Privacy Policy
Last updated: 19 August 2026
This policy explains what personal data Loopit collects, why we collect it, how long we keep it, and the rights you have over it. It applies to the Loopit apps and to this website.
Who is responsible
The controller for the processing described here is:
Liebsch & Roßkamp GbRMetzstr. 8, 81667 München
Represented by Jonas Roßkamp & Paul Liebsch
Email: info@hexagonstudios.de
For any question about your data, or to exercise the rights described below, write to support@loopit.hexagonstudios.de.
What data we process
Account data
Your email address, whether it has been confirmed, the date you registered, and a cryptographic hash of your password. We never store your password itself. If you deactivate your account, we also store the date on which you did so.
Profile data
A display name, a short biography, a status text and an avatar image URL. All of these are optional and stay empty unless you fill them in.
Contact details
Optionally a salutation, first and last name, street and house number, postcode, city and phone number. The app works without any of this; we only store what you choose to enter.
Your content
The cycles you create and the items inside them: their names, the message and emoji attached to each item, its duration and position, whether the cycle loops, and the identifiers your app assigns so it can synchronise across your devices.
Technical data
Our application log records the HTTP method, the requested path, the response status and how long the request took. It does not record IP addresses or your identity. Our web server keeps a separate access log which, like any web server, does include the IP address of the connecting device.
Email delivery data
When we cannot reach our mail provider, the affected message — its subject, its content and your email address — is stored in our database so it can be sent again later instead of being lost. See How long we keep your data below.
Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, synchronising your cycles across your devices, sending you service emails such as email confirmation and password resets | Performance of a contract, Art. 6(1)(b) GDPR |
| Keeping the service secure and available: server logs, abuse and error diagnosis, backups | Legitimate interests, Art. 6(1)(f) GDPR — operating a service that works and is not abused |
| Responding to requests you send us | Performance of a contract, Art. 6(1)(b), or legitimate interests, Art. 6(1)(f) GDPR |
| Complying with legal obligations where they apply | Legal obligation, Art. 6(1)(c) GDPR |
Who receives your data
We do not sell your data and we do not share it for advertising. Your data is processed on our behalf by the following service providers, each bound by a data processing agreement:
- Hetzner Online GmbH — hosting of our servers and databases, in data centres in Germany.
- STRATO GmbH — delivery of our service emails, in Germany.
- An external uptime monitor — periodically requests our public health-check endpoint. It receives no personal data.
If you installed the app from an app store, your relationship with Apple or Google is governed by their own privacy policies. We do not receive your data from them beyond what you enter in the app.
Transfers outside the EU
Your data is stored and processed in Germany. We do not transfer it to countries outside the European Economic Area.
How long we keep your data
- While your account exists, we keep your account data, profile, contact details and cycles so the service can work.
- After you deactivate your account, you can no longer sign in, and everything listed above is permanently deleted 30 days later. The delay exists so an accidental deactivation can still be undone.
- If you stop using Loopit altogether, we do not keep your data forever. After 730 days without any use of your account, it is deleted along with everything in it. We email you 30 days before that happens, and simply signing in again cancels the deletion.
- Backups are kept on a rolling schedule of seven daily, four weekly and six monthly copies. Deleted data therefore disappears from our backups within six months at the latest, not immediately.
- Stored service emails (see above) are currently retained beyond the deletion of the account they relate to. We are working on pruning them automatically; until then you can ask us to remove them, and we will.
See Deleting your account for exactly what is removed and how to delete your account yourself at any time.
Your rights
Under the GDPR you have the right to:
- Access (Art. 15) — obtain a copy of the data we hold about you.
- Rectification (Art. 16) — have inaccurate data corrected. Most of it you can edit yourself in the app.
- Erasure (Art. 17) — have your data deleted. See Deleting your account.
- Restriction (Art. 18) — have processing limited while a dispute is resolved.
- Data portability (Art. 20) — receive your data in a structured, machine-readable format.
- Objection (Art. 21) — object to processing based on our legitimate interests.
To exercise any of these, email support@loopit.hexagonstudios.de. We answer without undue delay and within one month at the latest. You also have the right to lodge a complaint with a data protection supervisory authority, normally the one for your place of residence or for our registered office.
Automated decision-making
We do not profile you and we make no automated decisions that produce legal effects for you.
How we protect your data
All traffic between your devices and our servers is encrypted with TLS. Passwords are stored only as salted hashes. Sign-in uses short-lived access tokens with rotating refresh tokens, so a stolen token has limited value and reuse is detected. Access to production systems is restricted to the people who operate the service.
Changes to this policy
We update this policy when the service changes. The date at the top always shows the current version. If a change materially affects you, we will tell you in the app or by email.