Privacy policy
Last updated 27 August 2026.
Loom is a chat app. You write to a language model, and the app keeps your conversations so they are there when you come back. This page describes everything it stores, everywhere that data goes, and how to get rid of it. It covers the Loom website and the Loom iOS app, which share one account and one backend.
Before submitting to the App Store: set CONTACT_EMAIL in app/legal/privacy/page.tsx. This page is the URL App Store Connect checks, and a policy with no contact address is a rejection.
What Loom stores
Your account
Your email address, the name you chose, and a hash of your password. Loom does not store your password itself and cannot read it. Accounts are handled by Neon Auth and live in the same database as everything else below.
What you write and upload
- Conversations — every message you send and every reply you receive, including the model’s reasoning and any tool calls it made, plus the conversation title, the model you picked and the reasoning effort.
- Summaries — as a conversation grows past its memory window, older messages are folded into a rolling summary so the model keeps context. The summary is stored with the conversation.
- Files — images, PDFs, text files and voice recordings you attach. These are held in private storage (Vercel Blob) and are only served back through an endpoint that checks your session.
- Workflows and their runs — the graphs you build or the model builds for you, and a snapshot of each run.
- Settings — default model, memory window, which tools are on, and which models appear in the composer.
What stays on your device
Unsent drafts, a cache of recent conversations, generated images in the image studio, and your appearance and typeface choices are stored on the device — in your browser’s storage on the web, and in the app’s own container on iOS. They are not uploaded. Signing out erases them.
What Loom does not do
- There is no advertising, no analytics service, no tracking SDK and no third-party cookie. Nothing tracks you across other apps or websites.
- Your data is never sold, rented, or shared for advertising.
- Your conversations are not used to train any model by Loom, and the providers below are used through interfaces that do not contribute your prompts to training.
- Loom does not ask for your location, contacts, calendar, or health data. The iOS app asks for the photo library and the microphone only when you attach a picture or record a voice message.
Who else sees it
Running the app means handing parts of your data to the services it is built on. Each is used for one job and nothing else.
- Neon — the database that holds your account, conversations, workflows and settings.
- Vercel — hosting, file storage, and ordinary server request logs (IP address, time, path), which exist for security and debugging.
- Vercel AI Gateway — passes your message, the conversation it belongs to, and any attached files to the model you picked. The gateway routes to that model’s provider, such as OpenAI, Anthropic or Google. Which provider receives a message is determined entirely by the model selected in the composer. Your email address and name are not sent with it.
- Brave Search — receives a search query when the model uses the web search tool. You can turn that tool off in Settings.
- CivitAI and OpenAI — receive the prompt and parameters when you generate a picture in the image studio or run a workflow node that calls them. Only used if you use those features.
How long it is kept
- Conversations, files, workflows and settings are kept until you delete them or delete your account. There is no automatic expiry.
- Deleting a conversation deletes its messages, its summary and its attachments immediately.
- Generated images in the image studio are held on the server only long enough for your device to collect them, and are cleared within about a day.
Deleting your account
You can delete your account from inside the app: Settings → Account → Delete account on iOS, and the same place on the web. No email, no form, and no request to anyone.
Deleting signs you out on every device and starts a 24-hour window. During that window nothing has been erased and the deletion can be undone by signing back in and pressing Cancel — this exists so that one mistaken tap is not permanent. After the window closes, a scheduled job erases your conversations, messages, uploaded files, summaries, workflows, runs and settings. That erasure is permanent and there is no backup copy to restore from. The job runs on a schedule, so deletion completes at least 24 hours after you ask and normally within 48.
Your sign-in record — the email address and password hash held by Neon Auth — is removed the next time that account contacts Loom, which is what any attempt to sign in with it does. Until then it cannot be used to reach anything: the data it pointed at is already gone. If you would like that record removed sooner, use the contact address below.
Your rights
You can read everything Loom holds about you from inside the app, since it is your conversations and your settings. You can correct your name at any time, delete individual conversations, and delete the whole account as described above. If you are in the UK, the EU, or another place with data protection law, you also have the right to ask for a copy of your data, to object to how it is handled, and to complain to your data protection authority.
Children
Loom is not directed at children under 13, and accounts are not knowingly created for them.
Changes
If this policy changes, the date at the top changes with it. A change that affects what is collected or who receives it will be announced in the app before it takes effect.
Contact
Contact address not set. Fill in CONTACT_EMAIL before this page goes in front of anyone.