Privacy Policy
Last updated: 13 October 2026
This policy explains what personal data Loopit collects, why we collect it, how long we keep it, and the rights you have over it. It applies to the Loopit apps and to this website.
Who is responsible
The controller for the processing described here is:
Liebsch & Roßkamp GbRMetzstr. 8, 81667 München
Represented by Jonas Roßkamp & Paul Hoffmann-Liebsch
Email: info@hexagonstudios.de
For any question about your data, or to exercise the rights described below, write to support@loopit.hexagonstudios.de.
What data we process
Account data
Your email address, whether it has been confirmed, the date you registered, and a cryptographic hash of your password. We never store your password itself. If you deactivate your account, we also store the date on which you did so.
Every account also has a random identifier that we generate when you register. It contains nothing about you and cannot be worked out from your email address. We use it to assign your in-app purchases to your account (see "Who receives your data").
If you make a purchase in the app, RevenueCat reports its status back to us: the product, when it was bought and when it ends, whether it renews, the app store it was bought in, and whether a charge failed. We store this with your account so that the purchase applies on all your devices and so that we can help you with questions about it. We do not receive your payment details.
To confirm your email address we send you a link and a six-digit code. Until you have used one of them, we store a cryptographic hash of that code, the time it was issued and the number of wrong attempts made with it. We delete this record as soon as your address is confirmed. To keep the code from being guessed, we also note the IP address a code is entered from for one minute.
Profile data
A display name, a short biography, a status text and an avatar image URL. All of these are optional and stay empty unless you fill them in.
We also store the language you use the app in (currently English or German). Your app sends it when you register and again whenever you change its language. We use it so that our service emails, including the automatic reminder before an inactive account is deleted, reach you in that language. If no language is stored, we write to you in English.
Contact details
Optionally a salutation, first and last name, street and house number, postcode, city and phone number. The app works without any of this; we only store what you choose to enter.
Your content
The cycles you create and the items inside them: their names, the message and emoji attached to each item, its duration and position, whether the cycle loops, when each cycle and item was created on our servers and last changed, and the identifiers your app assigns so it can synchronise across your devices.
How you use your cycles
When you run a cycle, your app reports each run to us: which cycle it was, when the run started and ended, the calendar day on your device at that moment, how many seconds the timer actually ran, and whether the cycle ran in full without a step being skipped or time being fast-forwarded. We use this to show you, on all your devices, how often and for how long you have run each cycle, and to work out your streak, meaning the number of days in a row on which you completed at least one cycle.
If you delete a cycle, the record of its runs stays until your account is deleted, because your streak is worked out from it. It is then no longer linked to a cycle.
If you use the free version, we also store the calendar day on your device on which you last changed your free cycle, and whether you have ever deleted all your cycles. The app needs both to apply the free version's daily limit on all your devices and after a reinstall.
Technical data
Our application log records the HTTP method, the requested path, the response status and how long the request took. It does not record IP addresses or your identity. Our web server keeps a separate access log which, like any web server, does include the IP address of the connecting device.
Email delivery data
When we cannot reach our mail provider, the affected message — its subject, its content and your email address — is stored in our database so it can be sent again later instead of being lost. See How long we keep your data below.
Cookies
This website sets no cookies and uses no analytics or tracking tools. It stores nothing on your device and reads nothing from it. Fonts, images and scripts come from our own server, not from third parties. Consent under Section 25 of the German TDDDG is therefore not required, which is why we do not ask for it.
The notice at the bottom of the home page says the same in short. Closing it is not remembered either, so it appears again on your next visit.
Separate from this is the technical access data, such as your IP address and the time of the request. It arises whenever a website is opened and is needed to deliver the page. What happens to it is described above under Technical data.
The one exception is our internal administration area, which is not open to visitors: signing in there sets strictly necessary cookies.
Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, synchronising your cycles across your devices, showing you how you have used them and your streak, sending you service emails such as email confirmation and password resets | Performance of a contract, Art. 6(1)(b) GDPR |
| Managing your in-app purchases, so that a purchase applies to your account on all your devices | Performance of a contract, Art. 6(1)(b) GDPR |
| Keeping the service secure and available: server logs, abuse and error diagnosis, backups | Legitimate interests, Art. 6(1)(f) GDPR — operating a service that works and is not abused |
| Responding to requests you send us | Performance of a contract, Art. 6(1)(b), or legitimate interests, Art. 6(1)(f) GDPR |
| Complying with legal obligations where they apply | Legal obligation, Art. 6(1)(c) GDPR |
Who receives your data
We do not sell your data and we do not share it for advertising. Your data is processed on our behalf by the following service providers, each bound by a data processing agreement:
- Hetzner Online GmbH — hosting of our servers and databases, in data centres in Germany.
- STRATO GmbH — delivery of our service emails, in Germany.
- RevenueCat, Inc. (USA) — management of your in-app purchases. When you make or restore a purchase in the app, RevenueCat receives the random identifier of your account, the details of the purchase (product, time, term and the app store's purchase receipt) and the language and currency of your device. RevenueCat does not receive your email address, your name or your content. The payment itself is handled by Apple or Google; neither we nor RevenueCat receive your payment details.
- An external uptime monitor — periodically requests our public health-check endpoint. It receives no personal data.
If you installed the app from an app store, your relationship with Apple or Google is governed by their own privacy policies. We do not receive your data from them beyond what you enter in the app.
Transfers outside the EU
Your data is stored and processed in Germany. The only exception is the management of in-app purchases: for that, the purchase data named above and the identifier of your account are transferred to RevenueCat in the USA, on the basis of the European Commission's standard contractual clauses. If you buy nothing, your data does not leave the EU.
How long we keep your data
- While your account exists, we keep your account data, profile, contact details, cycles and the record of your cycle runs so the service can work.
- After you deactivate your account, you can no longer sign in, and everything listed above is permanently deleted 30 days later. The delay exists so an accidental deactivation can still be undone.
- If you stop using Loopit altogether, we do not keep your data forever. After 730 days without any use of your account, it is deleted along with everything in it. We email you 30 days before that happens, and simply signing in again cancels the deletion.
- Backups are kept on a rolling schedule of seven daily, four weekly and six monthly copies. Deleted data therefore disappears from our backups within six months at the latest, not immediately.
- Purchase data: when your account is deleted, we delete your purchase status and have your customer record at RevenueCat deleted as well. This does not cancel a running subscription. Only you can do that, in the settings of your app store.
- Stored service emails (see above) are currently retained beyond the deletion of the account they relate to. We are working on pruning them automatically; until then you can ask us to remove them, and we will.
See Deleting your account for exactly what is removed and how to delete your account yourself at any time.
Your rights
Under the GDPR you have the right to:
- Access (Art. 15) — obtain a copy of the data we hold about you.
- Rectification (Art. 16) — have inaccurate data corrected. Most of it you can edit yourself in the app.
- Erasure (Art. 17) — have your data deleted. See Deleting your account.
- Restriction (Art. 18) — have processing limited while a dispute is resolved.
- Data portability (Art. 20) — receive your data in a structured, machine-readable format.
- Objection (Art. 21) — object to processing based on our legitimate interests.
To exercise any of these, email support@loopit.hexagonstudios.de. We answer without undue delay and within one month at the latest. You also have the right to lodge a complaint with a data protection supervisory authority, normally the one for your place of residence or for our registered office.
Automated decision-making
We do not profile you and we make no automated decisions that produce legal effects for you.
How we protect your data
All traffic between your devices and our servers is encrypted with TLS. Passwords are stored only as salted hashes. Sign-in uses short-lived access tokens with rotating refresh tokens, so a stolen token has limited value and reuse is detected. Access to production systems is restricted to the people who operate the service.
Changes to this policy
We update this policy when the service changes. The date at the top always shows the current version. If a change materially affects you, we will tell you in the app or by email.