Privacy Policy

Last updated: 23 August 2026

This Privacy Policy explains what information LoreLoom ("we", "us") collects when you use our website and services, how we use it, and the choices you have. By using LoreLoom you agree to the practices described here.

1. Information we collect

• Account information. When you sign up we collect your email address and a display name through our authentication provider, Google Firebase.
• Content you create. Characters, personas, messages, and other content you submit are stored so we can provide the service.
• Usage data. We collect basic technical data such as your IP address, browser type, device information, and pages viewed to keep the service secure and reliable.
• Cookies. We use one first-party session cookie to keep you logged in. We do not use advertising or analytics cookies — see section 3.
• Advertising identifier (Android app only). If you choose to watch a rewarded ad in the LoreLoom Android app, Google's ad SDK reads your device's advertising ID. The website has no advertising and collects no advertising identifier.

2. How we use your information

• To create and manage your account and authenticate you.
• To operate, maintain, and improve LoreLoom's features.
• To enforce our Content Policy and keep the platform safe, including automated moderation of uploaded images and character text.
• To show the optional rewarded ads in our Android app that you can watch in exchange for extra messages, and to credit that reward to the right account.

3. Cookies and advertising

The LoreLoom website shows no advertising. It sets one first-party session cookie so that you stay logged in, and no advertising or analytics cookies. Nothing on the website profiles you across other sites.

Advertising exists only in the LoreLoom Android app, and only as rewarded video: a short ad you choose to watch, in exchange for extra messages that day. There are no banner ads and no ads between screens, and no ad is ever shown to you unless you tap to watch one.

• Who serves them. Google AdMob. Its SDK reads your device's advertising ID and may use Google's Privacy Sandbox on Android APIs to choose the ad, which can make the ad you see personalised.
• What we send. When you finish an ad, Google confirms it to our server directly, so that a reward cannot be faked by a modified app. For that we pass Google your LoreLoom account ID together with a single-use token — this is what makes the messages land on your account rather than someone else's. We do not send Google your email address, your characters, or anything you have written.
• Consent in the EEA, UK and Switzerland. Where the law requires it, the app shows a Google-certified consent message before it ever requests an ad; if consent is required and you have not given it, no ad request is made at all. You can revisit that choice at any time under Settings → Account → Privacy & Ads → Manage ad privacy choices. That control is shown where a consent framework applies to you, so if you are outside those regions you will not see it.
• Turning off personalisation anywhere. On your device, open Settings → Privacy → Ads to delete your advertising ID or opt out of ads personalisation. This applies to every app on the device, not only ours. You can also review Google Ads Settings for your Google account.
• Declining ads costs you nothing. Rewarded ads are one of several ways to get more messages, alongside Orbs and a Loom Plus subscription. Choosing not to watch them does not restrict any feature you would otherwise have.

4. Third-party services

We rely on trusted third parties to operate LoreLoom, including Google Firebase (authentication and database), our AI model providers (to generate character responses), our payment processor (to take payment for Orbs and Loom Plus), and Google AdMob — the last of these only inside the Android app, and only for the rewarded ads described in section 3. These providers process data under their own privacy policies.

5. Data retention

We keep your account and the content you create for as long as your account is active. If you request deletion of your account, we delete your account and the personal information associated with it within 30 days, except where we are legally required to keep records longer. Technical logs and usage data used for security and reliability are kept for a limited period (typically up to 30 days).

6. Children's privacy

LoreLoom requires every account holder to be 18 or older. Content that can be browsed without an account is kept strictly safe for work — see our Content Policy. The service is not intended for anyone under 18, and we do not knowingly collect personal information from minors. Every account must confirm at sign-up that the account holder is 18 or older. If we learn that we have collected data from someone under 18, we will delete that account and its data. If you believe a minor has created an account, contact us through our Contact page.

7. Your rights under the GDPR

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and the personal information associated with it.
• Portability — receive your data in a structured, machine-readable format.
• Restrict or object to certain processing of your information.
• Withdraw consent at any time where processing is based on your consent, including consent to personalised advertising.
• Lodge a complaint with your local data protection supervisory authority.

We process personal information on these legal bases: performance of our contract with you (creating and running your account), our legitimate interests (keeping the service secure and reliable, and funding it through advertising), compliance with legal obligations, and your consent where we ask for it. To exercise any of these rights, reach us through our Contact page.

8. California privacy rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights:

• Right to know what personal information we collect, use, and disclose.
• Right to delete the personal information we hold about you.
• Right to correct inaccurate personal information.
• Right to opt out of the "sale" or "sharing" of personal information. LoreLoom does not sell your personal information. The LoreLoom website involves no advertising and no sharing for advertising at all. In the Android app, the advertising identifier used to serve a rewarded ad you have chosen to watch (section 3) may be considered "sharing" for cross-context behavioural advertising under California law. You can opt out by not watching rewarded ads, by opting out of ads personalisation in your device settings, or by contacting us.
• Right to non-discrimination — we will not treat you differently for exercising any of these rights.

To exercise these rights, contact us through our Contact page with the subject "Do Not Sell or Share My Personal Information".

9. International data transfers

LoreLoom relies on providers that operate globally — Google Firebase stores data in the United States and other countries, and our AI model and payment providers may process data outside your country of residence. Where we transfer personal information internationally, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses, to protect it.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

11. Contact

Questions about this policy? Reach us through our Contact page.