cookies page | 25 months, visitor identifier renewed after 13 months at the latest |
| Technical logs (IP address, timestamp) | Security of the service and troubleshooting | Legitimate interest (art. 6.1.f) in keeping a reliable service | 30 days at most, by the host |
Only the email address and the password are required to open an account. Everything else is optional: you can use Loopea without a photo, without a written goal and without notifications.
Loopea does not ask you for your date of birth, your location, your contacts or any health data. Some goals or habits that you choose yourself (for example around sleep, food or stress) may nevertheless reveal information about your health. Habits and the answers in "Your context" are text that you compose: avoid entering sensitive information within the meaning of article 9 of the GDPR (health, beliefs, sexual orientation), which the service is not designed to process. If you use the AI coach, what you entered is sent to Anthropic to generate its reply.
3. Who has access to this data
The publisher does not read the content of your habits: it only accesses an account's data at your explicit request (support) or in case of proven technical necessity. It does have an administration dashboard (email address, first name, creation and sign-in dates, aggregated usage statistics) for support, security and monitoring of the service. Apart from you and the publisher, only the providers strictly necessary for the service to work have technical access:
| Provider | Role | Data concerned | Location |
|---|---|---|---|
| Supabase Inc. | Hosting of the database and account management | Email address, hashed password, habits, history, profile photo | Database in Paris (eu-west-3 region); US company (Supabase Inc.) |
| Vercel Inc. | Hosting of the website and application servers | Technical connection data (IP address, server logs) and the content of the pages served | Server functions configured in Paris (cdg1); US company, transfers outside the EU are possible |
| Anthropic PBC | Generating the AI coach's replies (Premium accounts only) | First name, "Your context" answers, personal goal, habit names and categories, numeric targets, streaks and consistency, vacation mode, messages sent to the coach | United States |
Vercel, Supabase and Anthropic are US companies. Transfers of data to the United States rely on the European Commission's standard contractual clauses, built into these providers' contracts, and, for those that take part in it, on the Data Privacy Framework. You can obtain a copy by writing to contact@eloandsg.com. The AI coach only concerns Premium accounts: if you never open it, none of your data is sent to Anthropic. Conversations with the coach are not used by the publisher to train any artificial intelligence model.
4. Your rights
The GDPR gives you the following rights, which you can exercise at any time:
- Access: get a copy of the data concerning you.
- Rectification: correct inaccurate data, directly in your settings.
- Erasure: delete your account and all of its content. The button is in Settings; deletion is immediate and final.
- Portability: receive your habits and history in a machine-readable format. The Export my data button is in Settings; the download is immediate, in JSON or CSV.
- Objection and restriction: object to processing based on legitimate interest, or ask for it to be frozen.
- Withdrawal of consent: turn off notifications, remove your photo (Remove photo button in Edit profile) or clear your "Your context" answers, without affecting what was done before.
To exercise these rights, write to contact@eloandsg.com. You get an answer within one month at most (extendable by two months for complex requests, with notice within the first month). You can also ask to be detached from the referrer who invited you. If the answer does not satisfy you, you can lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, France, or at cnil.fr, or with the data protection authority of your country of residence.
5. Security
- All communications are encrypted in transit (HTTPS/TLS).
- Passwords are stored as hashed values, never in plain text.
- Separation between accounts is enforced at the database level itself: technically, a request cannot reach another user's rows.
- Sign-in with a passkey is offered as an alternative to the password.
- A strong password is required at creation and at each change.
6. Minimum age
Loopea is not intended for children under 15. In France, below that age, signing up requires the authorization of a holder of parental authority. Any account reported as belonging to a child under 15 without this authorization is deleted.
7. Deletion and retention
Deleting your account immediately erases your profile, your habits, your history, your pause periods and your photo. As of today, the publisher does not keep an automatic backup of the database: deleted data is therefore no longer present in our systems.
An account left inactive for three consecutive years gets a warning message, then is deleted if no sign-in occurs within the following month.
8. If you live outside France
Loopea applies the GDPR to all of its users, whatever their country of residence: the rights described in article 4 are open to you in every case. Depending on where you live, the following also apply:
- United Kingdom: the same rights under the UK GDPR, with the possibility of a complaint to the Information Commissioner's Office (ICO).
- Switzerland: equivalent rights under the Federal Act on Data Protection (FADP).
- Quebec and Canada: rights of access, rectification and de-indexing under Law 25 and PIPEDA. The person in charge of the protection of personal information is the publisher itself, reachable at the contact address above.
- California and other US states: Loopea does not sell or share your personal information within the meaning of the CCPA/CPRA, and never has. There is therefore no opt-out of sale mechanism to provide, since no sale takes place. No targeted advertising is shown.
Loopea does not adapt its processing according to your country: the protection applied is the same for everyone, aligned with the European standard, which is the most protective of the regimes listed.
9. Changes
Any significant change to this policy is announced in the application before it takes effect. The date of the last update is shown at the bottom of this page.
Last updated: October 14, 2026.